KTLS: Invalidate session on ktls error

We invalidate the session if an KTLS related error occurs after it was
initialized i.e. keys were set on the interfaces.

As of now this only affects key_update() which should be fixed via a
kernel patch. Thus future fallback mechanism implementation is not likely
as that would require yet another kernel patch.

Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

diff --git a/lib/handshake.c b/lib/handshake.c
index 14bcdea56a4be88e2805e3662530e792842835df..044b70e2a8e38b20ebf02ca52949d172b7f81cc0 100644 (file)
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -2926,6 +2926,7 @@ int gnutls_handshake(gnutls_session_t session)
        if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_DUPLEX)) {
                ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX);
                if (ret < 0) {
+                       /* no need to invalidate the session as keys were not set */
                        session->internals.ktls_enabled = 0;
                        _gnutls_audit_log(session,
                                          "disabling KTLS: failed to set keys\n");

diff --git a/lib/tls13/key_update.c b/lib/tls13/key_update.c
index acfda41290f6a130cbdbc880ea67657c24bd3b25..56fecfaa65f46d07dc43d1a04a624d168fe7d480 100644 (file)
--- a/lib/tls13/key_update.c
+++ b/lib/tls13/key_update.c
@@ -39,11 +39,14 @@
  */
 #define SET_KTLS_KEYS(session, interface)\
 {\
-       if(_gnutls_ktls_set_keys(session, interface) < 0) {\
+if(_gnutls_ktls_set_keys(session, interface) < 0) {\
                session->internals.ktls_enabled = 0;\
-               _gnutls_audit_log(session, \
-                         "disabling KTLS: couldn't update keys\n");\
-       }\
+               session->internals.invalid_connection = true;\
+               session->internals.resumable = false;\
+               _gnutls_audit_log(session,\
+                       "invalidating session: KTLS - couldn't update keys\n");\
+               ret = GNUTLS_E_INTERNAL_ERROR;\
+}\
 }
 
 static int update_keys(gnutls_session_t session, hs_stage_t stage)
@@ -64,6 +67,9 @@ static int update_keys(gnutls_session_t session, hs_stage_t stage)
         * write keys */
        if (session->internals.recv_state == RECV_STATE_EARLY_START) {
                ret = _tls13_write_connection_state_init(session, stage);
+               if (ret < 0)
+                       return gnutls_assert_val(ret);
+
                if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND))
                        SET_KTLS_KEYS(session,  GNUTLS_KTLS_SEND)
        } else {