d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfs tls: Update for SSL_OP_ENABLE_KTLS.

Browse Source 
Upstream OpenSSL (and the KTLS backport) have switched to an opt-in
option (SSL_OP_ENABLE_KTLS) in place of opt-out modes
(SSL_MODE_NO_KTLS_TX and SSL_MODE_NO_KTLS_RX) for controlling kernel
TLS.

Reviewed by:	rmacklem
Sponsored by:	Netflix
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D31445
This commit is contained in:
John Baldwin 2021-08-10 14:18:43 -07:00
parent 38911b3c2c
commit c7bb0f47f7
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c
View File

@ -573,9 +573,14 @@ rpctls_setupcl_ssl(void)
SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
#else
flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1_3;
#endif
#ifdef SSL_OP_ENABLE_KTLS
flags |= SSL_OP_ENABLE_KTLS;
#endif
SSL_CTX_set_options(ctx, flags);
#ifdef SSL_MODE_NO_KTLS_TX
SSL_CTX_clear_mode(ctx, SSL_MODE_NO_KTLS_TX | SSL_MODE_NO_KTLS_RX);
#endif
return (ctx);
}

5
usr.sbin/rpc.tlsservd/rpc.tlsservd.c
View File

@ -636,7 +636,12 @@ rpctls_setup_ssl(const char *certdir)
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,
rpctls_verify_callback);
}
#ifdef SSL_OP_ENABLE_KTLS
SSL_CTX_set_options(ctx, SSL_OP_ENABLE_KTLS);
#endif
#ifdef SSL_MODE_NO_KTLS_TX
SSL_CTX_clear_mode(ctx, SSL_MODE_NO_KTLS_TX | SSL_MODE_NO_KTLS_RX);
#endif
return (ctx);
}