[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v10 5/5] crypto/tls-cipher-suites: Produce fw_cfg consumable blob
From: |
Philippe Mathieu-Daudé |
Subject: |
[PATCH v10 5/5] crypto/tls-cipher-suites: Produce fw_cfg consumable blob |
Date: |
Tue, 23 Jun 2020 19:27:26 +0200 |
Since our format is consumable by the fw_cfg device,
we can implement the FW_CFG_DATA_GENERATOR interface.
Example of use to dump the cipher suites (if tracing enabled):
$ qemu-system-x86_64 -S \
-object tls-cipher-suites,id=mysuite1,priority=@SYSTEM \
-fw_cfg name=etc/path/to/ciphers,gen_id=mysuite1 \
-trace qcrypto\*
1590664444.197123:qcrypto_tls_cipher_suite_priority priority: @SYSTEM
1590664444.197219:qcrypto_tls_cipher_suite_info data=[0x13,0x02]
version=TLS1.3 name=TLS_AES_256_GCM_SHA384
1590664444.197228:qcrypto_tls_cipher_suite_info data=[0x13,0x03]
version=TLS1.3 name=TLS_CHACHA20_POLY1305_SHA256
1590664444.197233:qcrypto_tls_cipher_suite_info data=[0x13,0x01]
version=TLS1.3 name=TLS_AES_128_GCM_SHA256
1590664444.197236:qcrypto_tls_cipher_suite_info data=[0x13,0x04]
version=TLS1.3 name=TLS_AES_128_CCM_SHA256
1590664444.197240:qcrypto_tls_cipher_suite_info data=[0xc0,0x30]
version=TLS1.2 name=TLS_ECDHE_RSA_AES_256_GCM_SHA384
1590664444.197245:qcrypto_tls_cipher_suite_info data=[0xcc,0xa8]
version=TLS1.2 name=TLS_ECDHE_RSA_CHACHA20_POLY1305
1590664444.197250:qcrypto_tls_cipher_suite_info data=[0xc0,0x14]
version=TLS1.0 name=TLS_ECDHE_RSA_AES_256_CBC_SHA1
1590664444.197254:qcrypto_tls_cipher_suite_info data=[0xc0,0x2f]
version=TLS1.2 name=TLS_ECDHE_RSA_AES_128_GCM_SHA256
1590664444.197258:qcrypto_tls_cipher_suite_info data=[0xc0,0x13]
version=TLS1.0 name=TLS_ECDHE_RSA_AES_128_CBC_SHA1
1590664444.197261:qcrypto_tls_cipher_suite_info data=[0xc0,0x2c]
version=TLS1.2 name=TLS_ECDHE_ECDSA_AES_256_GCM_SHA384
1590664444.197266:qcrypto_tls_cipher_suite_info data=[0xcc,0xa9]
version=TLS1.2 name=TLS_ECDHE_ECDSA_CHACHA20_POLY1305
1590664444.197270:qcrypto_tls_cipher_suite_info data=[0xc0,0xad]
version=TLS1.2 name=TLS_ECDHE_ECDSA_AES_256_CCM
1590664444.197274:qcrypto_tls_cipher_suite_info data=[0xc0,0x0a]
version=TLS1.0 name=TLS_ECDHE_ECDSA_AES_256_CBC_SHA1
1590664444.197278:qcrypto_tls_cipher_suite_info data=[0xc0,0x2b]
version=TLS1.2 name=TLS_ECDHE_ECDSA_AES_128_GCM_SHA256
1590664444.197283:qcrypto_tls_cipher_suite_info data=[0xc0,0xac]
version=TLS1.2 name=TLS_ECDHE_ECDSA_AES_128_CCM
1590664444.197287:qcrypto_tls_cipher_suite_info data=[0xc0,0x09]
version=TLS1.0 name=TLS_ECDHE_ECDSA_AES_128_CBC_SHA1
1590664444.197291:qcrypto_tls_cipher_suite_info data=[0x00,0x9d]
version=TLS1.2 name=TLS_RSA_AES_256_GCM_SHA384
1590664444.197296:qcrypto_tls_cipher_suite_info data=[0xc0,0x9d]
version=TLS1.2 name=TLS_RSA_AES_256_CCM
1590664444.197300:qcrypto_tls_cipher_suite_info data=[0x00,0x35]
version=TLS1.0 name=TLS_RSA_AES_256_CBC_SHA1
1590664444.197304:qcrypto_tls_cipher_suite_info data=[0x00,0x9c]
version=TLS1.2 name=TLS_RSA_AES_128_GCM_SHA256
1590664444.197308:qcrypto_tls_cipher_suite_info data=[0xc0,0x9c]
version=TLS1.2 name=TLS_RSA_AES_128_CCM
1590664444.197312:qcrypto_tls_cipher_suite_info data=[0x00,0x2f]
version=TLS1.0 name=TLS_RSA_AES_128_CBC_SHA1
1590664444.197316:qcrypto_tls_cipher_suite_info data=[0x00,0x9f]
version=TLS1.2 name=TLS_DHE_RSA_AES_256_GCM_SHA384
1590664444.197320:qcrypto_tls_cipher_suite_info data=[0xcc,0xaa]
version=TLS1.2 name=TLS_DHE_RSA_CHACHA20_POLY1305
1590664444.197325:qcrypto_tls_cipher_suite_info data=[0xc0,0x9f]
version=TLS1.2 name=TLS_DHE_RSA_AES_256_CCM
1590664444.197329:qcrypto_tls_cipher_suite_info data=[0x00,0x39]
version=TLS1.0 name=TLS_DHE_RSA_AES_256_CBC_SHA1
1590664444.197333:qcrypto_tls_cipher_suite_info data=[0x00,0x9e]
version=TLS1.2 name=TLS_DHE_RSA_AES_128_GCM_SHA256
1590664444.197337:qcrypto_tls_cipher_suite_info data=[0xc0,0x9e]
version=TLS1.2 name=TLS_DHE_RSA_AES_128_CCM
1590664444.197341:qcrypto_tls_cipher_suite_info data=[0x00,0x33]
version=TLS1.0 name=TLS_DHE_RSA_AES_128_CBC_SHA1
1590664444.197345:qcrypto_tls_cipher_suite_count count: 29
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
v10: Removed Laszlo Acked-by due to logical changes
---
crypto/tls-cipher-suites.c | 11 +++++++++++
qemu-options.hx | 18 ++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/crypto/tls-cipher-suites.c b/crypto/tls-cipher-suites.c
index 5b403f86c9..b3dba00010 100644
--- a/crypto/tls-cipher-suites.c
+++ b/crypto/tls-cipher-suites.c
@@ -13,6 +13,7 @@
#include "qom/object_interfaces.h"
#include "crypto/tlscreds.h"
#include "crypto/tls-cipher-suites.h"
+#include "hw/nvram/fw_cfg.h"
#include "trace.h"
/*
@@ -88,11 +89,20 @@ static void
qcrypto_tls_cipher_suites_complete(UserCreatable *uc,
}
}
+static GByteArray *qcrypto_tls_cipher_suites_fw_cfg_gen_data(Object *obj,
+ Error **errp)
+{
+ return qcrypto_tls_cipher_suites_get_data(QCRYPTO_TLS_CIPHER_SUITES(obj),
+ errp);
+}
+
static void qcrypto_tls_cipher_suites_class_init(ObjectClass *oc, void *data)
{
UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
+ FWCfgDataGeneratorClass *fwgc = FW_CFG_DATA_GENERATOR_CLASS(oc);
ucc->complete = qcrypto_tls_cipher_suites_complete;
+ fwgc->get_data = qcrypto_tls_cipher_suites_fw_cfg_gen_data;
}
static const TypeInfo qcrypto_tls_cipher_suites_info = {
@@ -103,6 +113,7 @@ static const TypeInfo qcrypto_tls_cipher_suites_info = {
.class_init = qcrypto_tls_cipher_suites_class_init,
.interfaces = (InterfaceInfo[]) {
{ TYPE_USER_CREATABLE },
+ { TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
}
};
diff --git a/qemu-options.hx b/qemu-options.hx
index 4f519f35fd..ce54c7359c 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4585,6 +4585,24 @@ SRST
string as described at
https://gnutls.org/manual/html_node/Priority-Strings.html.
+ An example of use of this object is to control UEFI HTTPS Boot.
+ The tls-cipher-suites object exposes the ordered list of permitted
+ TLS cipher suites from the host side to the guest firmware, via
+ fw_cfg. The list is represented as an array of IANA_TLS_CIPHER
+ objects. The firmware uses the IANA_TLS_CIPHER array for configuring
+ guest-side TLS.
+
+ In the following example, the priority at which the host-side policy
+ is retrieved is given by the ``priority`` property.
+ Given that QEMU uses GNUTLS, ``priority=@SYSTEM`` may be used to
+ refer to /etc/crypto-policies/back-ends/gnutls.config.
+
+ .. parsed-literal::
+
+ # |qemu_system| \
+ -object tls-cipher-suites,id=mysuite0,priority=@SYSTEM \
+ -fw_cfg name=etc/edk2/https/ciphers,gen_id=mysuite0
+
``-object
filter-buffer,id=id,netdev=netdevid,interval=t[,queue=all|rx|tx][,status=on|off][,position=head|tail|id=<id>][,insert=behind|before]``
Interval t can't be 0, this filter batches the packet delivery:
all packets arriving in a given interval on netdev netdevid are
--
2.21.3
- [PATCH v10 0/5] fw_cfg: Add FW_CFG_DATA_GENERATOR; crypto: Add tls-cipher-suites, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 2/5] hw/nvram/fw_cfg: Add the FW_CFG_DATA_GENERATOR interface, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 3/5] softmmu/vl: Let -fw_cfg option take a 'gen_id' argument, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 1/5] crypto: Add tls-cipher-suites object, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 4/5] softmmu/vl: Allow -fw_cfg 'gen_id' option to use the 'etc/' namespace, Philippe Mathieu-Daudé, 2020/06/23
- [PATCH v10 5/5] crypto/tls-cipher-suites: Produce fw_cfg consumable blob,
Philippe Mathieu-Daudé <=
- Re: [PATCH v10 0/5] fw_cfg: Add FW_CFG_DATA_GENERATOR; crypto: Add tls-cipher-suites, Philippe Mathieu-Daudé, 2020/06/23