From nobody Sat Nov 15 11:14:43 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=suse.de ARC-Seal: i=1; a=rsa-sha256; t=1753227868; cv=none; d=zohomail.com; s=zohoarc; b=J1OpFbIVLdhF3KS/hSymofd48kgklaStSGldLgJUM0W0hJTF2hqtwMEGTZUi0+dZlFnWM0vuP10nhluA3PJxgfDpFoURVZMe2uYaiYyRoH89ljA17zTFMH5hxxmUXaMEjFzFZuacIzBaxWDTZZMiIXis7iacSzmmhSdecKzayE4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1753227868; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jZZh+ZVa3T5k6vTaImGQ/AbOZe7gkNeo6VdPQTexAdg=; b=an/ma2ng1aeBhVRVmMPUXvyzT4B3h2Xn0WgtkLfgOkW0/AT3MVA/ssMCnBpqiWHjysQLQgg+nmdlLMFbZW10Mm58t4GHAui2Lfj0DP01pORppYkDlz9Nms14bZtxSGSTJaR4LNqYgj3GeSrnmXF9QpOTeSowRelfg0mv+qDg2mg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1753227868702669.9111969765685; Tue, 22 Jul 2025 16:44:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ueMdy-0002jm-Cd; Tue, 22 Jul 2025 19:43:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ueMdQ-0002aD-Av for qemu-devel@nongnu.org; Tue, 22 Jul 2025 19:43:02 -0400 Received: from smtp-out2.suse.de ([195.135.223.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ueMdO-0007t3-J2 for qemu-devel@nongnu.org; Tue, 22 Jul 2025 19:42:59 -0400 Received: from imap1.dmz-prg2.suse.org (unknown [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 045211F7B5; Tue, 22 Jul 2025 23:42:33 +0000 (UTC) Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id A6FE013A32; Tue, 22 Jul 2025 23:42:31 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id qFgnGechgGiqOgAAD6G6ig (envelope-from ); Tue, 22 Jul 2025 23:42:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1753227753; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jZZh+ZVa3T5k6vTaImGQ/AbOZe7gkNeo6VdPQTexAdg=; b=c5Sdy7JDGgvNeN+YG3ps+AR/dRQAeultV4WHn/dXRh4mkycGxw847Z9RiHvnr+pqbqfony Aabm2ce8VEmmeFtdZjhESPSt1pMbWNl/i/xIfU4uKG4jNHrnUdVEkkSnXiXK1iafxNXCgH 8kRldLLfniw8prarRd2QTkf/28voigc= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1753227753; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jZZh+ZVa3T5k6vTaImGQ/AbOZe7gkNeo6VdPQTexAdg=; b=0o8t8Fy2vz7w49WsHcC6dB+2J8+iEJVPuiJFrdKPedtdj8twdyO2u4h1jMbMIi7aM0tuSO msdSdmxCkdg7jDBw== Authentication-Results: smtp-out2.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1753227753; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jZZh+ZVa3T5k6vTaImGQ/AbOZe7gkNeo6VdPQTexAdg=; b=c5Sdy7JDGgvNeN+YG3ps+AR/dRQAeultV4WHn/dXRh4mkycGxw847Z9RiHvnr+pqbqfony Aabm2ce8VEmmeFtdZjhESPSt1pMbWNl/i/xIfU4uKG4jNHrnUdVEkkSnXiXK1iafxNXCgH 8kRldLLfniw8prarRd2QTkf/28voigc= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1753227753; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jZZh+ZVa3T5k6vTaImGQ/AbOZe7gkNeo6VdPQTexAdg=; b=0o8t8Fy2vz7w49WsHcC6dB+2J8+iEJVPuiJFrdKPedtdj8twdyO2u4h1jMbMIi7aM0tuSO msdSdmxCkdg7jDBw== From: Fabiano Rosas To: qemu-devel@nongnu.org Cc: Peter Xu , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Subject: [PULL 7/7] crypto: add tracing & warning about GNUTLS countermeasures Date: Tue, 22 Jul 2025 20:42:15 -0300 Message-Id: <20250722234215.6807-8-farosas@suse.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20250722234215.6807-1-farosas@suse.de> References: <20250722234215.6807-1-farosas@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Spamd-Result: default: False [-3.30 / 50.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.20)[-0.999]; MIME_GOOD(-0.10)[text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; RCVD_TLS_ALL(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; FUZZY_RATELIMITED(0.00)[rspamd.com]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; FROM_EQ_ENVFROM(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; DBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo, suse.de:email, suse.de:mid] X-Spam-Score: -3.30 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=195.135.223.131; envelope-from=farosas@suse.de; helo=smtp-out2.suse.de X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @suse.de) X-ZM-MESSAGEID: 1753227870489116600 From: Daniel P. Berrang=C3=A9 We want some visibility on stderr when the GNUTLS thread safety countermeasures are activated, to encourage people to get the real fix deployed (once it exists). Some trace points will also help if we see any further wierd crash scenario we've not anticipated. Reviewed-by: Daniel P. Berrang=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-5-berrange@= redhat.com [add missing include] Signed-off-by: Fabiano Rosas --- crypto/tlssession.c | 11 +++++++++++ crypto/trace-events | 2 ++ 2 files changed, 13 insertions(+) diff --git a/crypto/tlssession.c b/crypto/tlssession.c index baef878fa0..86d407a142 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -19,6 +19,7 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/error-report.h" #include "qemu/thread.h" #include "crypto/tlssession.h" #include "crypto/tlscredsanon.h" @@ -615,10 +616,20 @@ qcrypto_tls_session_handshake(QCryptoTLSSession *sess= ion, * only have to protect against automatic rekeying * which doesn't trigger with CHACHA20 */ + trace_qcrypto_tls_session_parameters( + session, + session->requireThreadSafety, + gnutls_protocol_get_version(session->handle), + cipher); + if (session->requireThreadSafety && gnutls_protocol_get_version(session->handle) =3D=3D GNUTLS_TLS1_3 && cipher !=3D GNUTLS_CIPHER_CHACHA20_POLY1305) { + warn_report("WARNING: activating thread safety countermeasures= " + "for potentially broken GNUTLS with TLS1.3 cipher= =3D%d", + cipher); + trace_qcrypto_tls_session_bug1717_workaround(session); session->lockEnabled =3D true; } #endif diff --git a/crypto/trace-events b/crypto/trace-events index bccd0bbf29..d0e33427fa 100644 --- a/crypto/trace-events +++ b/crypto/trace-events @@ -21,6 +21,8 @@ qcrypto_tls_creds_x509_load_cert_list(void *creds, const = char *file) "TLS creds # tlssession.c qcrypto_tls_session_new(void *session, void *creds, const char *hostname, = const char *authzid, int endpoint) "TLS session new session=3D%p creds=3D%p= hostname=3D%s authzid=3D%s endpoint=3D%d" qcrypto_tls_session_check_creds(void *session, const char *status) "TLS se= ssion check creds session=3D%p status=3D%s" +qcrypto_tls_session_parameters(void *session, int threadSafety, int protoc= ol, int cipher) "TLS session parameters session=3D%p threadSafety=3D%d prot= ocol=3D%d cipher=3D%d" +qcrypto_tls_session_bug1717_workaround(void *session) "TLS session bug1717= workaround session=3D%p" =20 # tls-cipher-suites.c qcrypto_tls_cipher_suite_priority(const char *name) "priority: %s" --=20 2.35.3