* [PULL 1/3] softmmu: remove deprecated --enable-fips option
2022-04-26 15:13 [PULL 0/3] Misc next patches Daniel P. Berrangé
@ 2022-04-26 15:13 ` Daniel P. Berrangé
2022-04-26 15:13 ` [PULL 2/3] hw/char: fix qcode array bounds check in ESCC impl Daniel P. Berrangé
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Daniel P. Berrangé @ 2022-04-26 15:13 UTC (permalink / raw)
To: qemu-devel
Cc: Thomas Huth, Daniel P. Berrangé, Beraldo Leal, libvir-list,
Philippe Mathieu-Daudé, Wainer dos Santos Moschetta,
Gerd Hoffmann, Marc-André Lureau, Paolo Bonzini,
Alex Bennée
Users requiring FIPS support must build QEMU with either the libgcrypt
or gnutls libraries as the crytography backend.
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
docs/about/deprecated.rst | 12 ------------
docs/about/removed-features.rst | 11 +++++++++++
include/qemu/osdep.h | 3 ---
os-posix.c | 8 --------
qemu-options.hx | 10 ----------
ui/vnc.c | 7 -------
util/osdep.c | 28 ----------------------------
7 files changed, 11 insertions(+), 68 deletions(-)
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index cf02ef6821..257cc15f82 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -67,18 +67,6 @@ and will cause a warning.
The replacement for the ``nodelay`` short-form boolean option is ``nodelay=on``
rather than ``delay=off``.
-``--enable-fips`` (since 6.0)
-'''''''''''''''''''''''''''''
-
-This option restricts usage of certain cryptographic algorithms when
-the host is operating in FIPS mode.
-
-If FIPS compliance is required, QEMU should be built with the ``libgcrypt``
-library enabled as a cryptography provider.
-
-Neither the ``nettle`` library, or the built-in cryptography provider are
-supported on FIPS enabled hosts.
-
``-writeconfig`` (since 6.0)
'''''''''''''''''''''''''''''
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 4b831ea291..a66f4b73b2 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -336,6 +336,17 @@ for the RISC-V ``virt`` machine and ``sifive_u`` machine.
The ``-no-quit`` was a synonym for ``-display ...,window-close=off`` which
should be used instead.
+``--enable-fips`` (removed in 7.1)
+''''''''''''''''''''''''''''''''''
+
+This option restricted usage of certain cryptographic algorithms when
+the host is operating in FIPS mode.
+
+If FIPS compliance is required, QEMU should be built with the ``libgcrypt``
+or ``gnutls`` library enabled as a cryptography provider.
+
+Neither the ``nettle`` library, or the built-in cryptography provider are
+supported on FIPS enabled hosts.
QEMU Machine Protocol (QMP) commands
------------------------------------
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index baaa23c156..52d81c027b 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -553,9 +553,6 @@ int qemu_pipe(int pipefd[2]);
void qemu_set_cloexec(int fd);
-void fips_set_state(bool requested);
-bool fips_get_state(void);
-
/* Return a dynamically allocated directory path that is appropriate for storing
* local state.
*
diff --git a/os-posix.c b/os-posix.c
index faf6e6978b..1b746dba97 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -150,14 +150,6 @@ int os_parse_cmd_args(int index, const char *optarg)
case QEMU_OPTION_daemonize:
daemonize = 1;
break;
-#if defined(CONFIG_LINUX)
- case QEMU_OPTION_enablefips:
- warn_report("-enable-fips is deprecated, please build QEMU with "
- "the `libgcrypt` library as the cryptography provider "
- "to enable FIPS compliance");
- fips_set_state(true);
- break;
-#endif
default:
return -1;
}
diff --git a/qemu-options.hx b/qemu-options.hx
index 34e9b32a5c..1764eebfaf 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4673,16 +4673,6 @@ HXCOMM Internal use
DEF("qtest", HAS_ARG, QEMU_OPTION_qtest, "", QEMU_ARCH_ALL)
DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
-#ifdef __linux__
-DEF("enable-fips", 0, QEMU_OPTION_enablefips,
- "-enable-fips enable FIPS 140-2 compliance\n",
- QEMU_ARCH_ALL)
-#endif
-SRST
-``-enable-fips``
- Enable FIPS 140-2 compliance mode.
-ERST
-
DEF("msg", HAS_ARG, QEMU_OPTION_msg,
"-msg [timestamp[=on|off]][,guest-name=[on|off]]\n"
" control error message format\n"
diff --git a/ui/vnc.c b/ui/vnc.c
index badf1d7664..1347e27b5b 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -4059,13 +4059,6 @@ void vnc_display_open(const char *id, Error **errp)
password = qemu_opt_get_bool(opts, "password", false);
}
if (password) {
- if (fips_get_state()) {
- error_setg(errp,
- "VNC password auth disabled due to FIPS mode, "
- "consider using the VeNCrypt or SASL authentication "
- "methods as an alternative");
- goto fail;
- }
if (!qcrypto_cipher_supports(
QCRYPTO_CIPHER_ALG_DES, QCRYPTO_CIPHER_MODE_ECB)) {
error_setg(errp,
diff --git a/util/osdep.c b/util/osdep.c
index c7aec36f22..60fcbbaebe 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -31,8 +31,6 @@
#include "qemu/hw-version.h"
#include "monitor/monitor.h"
-static bool fips_enabled = false;
-
static const char *hw_version = QEMU_HW_VERSION;
int socket_set_cork(int fd, int v)
@@ -514,32 +512,6 @@ const char *qemu_hw_version(void)
return hw_version;
}
-void fips_set_state(bool requested)
-{
-#ifdef __linux__
- if (requested) {
- FILE *fds = fopen("/proc/sys/crypto/fips_enabled", "r");
- if (fds != NULL) {
- fips_enabled = (fgetc(fds) == '1');
- fclose(fds);
- }
- }
-#else
- fips_enabled = false;
-#endif /* __linux__ */
-
-#ifdef _FIPS_DEBUG
- fprintf(stderr, "FIPS mode %s (requested %s)\n",
- (fips_enabled ? "enabled" : "disabled"),
- (requested ? "enabled" : "disabled"));
-#endif
-}
-
-bool fips_get_state(void)
-{
- return fips_enabled;
-}
-
#ifdef _WIN32
static void socket_cleanup(void)
{
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PULL 2/3] hw/char: fix qcode array bounds check in ESCC impl
2022-04-26 15:13 [PULL 0/3] Misc next patches Daniel P. Berrangé
2022-04-26 15:13 ` [PULL 1/3] softmmu: remove deprecated --enable-fips option Daniel P. Berrangé
@ 2022-04-26 15:13 ` Daniel P. Berrangé
2022-04-26 15:13 ` [PULL 3/3] github: fix config mistake preventing repo lockdown commenting Daniel P. Berrangé
2022-04-26 20:12 ` [PULL 0/3] Misc next patches Richard Henderson
3 siblings, 0 replies; 5+ messages in thread
From: Daniel P. Berrangé @ 2022-04-26 15:13 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Thomas Huth, Daniel P. Berrangé, Beraldo Leal,
libvir-list, Philippe Mathieu-Daudé,
Wainer dos Santos Moschetta, Gerd Hoffmann,
Marc-André Lureau, Paolo Bonzini, Alex Bennée
There was an off-by-1 in the qcode conversion array bounds
check.
Fixes: e709a61a8fe1076a487376fd657544418a38ba06
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/char/escc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 8755d8d34f..17a908c59b 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -828,7 +828,7 @@ static void sunkbd_handle_event(DeviceState *dev, QemuConsole *src,
}
}
- if (qcode > qemu_input_map_qcode_to_sun_len) {
+ if (qcode >= qemu_input_map_qcode_to_sun_len) {
return;
}
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PULL 3/3] github: fix config mistake preventing repo lockdown commenting
2022-04-26 15:13 [PULL 0/3] Misc next patches Daniel P. Berrangé
2022-04-26 15:13 ` [PULL 1/3] softmmu: remove deprecated --enable-fips option Daniel P. Berrangé
2022-04-26 15:13 ` [PULL 2/3] hw/char: fix qcode array bounds check in ESCC impl Daniel P. Berrangé
@ 2022-04-26 15:13 ` Daniel P. Berrangé
2022-04-26 20:12 ` [PULL 0/3] Misc next patches Richard Henderson
3 siblings, 0 replies; 5+ messages in thread
From: Daniel P. Berrangé @ 2022-04-26 15:13 UTC (permalink / raw)
To: qemu-devel
Cc: Thomas Huth, Daniel P. Berrangé, Beraldo Leal, libvir-list,
Philippe Mathieu-Daudé, Wainer dos Santos Moschetta,
Gerd Hoffmann, Marc-André Lureau, Paolo Bonzini,
Alex Bennée
The previous commit updated the repo lockdown config to the new
format:
commit 9b89cdb2a5064a87b8a7172fa1748d46aa37a9df
Author: Alex Bennée <alex.bennee@linaro.org>
Date: Mon Oct 4 16:43:08 2021 +0100
.github: move repo lockdown to the v2 configuration
Unfortunately the config key names used were wrong, resulting in
the repo lockdown throwing warnings:
Unexpected input(s) 'pull-comment', 'lock-pull', 'close-pull',
valid inputs are ['github-token', 'exclude-issue-created-before',
'exclude-issue-labels', 'issue-labels', 'issue-comment',
'skip-closed-issue-comment', 'close-issue', 'lock-issue',
'issue-lock-reason', 'exclude-pr-created-before', 'exclude-pr-labels',
'pr-labels', 'pr-comment', 'skip-closed-pr-comment', 'close-pr',
'lock-pr', 'pr-lock-reason', 'process-only', 'log-output']
It still locked down the pull requests, due to its default config,
but didn't leave the friendly message explaining why.
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
.github/workflows/lockdown.yml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/lockdown.yml b/.github/workflows/lockdown.yml
index ad8b8f7e30..d5e1265cff 100644
--- a/.github/workflows/lockdown.yml
+++ b/.github/workflows/lockdown.yml
@@ -15,7 +15,7 @@ jobs:
steps:
- uses: dessant/repo-lockdown@v2
with:
- pull-comment: |
+ pr-comment: |
Thank you for your interest in the QEMU project.
This repository is a read-only mirror of the project's repostories hosted
@@ -26,5 +26,5 @@ jobs:
functionality). However, we get a lot of patches, and so we have some
guidelines about contributing on the project website:
https://www.qemu.org/contribute/
- lock-pull: true
- close-pull: true
+ lock-pr: true
+ close-pr: true
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PULL 0/3] Misc next patches
2022-04-26 15:13 [PULL 0/3] Misc next patches Daniel P. Berrangé
` (2 preceding siblings ...)
2022-04-26 15:13 ` [PULL 3/3] github: fix config mistake preventing repo lockdown commenting Daniel P. Berrangé
@ 2022-04-26 20:12 ` Richard Henderson
3 siblings, 0 replies; 5+ messages in thread
From: Richard Henderson @ 2022-04-26 20:12 UTC (permalink / raw)
To: Daniel P. Berrangé, qemu-devel
Cc: Thomas Huth, Beraldo Leal, libvir-list,
Philippe Mathieu-Daudé, Wainer dos Santos Moschetta,
Gerd Hoffmann, Paolo Bonzini, Marc-André Lureau,
Alex Bennée
On 4/26/22 08:13, Daniel P. Berrangé wrote:
> The following changes since commit a1755db71e34df016ffc10aa0727360aae2c6036:
>
> Merge tag 'pull-block-2022-04-25' of https://gitlab.com/hreitz/qemu into staging (2022-04-25 13:35:41 -0700)
>
> are available in the Git repository at:
>
> https://gitlab.com/berrange/qemu tags/misc-next-pull-request
>
> for you to fetch changes up to 5cf434b5af386fadc3418df71d3738676cbb0549:
>
> github: fix config mistake preventing repo lockdown commenting (2022-04-26 16:12:26 +0100)
>
> ----------------------------------------------------------------
> Misc patch queue
>
> * Removes depecated --enable-fips QEMU system emulator option
> * Fixes array bounds check in keycode conversion for ESCC device
Applied, thanks. Please update https://wiki.qemu.org/ChangeLog/7.1 as appropriate.
r~
>
> ----------------------------------------------------------------
>
> Daniel P. Berrangé (3):
> softmmu: remove deprecated --enable-fips option
> hw/char: fix qcode array bounds check in ESCC impl
> github: fix config mistake preventing repo lockdown commenting
>
> .github/workflows/lockdown.yml | 6 +++---
> docs/about/deprecated.rst | 12 ------------
> docs/about/removed-features.rst | 11 +++++++++++
> hw/char/escc.c | 2 +-
> include/qemu/osdep.h | 3 ---
> os-posix.c | 8 --------
> qemu-options.hx | 10 ----------
> ui/vnc.c | 7 -------
> util/osdep.c | 28 ----------------------------
> 9 files changed, 15 insertions(+), 72 deletions(-)
>
^ permalink raw reply [flat|nested] 5+ messages in thread