From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56527) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1an6MA-0007hp-7N for qemu-devel@nongnu.org; Mon, 04 Apr 2016 11:23:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1an6M6-00072H-IY for qemu-devel@nongnu.org; Mon, 04 Apr 2016 11:23:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38459) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1an6M6-000721-Ah for qemu-devel@nongnu.org; Mon, 04 Apr 2016 11:23:54 -0400 Date: Mon, 4 Apr 2016 16:23:50 +0100 From: "Daniel P. Berrange" Message-ID: <20160404152350.GJ15379@redhat.com> References: <1459263011-1200-1-git-send-email-berrange@redhat.com> <56FCCC740200004800127F10@prv-mh.provo.novell.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <56FCCC740200004800127F10@prv-mh.provo.novell.com> Subject: Re: [Qemu-devel] [PATCH] crypto: do an explicit check for nettle pbkdf functions Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Bruce Rogers Cc: qemu-devel@nongnu.org On Thu, Mar 31, 2016 at 07:06:28AM -0600, Bruce Rogers wrote: > >>> On 3/29/2016 at 08:50 AM, "Daniel P. Berrange" wrote: > > Support for the PBKDF functions in nettle was not introduced > > until version 2.6. Some distros QEMU targets have older > > versions and thus lack PBKDF support. Address this by doing > > a check in configure for the desired function and then skipping > > compilation of the nettle-pbkdf.o module > > > > Reported-by: Wen Congyang > > Signed-off-by: Daniel P. Berrange > > --- > > configure | 16 ++++++++++++++++ > > crypto/Makefile.objs | 4 ++-- > > 2 files changed, 18 insertions(+), 2 deletions(-) > > > > diff --git a/configure b/configure > > index f4a03b8..2d78bcd 100755 > > --- a/configure > > +++ b/configure > > @@ -308,6 +308,7 @@ gnutls="" > > gnutls_hash="" > > gnutls_rnd="" > > nettle="" > > +nettle_kdf="no" > > gcrypt="" > > gcrypt_kdf="no" > > vte="" > > @@ -2335,6 +2336,17 @@ if test "$nettle" != "no"; then > > libs_tools="$nettle_libs $libs_tools" > > QEMU_CFLAGS="$QEMU_CFLAGS $nettle_cflags" > > nettle="yes" > > + > > + cat > $TMPC << EOF > > +#include > > +int main(void) { > > + pbkdf2_hmac_sha256(8, NULL, 1000, 8, NULL, 8, NULL); > > + return 0; > > +} > > +EOF > > + if compile_prog "$nettle_cflags" "$nettle_libs" ; then > > + nettle_kdf=yes > > + fi > > else > > if test "$nettle" = "yes"; then > > feature_not_found "nettle" "Install nettle devel" > > @@ -4746,6 +4758,7 @@ if test "$nettle" = "yes"; then > > else > > echo "nettle $nettle" > > fi > > +echo "nettle kdf $nettle_kdf" > > echo "libtasn1 $tasn1" > > echo "VTE support $vte" > > echo "curses support $curses" > > @@ -5130,6 +5143,9 @@ fi > > if test "$nettle" = "yes" ; then > > echo "CONFIG_NETTLE=y" >> $config_host_mak > > echo "CONFIG_NETTLE_VERSION_MAJOR=${nettle_version%%.*}" >> > > $config_host_mak > > + if test "$nettle_kdf" = "yes" ; then > > + echo "CONFIG_NETTLE_KDF=y" >> $config_host_mak > > + fi > > fi > > if test "$tasn1" = "yes" ; then > > echo "CONFIG_TASN1=y" >> $config_host_mak > > diff --git a/crypto/Makefile.objs b/crypto/Makefile.objs > > index 9f2c87e..0737f48 100644 > > --- a/crypto/Makefile.objs > > +++ b/crypto/Makefile.objs > > @@ -11,8 +11,8 @@ crypto-obj-y += secret.o > > crypto-obj-$(CONFIG_GCRYPT) += random-gcrypt.o > > crypto-obj-$(if $(CONFIG_GCRYPT),n,$(CONFIG_GNUTLS_RND)) += random-gnutls.o > > crypto-obj-y += pbkdf.o > > -crypto-obj-$(CONFIG_NETTLE) += pbkdf-nettle.o > > -crypto-obj-$(if $(CONFIG_NETTLE),n,$(CONFIG_GCRYPT_KDF)) += pbkdf-gcrypt.o > > +crypto-obj-$(CONFIG_NETTLE_KDF) += pbkdf-nettle.o > > +crypto-obj-$(if $(CONFIG_NETTLE_KDF),n,$(CONFIG_GCRYPT_KDF)) += pbkdf-gcrypt.o > > crypto-obj-y += ivgen.o > > crypto-obj-y += ivgen-essiv.o > > crypto-obj-y += ivgen-plain.o > > Do we also need a corresponding fix in tests/Makefile for the inclusion of > tests/test-crypto-pbkdf ? Yes, I should have changed that too. Will CC you on a likely fix. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|