diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2021-08-10 21:18:43 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2021-08-10 21:18:43 +0000 |
| commit | c7bb0f47f721a2095ed6100bca595ba68fa5645a (patch) | |
| tree | a617cdab6bbac19ba24166f28d2e96c4e16b23b9 | |
| parent | 38911b3c2c7dbb9a097b44856472ebbbedde71fc (diff) | |
nfs tls: Update for SSL_OP_ENABLE_KTLS.
Upstream OpenSSL (and the KTLS backport) have switched to an opt-in
option (SSL_OP_ENABLE_KTLS) in place of opt-out modes
(SSL_MODE_NO_KTLS_TX and SSL_MODE_NO_KTLS_RX) for controlling kernel
TLS.
Reviewed by: rmacklem
Sponsored by: Netflix
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D31445
| -rw-r--r-- | usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c | 5 | ||||
| -rw-r--r-- | usr.sbin/rpc.tlsservd/rpc.tlsservd.c | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c b/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c index af803f203ffd..5e66f4b4b2dd 100644 --- a/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c +++ b/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c @@ -574,8 +574,13 @@ rpctls_setupcl_ssl(void) #else flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1_3; #endif +#ifdef SSL_OP_ENABLE_KTLS + flags |= SSL_OP_ENABLE_KTLS; +#endif SSL_CTX_set_options(ctx, flags); +#ifdef SSL_MODE_NO_KTLS_TX SSL_CTX_clear_mode(ctx, SSL_MODE_NO_KTLS_TX | SSL_MODE_NO_KTLS_RX); +#endif return (ctx); } diff --git a/usr.sbin/rpc.tlsservd/rpc.tlsservd.c b/usr.sbin/rpc.tlsservd/rpc.tlsservd.c index 1c7687cad87a..71787b162acd 100644 --- a/usr.sbin/rpc.tlsservd/rpc.tlsservd.c +++ b/usr.sbin/rpc.tlsservd/rpc.tlsservd.c @@ -636,7 +636,12 @@ rpctls_setup_ssl(const char *certdir) SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, rpctls_verify_callback); } +#ifdef SSL_OP_ENABLE_KTLS + SSL_CTX_set_options(ctx, SSL_OP_ENABLE_KTLS); +#endif +#ifdef SSL_MODE_NO_KTLS_TX SSL_CTX_clear_mode(ctx, SSL_MODE_NO_KTLS_TX | SSL_MODE_NO_KTLS_RX); +#endif return (ctx); } |