KTLS: fallback to default

If an error occurs during setting of keys either initial or key update
then fallback to default mode of operation (disable ktls) and let the
user know

Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

diff --git a/lib/handshake.c b/lib/handshake.c
index cb2bc3ae9c729bfc7f6545e83a2c1416e53a6839..14bcdea56a4be88e2805e3662530e792842835df 100644 (file)
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -2924,7 +2924,12 @@ int gnutls_handshake(gnutls_session_t session)
 
 #ifdef ENABLE_KTLS
        if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_DUPLEX)) {
-               _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX);
+               ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX);
+               if (ret < 0) {
+                       session->internals.ktls_enabled = 0;
+                       _gnutls_audit_log(session,
+                                         "disabling KTLS: failed to set keys\n");
+               }
        }
 #endif
 

diff --git a/lib/tls13/key_update.c b/lib/tls13/key_update.c
index 10c0a9110961f482ff28fdedeb256b4d581b3f4f..acfda41290f6a130cbdbc880ea67657c24bd3b25 100644 (file)
--- a/lib/tls13/key_update.c
+++ b/lib/tls13/key_update.c
@@ -32,6 +32,20 @@
 #define KEY_UPDATES_WINDOW 1000
 #define KEY_UPDATES_PER_WINDOW 8
 
+/*
+ * Sets kTLS keys if enabled.
+ * If this operation fails with GNUTLS_E_INTERNAL_ERROR, KTLS is disabled
+ * because KTLS most likely doesn't support key update.
+ */
+#define SET_KTLS_KEYS(session, interface)\
+{\
+       if(_gnutls_ktls_set_keys(session, interface) < 0) {\
+               session->internals.ktls_enabled = 0;\
+               _gnutls_audit_log(session, \
+                         "disabling KTLS: couldn't update keys\n");\
+       }\
+}
+
 static int update_keys(gnutls_session_t session, hs_stage_t stage)
 {
        int ret;
@@ -51,15 +65,16 @@ static int update_keys(gnutls_session_t session, hs_stage_t stage)
        if (session->internals.recv_state == RECV_STATE_EARLY_START) {
                ret = _tls13_write_connection_state_init(session, stage);
                if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND))
-                       ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND);
+                       SET_KTLS_KEYS(session,  GNUTLS_KTLS_SEND)
        } else {
                ret = _tls13_connection_state_init(session, stage);
+               if (ret < 0)
+                       return gnutls_assert_val(ret);
 
                if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND) && stage == STAGE_UPD_OURS)
-                       ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND);
+                       SET_KTLS_KEYS(session, GNUTLS_KTLS_SEND)
                else if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_RECV) && stage == STAGE_UPD_PEERS)
-                       ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_RECV);
-
+                       SET_KTLS_KEYS(session, GNUTLS_KTLS_RECV)
        }
        if (ret < 0)
                return gnutls_assert_val(ret);