[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 12/22] crypto: flip priority of backends to prefer gcrypt
From: |
Daniel P . Berrangé |
Subject: |
[PULL 12/22] crypto: flip priority of backends to prefer gcrypt |
Date: |
Mon, 12 Jul 2021 14:02:13 +0100 |
Originally we preferred to use nettle over gcrypt because
gnutls already links to nettle and thus it minimizes the
dependencies. In retrospect this was the wrong criteria to
optimize for.
Currently shipping versions of gcrypt have cipher impls that
are massively faster than those in nettle and this is way
more important. The nettle library is also not capable of
enforcing FIPS compliance, since it considers that out of
scope. It merely aims to provide general purpose impls of
algorithms, and usage policy is left upto the layer above,
such as GNUTLS.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
meson.build | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/meson.build b/meson.build
index 2cf2e8b0b8..cc08561fbd 100644
--- a/meson.build
+++ b/meson.build
@@ -827,22 +827,13 @@ if not get_option('gnutls').auto() or have_system
kwargs: static_kwargs)
endif
-# Nettle has priority over gcrypt
+# Gcrypt has priority over nettle
gcrypt = not_found
nettle = not_found
xts = 'none'
if get_option('nettle').enabled() and get_option('gcrypt').enabled()
error('Only one of gcrypt & nettle can be enabled')
-elif (not get_option('nettle').auto() or have_system) and not
get_option('gcrypt').enabled()
- nettle = dependency('nettle', version: '>=3.4',
- method: 'pkg-config',
- required: get_option('nettle'),
- kwargs: static_kwargs)
- if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle)
- xts = 'private'
- endif
-endif
-if (not get_option('gcrypt').auto() or have_system) and not nettle.found()
+elif (not get_option('gcrypt').auto() or have_system) and not
get_option('nettle').enabled()
gcrypt = dependency('libgcrypt', version: '>=1.8',
method: 'config-tool',
required: get_option('gcrypt'),
@@ -856,6 +847,15 @@ if (not get_option('gcrypt').auto() or have_system) and
not nettle.found()
cc.find_library('gpg-error', required: true, kwargs: static_kwargs)])
endif
endif
+if (not get_option('nettle').auto() or have_system) and not gcrypt.found()
+ nettle = dependency('nettle', version: '>=3.4',
+ method: 'pkg-config',
+ required: get_option('nettle'),
+ kwargs: static_kwargs)
+ if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle)
+ xts = 'private'
+ endif
+endif
gtk = not_found
gtkx11 = not_found
--
2.31.1
- [PULL 02/22] crypto: remove obsolete crypto test condition, (continued)
- [PULL 02/22] crypto: remove obsolete crypto test condition, Daniel P . Berrangé, 2021/07/12
- [PULL 03/22] crypto: skip essiv ivgen tests if AES+ECB isn't available, Daniel P . Berrangé, 2021/07/12
- [PULL 04/22] crypto: use &error_fatal in crypto tests, Daniel P . Berrangé, 2021/07/12
- [PULL 05/22] crypto: fix gcrypt min version 1.8 regression, Daniel P . Berrangé, 2021/07/12
- [PULL 06/22] crypto: drop gcrypt thread initialization code, Daniel P . Berrangé, 2021/07/12
- [PULL 07/22] crypto: drop custom XTS support in gcrypt driver, Daniel P . Berrangé, 2021/07/12
- [PULL 08/22] crypto: add crypto tests for single block DES-ECB and DES-CBC, Daniel P . Berrangé, 2021/07/12
- [PULL 09/22] crypto: delete built-in DES implementation, Daniel P . Berrangé, 2021/07/12
- [PULL 10/22] crypto: delete built-in XTS cipher mode support, Daniel P . Berrangé, 2021/07/12
- [PULL 11/22] crypto: replace 'des-rfb' cipher with 'des', Daniel P . Berrangé, 2021/07/12
- [PULL 12/22] crypto: flip priority of backends to prefer gcrypt,
Daniel P . Berrangé <=
- [PULL 13/22] crypto: introduce build system for gnutls crypto backend, Daniel P . Berrangé, 2021/07/12
- [PULL 14/22] crypto: add gnutls cipher provider, Daniel P . Berrangé, 2021/07/12
- [PULL 15/22] crypto: add gnutls hash provider, Daniel P . Berrangé, 2021/07/12
- [PULL 16/22] crypto: add gnutls hmac provider, Daniel P . Berrangé, 2021/07/12
- [PULL 17/22] crypto: add gnutls pbkdf provider, Daniel P . Berrangé, 2021/07/12
- [PULL 18/22] crypto: prefer gnutls as the crypto backend if new enough, Daniel P . Berrangé, 2021/07/12
- [PULL 19/22] net/rocker: use GDateTime for formatting timestamp in debug messages, Daniel P . Berrangé, 2021/07/12
- [PULL 20/22] io: use GDateTime for formatting timestamp for websock headers, Daniel P . Berrangé, 2021/07/12
- [PULL 21/22] seccomp: don't block getters for resource control syscalls, Daniel P . Berrangé, 2021/07/12
- [PULL 22/22] tests/migration: fix unix socket migration, Daniel P . Berrangé, 2021/07/12