Re: [PATCH 0/4] Revert obsolete & broken workaround for GNUTLS thread safety bug

[Fabiano Rosas <farosas@suse.de>]

Daniel P. Berrangé <berrange@redhat.com> writes:

> A year or so ago we introduced a workaround for a troubling GNUTLS
> thread safety problem that hits when a bidirectional TLS channel
> is used and "large" amounts of data are transferred triggering
> re-keying under TLS 1.3.
>
> Unfortunately that workaround turned out to not work, and since it
> was close to final freeze we disabled it, rather than attempt last
> minute changes.
>
> Fast forward a year, and GNUTLS has shipped a fix itself and RHEL
> at least has backported the fix to stable releases. A user who
> is still affected can workaround it by disabling TLS 1.3, or
> forcing use of a different cipher to avoid re-keying entirely.
>
> Getting a viable workaround operating correctly in QEMU is going
> to be challenging and fragile long term, so not worth spending
> more time on.
>
> Revert the broken workaround (which was already hardcoded to be
> disabled at build time).
>
> Daniel P. Berrangé (4):
>   Revert "migration: activate TLS thread safety workaround"
>   Revert "io: add support for activating TLS thread safety workaround"
>   Revert "crypto: add tracing & warning about GNUTLS countermeasures"
>   Revert "crypto: implement workaround for GNUTLS thread safety
>     problems"
>
>  crypto/tlssession.c         | 103 ++----------------------------------
>  crypto/trace-events         |   1 -
>  include/crypto/tlssession.h |  14 -----
>  include/io/channel.h        |   1 -
>  io/channel-tls.c            |   5 --
>  meson.build                 |   9 ----
>  migration/tls.c             |   9 ----
>  7 files changed, 3 insertions(+), 139 deletions(-)

Reviewed-by: Fabiano Rosas <farosas@suse.de>