mirror of
https://github.com/qemu/qemu.git
synced 2024-11-25 11:53:39 +08:00
993aec27aa
On the host OS, various aspects of TLS operation are configurable. In particular it is possible for the sysadmin to control the TLS cipher/protocol algorithms that applications are permitted to use. * Any given crypto library has a built-in default priority list defined by the distro maintainer of the library package (or by upstream). * The "crypto-policies" RPM (or equivalent host OS package) provides a config file such as "/etc/crypto-policies/config", where the sysadmin can set a high level (library-independent) policy. The "update-crypto-policies --set" command (or equivalent) is used to translate the global policy to individual library representations, producing files such as "/etc/crypto-policies/back-ends/*.config". The generated files, if present, are loaded by the various crypto libraries to override their own built-in defaults. For example, the GNUTLS library may read "/etc/crypto-policies/back-ends/gnutls.config". * A management application (or the QEMU user) may overide the system-wide crypto-policies config via their own config, if they need to diverge from the former. Thus the priority order is "QEMU user config" > "crypto-policies system config" > "library built-in config". Introduce the "tls-cipher-suites" object for exposing the ordered list of permitted TLS cipher suites from the host side to the guest firmware, via fw_cfg. The list is represented as an array of bytes. The priority at which the host-side policy is retrieved is given by the "priority" property of the new object type. For example, "priority=@SYSTEM" may be used to refer to "/etc/crypto-policies/back-ends/gnutls.config" (given that QEMU uses GNUTLS). The firmware uses the IANA_TLS_CIPHER array for configuring guest-side TLS, for example in UEFI HTTPS Boot. [Description from Daniel P. Berrangé, edited by Laszlo Ersek.] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20200623172726.21040-2-philmd@redhat.com> |
||
|---|---|---|
| .. | ||
| aes.c | ||
| afalg.c | ||
| afalgpriv.h | ||
| afsplit.c | ||
| block-luks.c | ||
| block-luks.h | ||
| block-qcow.c | ||
| block-qcow.h | ||
| block.c | ||
| blockpriv.h | ||
| cipher-afalg.c | ||
| cipher-builtin.c | ||
| cipher-gcrypt.c | ||
| cipher-nettle.c | ||
| cipher.c | ||
| cipherpriv.h | ||
| desrfb.c | ||
| hash-afalg.c | ||
| hash-gcrypt.c | ||
| hash-glib.c | ||
| hash-nettle.c | ||
| hash.c | ||
| hashpriv.h | ||
| hmac-gcrypt.c | ||
| hmac-glib.c | ||
| hmac-nettle.c | ||
| hmac.c | ||
| hmacpriv.h | ||
| init.c | ||
| ivgen-essiv.c | ||
| ivgen-essiv.h | ||
| ivgen-plain64.c | ||
| ivgen-plain64.h | ||
| ivgen-plain.c | ||
| ivgen-plain.h | ||
| ivgen.c | ||
| ivgenpriv.h | ||
| Makefile.objs | ||
| pbkdf-gcrypt.c | ||
| pbkdf-nettle.c | ||
| pbkdf-stub.c | ||
| pbkdf.c | ||
| random-gcrypt.c | ||
| random-gnutls.c | ||
| random-none.c | ||
| random-platform.c | ||
| secret_common.c | ||
| secret_keyring.c | ||
| secret.c | ||
| tls-cipher-suites.c | ||
| tlscreds.c | ||
| tlscredsanon.c | ||
| tlscredspriv.h | ||
| tlscredspsk.c | ||
| tlscredsx509.c | ||
| tlssession.c | ||
| trace-events | ||
| xts.c | ||