993aec27aa
On the host OS, various aspects of TLS operation are configurable. In particular it is possible for the sysadmin to control the TLS cipher/protocol algorithms that applications are permitted to use. * Any given crypto library has a built-in default priority list defined by the distro maintainer of the library package (or by upstream). * The "crypto-policies" RPM (or equivalent host OS package) provides a config file such as "/etc/crypto-policies/config", where the sysadmin can set a high level (library-independent) policy. The "update-crypto-policies --set" command (or equivalent) is used to translate the global policy to individual library representations, producing files such as "/etc/crypto-policies/back-ends/*.config". The generated files, if present, are loaded by the various crypto libraries to override their own built-in defaults. For example, the GNUTLS library may read "/etc/crypto-policies/back-ends/gnutls.config". * A management application (or the QEMU user) may overide the system-wide crypto-policies config via their own config, if they need to diverge from the former. Thus the priority order is "QEMU user config" > "crypto-policies system config" > "library built-in config". Introduce the "tls-cipher-suites" object for exposing the ordered list of permitted TLS cipher suites from the host side to the guest firmware, via fw_cfg. The list is represented as an array of bytes. The priority at which the host-side policy is retrieved is given by the "priority" property of the new object type. For example, "priority=@SYSTEM" may be used to refer to "/etc/crypto-policies/back-ends/gnutls.config" (given that QEMU uses GNUTLS). The firmware uses the IANA_TLS_CIPHER array for configuring guest-side TLS, for example in UEFI HTTPS Boot. [Description from Daniel P. Berrangé, edited by Laszlo Ersek.] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20200623172726.21040-2-philmd@redhat.com>
44 lines
1.7 KiB
Makefile
44 lines
1.7 KiB
Makefile
crypto-obj-y = init.o
|
|
crypto-obj-y += hash.o
|
|
crypto-obj-$(CONFIG_NETTLE) += hash-nettle.o
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(CONFIG_GCRYPT)) += hash-gcrypt.o
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(if $(CONFIG_GCRYPT),n,y)) += hash-glib.o
|
|
crypto-obj-y += hmac.o
|
|
crypto-obj-$(CONFIG_NETTLE) += hmac-nettle.o
|
|
crypto-obj-$(CONFIG_GCRYPT_HMAC) += hmac-gcrypt.o
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(if $(CONFIG_GCRYPT_HMAC),n,y)) += hmac-glib.o
|
|
crypto-obj-y += aes.o
|
|
crypto-obj-y += desrfb.o
|
|
crypto-obj-y += cipher.o
|
|
crypto-obj-$(CONFIG_AF_ALG) += afalg.o
|
|
crypto-obj-$(CONFIG_AF_ALG) += cipher-afalg.o
|
|
crypto-obj-$(CONFIG_AF_ALG) += hash-afalg.o
|
|
crypto-obj-$(CONFIG_GNUTLS) += tls-cipher-suites.o
|
|
crypto-obj-y += tlscreds.o
|
|
crypto-obj-y += tlscredsanon.o
|
|
crypto-obj-y += tlscredspsk.o
|
|
crypto-obj-y += tlscredsx509.o
|
|
crypto-obj-y += tlssession.o
|
|
crypto-obj-y += secret_common.o
|
|
crypto-obj-y += secret.o
|
|
crypto-obj-$(CONFIG_SECRET_KEYRING) += secret_keyring.o
|
|
crypto-obj-y += pbkdf.o
|
|
crypto-obj-$(CONFIG_NETTLE) += pbkdf-nettle.o
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(CONFIG_GCRYPT)) += pbkdf-gcrypt.o
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(if $(CONFIG_GCRYPT),n,y)) += pbkdf-stub.o
|
|
crypto-obj-y += ivgen.o
|
|
crypto-obj-y += ivgen-essiv.o
|
|
crypto-obj-y += ivgen-plain.o
|
|
crypto-obj-y += ivgen-plain64.o
|
|
crypto-obj-y += afsplit.o
|
|
crypto-obj-$(CONFIG_QEMU_PRIVATE_XTS) += xts.o
|
|
crypto-obj-y += block.o
|
|
crypto-obj-y += block-qcow.o
|
|
crypto-obj-y += block-luks.o
|
|
|
|
util-obj-$(CONFIG_GCRYPT) += random-gcrypt.o
|
|
util-obj-$(if $(CONFIG_GCRYPT),n,$(CONFIG_GNUTLS)) += random-gnutls.o
|
|
util-obj-$(if $(CONFIG_GCRYPT),n,$(if $(CONFIG_GNUTLS),n,$(CONFIG_RNG_NONE))) += random-none.o
|
|
util-obj-$(if $(CONFIG_GCRYPT),n,$(if $(CONFIG_GNUTLS),n,$(if $(CONFIG_RNG_NONE),n,y))) += random-platform.o
|
|
util-obj-y += aes.o init.o
|