[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 13/22] crypto: introduce build system for gnutls crypto backend
From: |
Daniel P . Berrangé |
Subject: |
[PULL 13/22] crypto: introduce build system for gnutls crypto backend |
Date: |
Mon, 12 Jul 2021 14:02:14 +0100 |
This introduces the build logic needed to decide whether we can
use gnutls as a crypto driver backend. The actual implementations
will be introduced in following patches. We only wish to use
gnutls if it has version 3.6.14 or newer, because that is what
finally brings HW accelerated AES-XTS mode for x86_64.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
meson.build | 36 ++++++++++++++++++++++++++++++++----
1 file changed, 32 insertions(+), 4 deletions(-)
diff --git a/meson.build b/meson.build
index cc08561fbd..29fcbbe81f 100644
--- a/meson.build
+++ b/meson.build
@@ -820,11 +820,34 @@ if 'CONFIG_OPENGL' in config_host
endif
gnutls = not_found
+gnutls_crypto = not_found
if not get_option('gnutls').auto() or have_system
- gnutls = dependency('gnutls', version: '>=3.5.18',
- method: 'pkg-config',
- required: get_option('gnutls'),
- kwargs: static_kwargs)
+ # For general TLS support our min gnutls matches
+ # that implied by our platform support matrix
+ #
+ # For the crypto backends, we look for a newer
+ # gnutls:
+ #
+ # Version 3.6.8 is needed to get XTS
+ # Version 3.6.13 is needed to get PBKDF
+ # Version 3.6.14 is needed to get HW accelerated XTS
+ #
+ # If newer enough gnutls isn't available, we can
+ # still use a different crypto backend to satisfy
+ # the platform support requirements
+ gnutls_crypto = dependency('gnutls', version: '>=3.6.14',
+ method: 'pkg-config',
+ required: get_option('gnutls'),
+ kwargs: static_kwargs)
+ if gnutls_crypto.found()
+ gnutls = gnutls_crypto
+ else
+ # Our min version if all we need is TLS
+ gnutls = dependency('gnutls', version: '>=3.5.18',
+ method: 'pkg-config',
+ required: get_option('gnutls'),
+ kwargs: static_kwargs)
+ endif
endif
# Gcrypt has priority over nettle
@@ -856,6 +879,9 @@ if (not get_option('nettle').auto() or have_system) and not
gcrypt.found()
xts = 'private'
endif
endif
+if gcrypt.found() or nettle.found()
+ gnutls_crypto = not_found
+endif
gtk = not_found
gtkx11 = not_found
@@ -1240,6 +1266,7 @@ config_host_data.set('CONFIG_XKBCOMMON',
xkbcommon.found())
config_host_data.set('CONFIG_KEYUTILS', keyutils.found())
config_host_data.set('CONFIG_GETTID', has_gettid)
config_host_data.set('CONFIG_GNUTLS', gnutls.found())
+config_host_data.set('CONFIG_GNUTLS_CRYPTO', gnutls_crypto.found())
config_host_data.set('CONFIG_GCRYPT', gcrypt.found())
config_host_data.set('CONFIG_NETTLE', nettle.found())
config_host_data.set('CONFIG_QEMU_PRIVATE_XTS', xts == 'private')
@@ -2961,6 +2988,7 @@ summary(summary_info, bool_yn: true, section: 'Block
layer support')
summary_info = {}
summary_info += {'TLS priority': config_host['CONFIG_TLS_PRIORITY']}
summary_info += {'GNUTLS support': gnutls.found()}
+summary_info += {'GNUTLS crypto': gnutls_crypto.found()}
# TODO: add back version
summary_info += {'libgcrypt': gcrypt.found()}
# TODO: add back version
--
2.31.1
- [PULL 03/22] crypto: skip essiv ivgen tests if AES+ECB isn't available, (continued)
- [PULL 03/22] crypto: skip essiv ivgen tests if AES+ECB isn't available, Daniel P . Berrangé, 2021/07/12
- [PULL 04/22] crypto: use &error_fatal in crypto tests, Daniel P . Berrangé, 2021/07/12
- [PULL 05/22] crypto: fix gcrypt min version 1.8 regression, Daniel P . Berrangé, 2021/07/12
- [PULL 06/22] crypto: drop gcrypt thread initialization code, Daniel P . Berrangé, 2021/07/12
- [PULL 07/22] crypto: drop custom XTS support in gcrypt driver, Daniel P . Berrangé, 2021/07/12
- [PULL 08/22] crypto: add crypto tests for single block DES-ECB and DES-CBC, Daniel P . Berrangé, 2021/07/12
- [PULL 09/22] crypto: delete built-in DES implementation, Daniel P . Berrangé, 2021/07/12
- [PULL 10/22] crypto: delete built-in XTS cipher mode support, Daniel P . Berrangé, 2021/07/12
- [PULL 11/22] crypto: replace 'des-rfb' cipher with 'des', Daniel P . Berrangé, 2021/07/12
- [PULL 12/22] crypto: flip priority of backends to prefer gcrypt, Daniel P . Berrangé, 2021/07/12
- [PULL 13/22] crypto: introduce build system for gnutls crypto backend,
Daniel P . Berrangé <=
- [PULL 14/22] crypto: add gnutls cipher provider, Daniel P . Berrangé, 2021/07/12
- [PULL 15/22] crypto: add gnutls hash provider, Daniel P . Berrangé, 2021/07/12
- [PULL 16/22] crypto: add gnutls hmac provider, Daniel P . Berrangé, 2021/07/12
- [PULL 17/22] crypto: add gnutls pbkdf provider, Daniel P . Berrangé, 2021/07/12
- [PULL 18/22] crypto: prefer gnutls as the crypto backend if new enough, Daniel P . Berrangé, 2021/07/12
- [PULL 19/22] net/rocker: use GDateTime for formatting timestamp in debug messages, Daniel P . Berrangé, 2021/07/12
- [PULL 20/22] io: use GDateTime for formatting timestamp for websock headers, Daniel P . Berrangé, 2021/07/12
- [PULL 21/22] seccomp: don't block getters for resource control syscalls, Daniel P . Berrangé, 2021/07/12
- [PULL 22/22] tests/migration: fix unix socket migration, Daniel P . Berrangé, 2021/07/12
- Re: [PULL 00/22] Crypto and more patches, Peter Maydell, 2021/07/13