[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v10 1/5] crypto: Add tls-cipher-suites object
From: |
Daniel P . Berrangé |
Subject: |
Re: [PATCH v10 1/5] crypto: Add tls-cipher-suites object |
Date: |
Thu, 25 Jun 2020 12:11:54 +0100 |
User-agent: |
Mutt/1.14.0 (2020-05-02) |
On Tue, Jun 23, 2020 at 07:27:22PM +0200, Philippe Mathieu-Daudé wrote:
> On the host OS, various aspects of TLS operation are configurable.
> In particular it is possible for the sysadmin to control the TLS
> cipher/protocol algorithms that applications are permitted to use.
>
> * Any given crypto library has a built-in default priority list
> defined by the distro maintainer of the library package (or by
> upstream).
>
> * The "crypto-policies" RPM (or equivalent host OS package)
> provides a config file such as "/etc/crypto-policies/config",
> where the sysadmin can set a high level (library-independent)
> policy.
>
> The "update-crypto-policies --set" command (or equivalent) is
> used to translate the global policy to individual library
> representations, producing files such as
> "/etc/crypto-policies/back-ends/*.config". The generated files,
> if present, are loaded by the various crypto libraries to
> override their own built-in defaults.
>
> For example, the GNUTLS library may read
> "/etc/crypto-policies/back-ends/gnutls.config".
>
> * A management application (or the QEMU user) may overide the
> system-wide crypto-policies config via their own config, if
> they need to diverge from the former.
>
> Thus the priority order is "QEMU user config" > "crypto-policies
> system config" > "library built-in config".
>
> Introduce the "tls-cipher-suites" object for exposing the ordered
> list of permitted TLS cipher suites from the host side to the
> guest firmware, via fw_cfg. The list is represented as an array
> of bytes.
>
> The priority at which the host-side policy is retrieved is given
> by the "priority" property of the new object type. For example,
> "priority=@SYSTEM" may be used to refer to
> "/etc/crypto-policies/back-ends/gnutls.config" (given that QEMU
> uses GNUTLS).
>
> The firmware uses the IANA_TLS_CIPHER array for configuring
> guest-side TLS, for example in UEFI HTTPS Boot.
>
> [Description from Daniel P. Berrangé, edited by Laszlo Ersek.]
>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> v10: rewrote logic (danpb)
> ---
> include/crypto/tls-cipher-suites.h | 39 ++++++++++
> crypto/tls-cipher-suites.c | 115 +++++++++++++++++++++++++++++
> crypto/Makefile.objs | 1 +
> crypto/trace-events | 5 ++
> qemu-options.hx | 19 +++++
> 5 files changed, 179 insertions(+)
> create mode 100644 include/crypto/tls-cipher-suites.h
> create mode 100644 crypto/tls-cipher-suites.c
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>
> diff --git a/include/crypto/tls-cipher-suites.h
> b/include/crypto/tls-cipher-suites.h
> new file mode 100644
> index 0000000000..1be7917233
> --- /dev/null
> +++ b/include/crypto/tls-cipher-suites.h
> @@ -0,0 +1,39 @@
> +/*
> + * QEMU TLS Cipher Suites Registry (RFC8447)
> + *
> + * Copyright (c) 2019 Red Hat, Inc.
nit-pick, we could make that 2019-2020, likewise other files.
No need to respin just for that though.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
- [PATCH v10 0/5] fw_cfg: Add FW_CFG_DATA_GENERATOR; crypto: Add tls-cipher-suites, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 2/5] hw/nvram/fw_cfg: Add the FW_CFG_DATA_GENERATOR interface, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 3/5] softmmu/vl: Let -fw_cfg option take a 'gen_id' argument, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 1/5] crypto: Add tls-cipher-suites object, Philippe Mathieu-Daudé, 2020/06/23
- Re: [PATCH v10 1/5] crypto: Add tls-cipher-suites object,
Daniel P . Berrangé <=
- [PATCH v10 4/5] softmmu/vl: Allow -fw_cfg 'gen_id' option to use the 'etc/' namespace, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 5/5] crypto/tls-cipher-suites: Produce fw_cfg consumable blob, Philippe Mathieu-Daudé, 2020/06/23
- Re: [PATCH v10 0/5] fw_cfg: Add FW_CFG_DATA_GENERATOR; crypto: Add tls-cipher-suites, Philippe Mathieu-Daudé, 2020/06/23