From patchwork Mon Jun 13 12:13:53 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 9172787 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 58C596075D for ; Mon, 13 Jun 2016 12:14:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 49EB5200E7 for ; Mon, 13 Jun 2016 12:14:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3E946200F5; Mon, 13 Jun 2016 12:14:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.9 required=2.0 tests=BAYES_00,FSL_HELO_HOME, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D4C01200E7 for ; Mon, 13 Jun 2016 12:14:39 +0000 (UTC) Received: from localhost ([::1]:56063 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCQlK-00049O-Uo for patchwork-qemu-devel@patchwork.kernel.org; Mon, 13 Jun 2016 08:14:39 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60653) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCQkp-00043y-BU for qemu-devel@nongnu.org; Mon, 13 Jun 2016 08:14:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bCQki-0003k5-5I for qemu-devel@nongnu.org; Mon, 13 Jun 2016 08:14:06 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47945) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCQkh-0003k1-TQ for qemu-devel@nongnu.org; Mon, 13 Jun 2016 08:14:00 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 97C8164089 for ; Mon, 13 Jun 2016 12:13:59 +0000 (UTC) Received: from t530wlan.home.berrange.com.com (vpn1-6-162.ams2.redhat.com [10.36.6.162]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u5DCDuLR022431; Mon, 13 Jun 2016 08:13:58 -0400 From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Mon, 13 Jun 2016 13:13:53 +0100 Message-Id: <1465820033-5078-3-git-send-email-berrange@redhat.com> In-Reply-To: <1465820033-5078-1-git-send-email-berrange@redhat.com> References: <1465820033-5078-1-git-send-email-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Mon, 13 Jun 2016 12:13:59 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 2/2] crypto: allow default TLS priority to be chosen at build time X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP Modern gnutls can use a global config file to control the crypto priority settings for TLS connections. For example the priority string "@SYSTEM" instructs gnutls to find the priority setting named "SYSTEM" in the global config file. Latest gnutls GIT codebase gained the ability to reference multiple priority strings in the config file, with the first one that is found to existing winning. This means it is now possible to configure QEMU out of the box with a default priority of "@QEMU,SYSTEM", which says to look for the settings "QEMU" first, and if not found, use the "SYSTEM" settings. To make use of this facility, we introduce the ability to set the QEMU default priority at build time via a new configure argument. It is anticipated that distro vendors will set this when building QEMU to a suitable value for use with distro crypto policy setup. eg current Fedora would run ./configure --tls-priority=@SYSTEM while future Fedora would run ./configure --tls-priority=@QEMU,SYSTEM Signed-off-by: Daniel P. Berrange --- configure | 6 ++++++ crypto/tlssession.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/configure b/configure index 8c2f90b..2afaf28 100755 --- a/configure +++ b/configure @@ -306,6 +306,7 @@ archipelago="no" gtk="" gtkabi="" gtk_gl="no" +tls_priority="NORMAL" gnutls="" gnutls_hash="" gnutls_rnd="" @@ -1098,6 +1099,8 @@ for opt do ;; --enable-gtk) gtk="yes" ;; + --tls-priority=*) tls_priority="$optarg" + ;; --disable-gnutls) gnutls="no" ;; --enable-gnutls) gnutls="yes" @@ -1302,6 +1305,7 @@ Advanced options (experts only): --disable-blobs disable installing provided firmware blobs --with-vss-sdk=SDK-path enable Windows VSS support in QEMU Guest Agent --with-win-sdk=SDK-path path to Windows Platform SDK (to build VSS .tlb) + --tls-priority default TLS protocol/cipher priority string Optional features, enabled with --enable-FEATURE and disabled with --disable-FEATURE, default is enabled if available: @@ -4815,6 +4819,7 @@ echo "SDL support $sdl $(echo_version $sdl $sdlversion)" echo "GTK support $gtk $(echo_version $gtk $gtk_version)" echo "GTK GL support $gtk_gl" echo "VTE support $vte $(echo_version $vte $vteversion)" +echo "TLS priority $tls_priority" echo "GNUTLS support $gnutls" echo "GNUTLS hash $gnutls_hash" echo "GNUTLS rnd $gnutls_rnd" @@ -5180,6 +5185,7 @@ if test "$gtk" = "yes" ; then echo "CONFIG_GTK_GL=y" >> $config_host_mak fi fi +echo "CONFIG_TLS_PRIORITY=\"$tls_priority\"" >> $config_host_mak if test "$gnutls" = "yes" ; then echo "CONFIG_GNUTLS=y" >> $config_host_mak fi diff --git a/crypto/tlssession.c b/crypto/tlssession.c index 2112d29..2de42c6 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -137,7 +137,7 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds, if (creds->priority != NULL) { prio = g_strdup_printf("%s:+ANON-DH", creds->priority); } else { - prio = g_strdup("NORMAL:+ANON-DH"); + prio = g_strdup(CONFIG_TLS_PRIORITY ":+ANON-DH"); } ret = gnutls_priority_set_direct(session->handle, prio, NULL); @@ -167,7 +167,7 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds, QCryptoTLSCredsX509 *tcreds = QCRYPTO_TLS_CREDS_X509(creds); const char *prio = creds->priority; if (!prio) { - prio = "NORMAL"; + prio = CONFIG_TLS_PRIORITY; } ret = gnutls_priority_set_direct(session->handle, prio, NULL);