[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v5] crypto: Implement TLS Pre-Shared Keys (PSK).
From: |
Daniel P . Berrangé |
Subject: |
Re: [Qemu-devel] [PATCH v5] crypto: Implement TLS Pre-Shared Keys (PSK). |
Date: |
Mon, 2 Jul 2018 13:18:29 +0100 |
User-agent: |
Mutt/1.10.0 (2018-05-17) |
On Mon, Jul 02, 2018 at 06:54:41AM -0500, Eric Blake wrote:
> On 07/02/2018 02:52 AM, Daniel P. Berrangé wrote:
>
> > > > > +#define TLS_PRIORITY_ADDITIONAL_ANON "+ANON-DH"
> > > > > +#define TLS_PRIORITY_ADDITIONAL_PSK "+ECDHE-PSK:+DHE-PSK:+PSK"
> > > >
> > > > Unfortunately in testing this I learn ECDHE-PSK is only supported when
> > > > using GNUTLS >= 3.0, so can you make this conditional based on
> > > > GNUTLS_VERSION_MAJOR >= 3
> > >
> > > GnuTLS 3.0 was released in 2011, and the last 2.x version seems to be
> > > from 2009. Do we need to support such old versions?
> >
> > With our recently introduced platform support guidelines, I think we can
> > likely drop 2.x. The issue is timing though - feature freeze deadline is
> > tomorrow, and I really want to get your PSK patch included without more
> > delay. So just making it conditional is the simplest way to achieve it.
> >
> > > I looked at the configure script. It seems as if we will try to use
> > > any version of GnuTLS, even ancient ones (although other sub-features
> > > require later versions of GnuTLS). But if I'm understanding it
> > > correctly, by forcing both GnuTLS >= 3.0.0 and Nettle we could
> > > eliminate all the conditionals there, except for one Nettle test.
> >
> > We still need support for gcrypt unfortunately, since nettle is not covered
> > by FIPS certs. So while we will be able to delete a bunch of compat code,
> > we'll need to refactor much of the configure test logic. I don't want to
> > risk doing that the day before feature freeze.
>
> We can still check in the initial PSK implementation in time for soft
> freeze, then fix conditionals during the freeze but prior to the release as
> bug fixes, if that makes life easier (although we also want to minimize
> known-broken builds - if the CI tools fail to compile an unconditional use,
> for example, it's harder to justify committing the code just to meet freeze
> deadlines).
We can't commit it because it breaks unit tests on a number of platforms,
so it won't pass pre-merge testing.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|