From f41151c8a218f255af08362b74cd6ee0dfd45c00 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Franti=C5=A1ek=20Kren=C5=BEelok?=

 <krenzelok.frantisek@gmail.com>

Date: Tue, 14 Jun 2022 16:16:11 +0200

Subject: [PATCH] KTLS: disable by default enable by config

KTLS will be disabled by default when build with `--enable-ktls` to

enable it, use config file option `ktls = true` in [global] section.

Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

---

 doc/cha-config.texi | 18 ++++++++----------

 lib/gnutls_int.h    |  2 +-

 lib/handshake.c     |  2 +-

 lib/priority.c      | 12 ++++++------

 4 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/doc/cha-config.texi b/doc/cha-config.texi

index e550f2e4b1..eaab7fd799 100644

--- a/doc/cha-config.texi

+++ b/doc/cha-config.texi

@@ -26,7 +26,7 @@ used can be queried using @funcref{gnutls_get_system_config_file}.

 * Querying for disabled algorithms and protocols::

 * Overriding the parameter verification profile::

 * Overriding the default priority string::

-* Disabling system/acceleration protocols::

+* Enabling/Disabling system/acceleration protocols::

 @end menu

 @node Application-specific priority strings

@@ -253,16 +253,14 @@ default-priority-string = SECURE128:-VERS-TLS-ALL:+VERS-TLS1.3

 @end example

-@node Disabling system/acceleration protocols

-@section Disabling system/acceleration protocols

-When system/acceleration protocol is enabled during build, it is usually

-enabled by default. The following options can overwrite this behavior

-system-wide.

+@node Enabling/Disabling system/acceleration protocols

+@section Enabling/Disabling system/acceleration protocols

+The following options can overwrite default behavior of protocols system-wide.

 @example

 [global]

-ktls = false

+ktls = true

 @end example

-@subsection Disabling KTLS

-When GnuTLS is build with -–enable-ktls configuration, it uses KTLS by default.

-This can be overwritten by setting @code{ktls = false} in @code{[global]} section.

+@subsection Enabling KTLS

+When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default.

+This can be enabled by setting @code{ktls = true} in @code{[global]} section.

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h

index 872188696b..8c7bdaa1db 100644

--- a/lib/gnutls_int.h

+++ b/lib/gnutls_int.h

@@ -1649,6 +1649,6 @@ get_certificate_type(gnutls_session_t session,

 extern unsigned int _gnutls_global_version;

-bool _gnutls_config_is_ktls_disabled(void);

+bool _gnutls_config_is_ktls_enabled(void);

 #endif /* GNUTLS_LIB_GNUTLS_INT_H */

diff --git a/lib/handshake.c b/lib/handshake.c

index f3edbbdacb..4dd457bf22 100644

--- a/lib/handshake.c

+++ b/lib/handshake.c

@@ -2815,7 +2815,7 @@ int gnutls_handshake(gnutls_session_t session)

 	session->internals.ktls_enabled = 0;

 #ifdef ENABLE_KTLS

-	if (_gnutls_config_is_ktls_disabled() == false)

+	if (_gnutls_config_is_ktls_enabled() == true)

 		_gnutls_ktls_enable(session);

 #endif

diff --git a/lib/priority.c b/lib/priority.c

index 7279c03c88..d163d8169f 100644

--- a/lib/priority.c

+++ b/lib/priority.c

@@ -1027,7 +1027,7 @@ static void dummy_func(gnutls_priority_t c)

 struct cfg {

 	bool allowlisting;

-	bool ktls_disabled;

+	bool ktls_enabled;

 	name_val_array_t priority_strings;

 	char *priority_string;

@@ -1140,7 +1140,7 @@ cfg_steal(struct cfg *dst, struct cfg *src)

 	src->default_priority_string = NULL;

 	dst->allowlisting = src->allowlisting;

-	dst->ktls_disabled = src->ktls_disabled;

+	dst->ktls_enabled = src->ktls_enabled;

 	memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));

 	memcpy(dst->macs, src->macs, sizeof(src->macs));

 	memcpy(dst->groups, src->groups, sizeof(src->groups));

@@ -1268,8 +1268,8 @@ static int global_ini_handler(void *ctx, const char *section, const char *name,

 			}

 		} else if (c_strcasecmp(name, "ktls") == 0) {

 			p = clear_spaces(value, str);

-			if (c_strcasecmp(p, "false") == 0) {

-				cfg->ktls_disabled = true;

+			if (c_strcasecmp(p, "true") == 0) {

+				cfg->ktls_enabled = true;

 			} else {

 				_gnutls_debug_log("cfg: unknown ktls mode %s\n",

 					p);

@@ -3490,6 +3490,6 @@ gnutls_priority_string_list(unsigned iter, unsigned int flags)

 	return NULL;

 }

-bool _gnutls_config_is_ktls_disabled(void){

-	return system_wide_config.ktls_disabled;

+bool _gnutls_config_is_ktls_enabled(void){

+	return system_wide_config.ktls_enabled;

 }

-- 

2.36.1