Blame SOURCES/gnutls-3.7.6-ktls-disable-by-default.patch

cd0318
From f41151c8a218f255af08362b74cd6ee0dfd45c00 Mon Sep 17 00:00:00 2001
cd0318
From: =?UTF-8?q?Franti=C5=A1ek=20Kren=C5=BEelok?=
cd0318
 <krenzelok.frantisek@gmail.com>
cd0318
Date: Tue, 14 Jun 2022 16:16:11 +0200
cd0318
Subject: [PATCH] KTLS: disable by default enable by config
cd0318
cd0318
KTLS will be disabled by default when build with `--enable-ktls` to
cd0318
enable it, use config file option `ktls = true` in [global] section.
cd0318
cd0318
Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
cd0318
---
cd0318
 doc/cha-config.texi | 18 ++++++++----------
cd0318
 lib/gnutls_int.h    |  2 +-
cd0318
 lib/handshake.c     |  2 +-
cd0318
 lib/priority.c      | 12 ++++++------
cd0318
 4 files changed, 16 insertions(+), 18 deletions(-)
cd0318
cd0318
diff --git a/doc/cha-config.texi b/doc/cha-config.texi
cd0318
index e550f2e4b1..eaab7fd799 100644
cd0318
--- a/doc/cha-config.texi
cd0318
+++ b/doc/cha-config.texi
cd0318
@@ -26,7 +26,7 @@ used can be queried using @funcref{gnutls_get_system_config_file}.
cd0318
 * Querying for disabled algorithms and protocols::
cd0318
 * Overriding the parameter verification profile::
cd0318
 * Overriding the default priority string::
cd0318
-* Disabling system/acceleration protocols::
cd0318
+* Enabling/Disabling system/acceleration protocols::
cd0318
 @end menu
cd0318
 
cd0318
 @node Application-specific priority strings
cd0318
@@ -253,16 +253,14 @@ default-priority-string = SECURE128:-VERS-TLS-ALL:+VERS-TLS1.3
cd0318
 @end example
cd0318
 
cd0318
 
cd0318
-@node Disabling system/acceleration protocols
cd0318
-@section Disabling system/acceleration protocols
cd0318
-When system/acceleration protocol is enabled during build, it is usually
cd0318
-enabled by default. The following options can overwrite this behavior
cd0318
-system-wide.
cd0318
+@node Enabling/Disabling system/acceleration protocols
cd0318
+@section Enabling/Disabling system/acceleration protocols
cd0318
+The following options can overwrite default behavior of protocols system-wide.
cd0318
 @example
cd0318
 [global]
cd0318
-ktls = false
cd0318
+ktls = true
cd0318
 
cd0318
 @end example
cd0318
-@subsection Disabling KTLS
cd0318
-When GnuTLS is build with -–enable-ktls configuration, it uses KTLS by default.
cd0318
-This can be overwritten by setting @code{ktls = false} in @code{[global]} section.
cd0318
+@subsection Enabling KTLS
cd0318
+When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default.
cd0318
+This can be enabled by setting @code{ktls = true} in @code{[global]} section.
cd0318
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
cd0318
index 872188696b..8c7bdaa1db 100644
cd0318
--- a/lib/gnutls_int.h
cd0318
+++ b/lib/gnutls_int.h
cd0318
@@ -1649,6 +1649,6 @@ get_certificate_type(gnutls_session_t session,
cd0318
 
cd0318
 extern unsigned int _gnutls_global_version;
cd0318
 
cd0318
-bool _gnutls_config_is_ktls_disabled(void);
cd0318
+bool _gnutls_config_is_ktls_enabled(void);
cd0318
 
cd0318
 #endif /* GNUTLS_LIB_GNUTLS_INT_H */
cd0318
diff --git a/lib/handshake.c b/lib/handshake.c
cd0318
index f3edbbdacb..4dd457bf22 100644
cd0318
--- a/lib/handshake.c
cd0318
+++ b/lib/handshake.c
cd0318
@@ -2815,7 +2815,7 @@ int gnutls_handshake(gnutls_session_t session)
cd0318
 
cd0318
 	session->internals.ktls_enabled = 0;
cd0318
 #ifdef ENABLE_KTLS
cd0318
-	if (_gnutls_config_is_ktls_disabled() == false)
cd0318
+	if (_gnutls_config_is_ktls_enabled() == true)
cd0318
 		_gnutls_ktls_enable(session);
cd0318
 #endif
cd0318
 
cd0318
diff --git a/lib/priority.c b/lib/priority.c
cd0318
index 7279c03c88..d163d8169f 100644
cd0318
--- a/lib/priority.c
cd0318
+++ b/lib/priority.c
cd0318
@@ -1027,7 +1027,7 @@ static void dummy_func(gnutls_priority_t c)
cd0318
 
cd0318
 struct cfg {
cd0318
 	bool allowlisting;
cd0318
-	bool ktls_disabled;
cd0318
+	bool ktls_enabled;
cd0318
 
cd0318
 	name_val_array_t priority_strings;
cd0318
 	char *priority_string;
cd0318
@@ -1140,7 +1140,7 @@ cfg_steal(struct cfg *dst, struct cfg *src)
cd0318
 	src->default_priority_string = NULL;
cd0318
 
cd0318
 	dst->allowlisting = src->allowlisting;
cd0318
-	dst->ktls_disabled = src->ktls_disabled;
cd0318
+	dst->ktls_enabled = src->ktls_enabled;
cd0318
 	memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));
cd0318
 	memcpy(dst->macs, src->macs, sizeof(src->macs));
cd0318
 	memcpy(dst->groups, src->groups, sizeof(src->groups));
cd0318
@@ -1268,8 +1268,8 @@ static int global_ini_handler(void *ctx, const char *section, const char *name,
cd0318
 			}
cd0318
 		} else if (c_strcasecmp(name, "ktls") == 0) {
cd0318
 			p = clear_spaces(value, str);
cd0318
-			if (c_strcasecmp(p, "false") == 0) {
cd0318
-				cfg->ktls_disabled = true;
cd0318
+			if (c_strcasecmp(p, "true") == 0) {
cd0318
+				cfg->ktls_enabled = true;
cd0318
 			} else {
cd0318
 				_gnutls_debug_log("cfg: unknown ktls mode %s\n",
cd0318
 					p);
cd0318
@@ -3490,6 +3490,6 @@ gnutls_priority_string_list(unsigned iter, unsigned int flags)
cd0318
 	return NULL;
cd0318
 }
cd0318
 
cd0318
-bool _gnutls_config_is_ktls_disabled(void){
cd0318
-	return system_wide_config.ktls_disabled;
cd0318
+bool _gnutls_config_is_ktls_enabled(void){
cd0318
+	return system_wide_config.ktls_enabled;
cd0318
 }
cd0318
-- 
cd0318
2.36.1
cd0318