Daniel P. Berrangé <[email protected]> writes: > A year or so ago we introduced a workaround for a troubling GNUTLS > thread safety problem that hits when a bidirectional TLS channel > is used and "large" amounts of data are transferred triggering > re-keying under TLS 1.3. > > Unfortunately that workaround turned out to not work, and since it > was close to final freeze we disabled it, rather than attempt last > minute changes. > > Fast forward a year, and GNUTLS has shipped a fix itself and RHEL > at least has backported the fix to stable releases. A user who > is still affected can workaround it by disabling TLS 1.3, or > forcing use of a different cipher to avoid re-keying entirely. > > Getting a viable workaround operating correctly in QEMU is going > to be challenging and fragile long term, so not worth spending > more time on. > > Revert the broken workaround (which was already hardcoded to be > disabled at build time). > > Daniel P. Berrangé (4): > Revert "migration: activate TLS thread safety workaround" > Revert "io: add support for activating TLS thread safety workaround" > Revert "crypto: add tracing & warning about GNUTLS countermeasures" > Revert "crypto: implement workaround for GNUTLS thread safety > problems" > > crypto/tlssession.c | 103 ++---------------------------------- > crypto/trace-events | 1 - > include/crypto/tlssession.h | 14 ----- > include/io/channel.h | 1 - > io/channel-tls.c | 5 -- > meson.build | 9 ---- > migration/tls.c | 9 ---- > 7 files changed, 3 insertions(+), 139 deletions(-)
Reviewed-by: Fabiano Rosas <[email protected]>
