Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tlshd: establish a priority cache at startup time #10

Closed
wants to merge 1 commit into from
Closed

tlshd: establish a priority cache at startup time #10

wants to merge 1 commit into from

Conversation

jtlayton
Copy link
Contributor 

Review of the proposed Fedora package by Petr pointed out that tlshd
doesn't respect system-wide preferences for cipher selection, and just
has a hardcoded list. Also, tlshd builds a new priority string every
time, which adds extra string-parsing overhead and such.

Instead, at startup time, build priority strings (taking the local
system preferences into account) and then use those to create two
gnutls_priority_t objects -- one "normal" and one for pre-shared keys.

Then, just attach the appropriate one to the session in
tlshd_start_tls_handshake.

Reported-by: Petr Pisar <ppisar@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>

@oracle-contributor-agreement
Copy link

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. label Apr 25, 2023
@jtlayton jtlayton changed the base branch from main to ktls-utils-0.9 April 25, 2023 14:31
chucklever
chucklever requested changes Apr 25, 2023
View reviewed changes
Copy link
Member

@chucklever chucklever left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of having a pair of tlshd_gnutls_priority globals, make tlshd_make_priorities_string() set the priority (and change its name).

@jtlayton
Copy link
Contributor Author

Removed the now-defunct prototype for tlshd_make_priorities_string.

@jtlayton
Copy link
Contributor Author

Something like this maybe?

@jtlayton
tlshd: establish a priority cache at startup time
f63fd29 
Review of the proposed Fedora package by Petr pointed out that tlshd
doesn't respect system-wide preferences for cipher selection, and just
has a hardcoded list. Also, tlshd builds a new priority string every
time, which adds extra string-parsing overhead and such.

Instead, at startup time, build priority strings (taking the local
system preferences into account) and then use those to create two
gnutls_priority_t objects -- one "normal" and one for pre-shared keys.

Then, just attach the appropriate one to the session in
tlshd_gnutls_priority_set.

Reported-by: Petr Pisar <ppisar@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
@chucklever
Copy link
Member

I've applied f63fd29 to my private ktls-utils-0.9 for further testing. Thanks for contributing!

@chucklever chucklever closed this Apr 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chucklever chucklever chucklever requested changes

Assignees
No one assigned
Labels
OCA Required At least one contributor does not have an approved Oracle Contributor Agreement.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@jtlayton @chucklever