From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45452) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZTydb-0004jO-0w for qemu-devel@nongnu.org; Mon, 24 Aug 2015 16:46:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZTydY-0008RF-Af for qemu-devel@nongnu.org; Mon, 24 Aug 2015 16:46:38 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49095) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZTydY-0008Qc-3n for qemu-devel@nongnu.org; Mon, 24 Aug 2015 16:46:36 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (Postfix) with ESMTPS id 932288F31B for ; Mon, 24 Aug 2015 20:46:35 +0000 (UTC) References: <1440425695-24286-1-git-send-email-berrange@redhat.com> <1440425695-24286-3-git-send-email-berrange@redhat.com> From: Eric Blake Message-ID: <55DB82A6.1080706@redhat.com> Date: Mon, 24 Aug 2015 14:46:30 -0600 MIME-Version: 1.0 In-Reply-To: <1440425695-24286-3-git-send-email-berrange@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="q3SPDGO3WawIWomk88DqUC7hDFk4IKjPE" Subject: Re: [Qemu-devel] [PATCH v4 2/7] crypto: introduce new module for TLS anonymous credentials List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , qemu-devel@nongnu.org Cc: Paolo Bonzini , Gerd Hoffmann This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --q3SPDGO3WawIWomk88DqUC7hDFk4IKjPE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 08/24/2015 08:14 AM, Daniel P. Berrange wrote: > Introduce a QCryptoTLSCredsAnon class which is used to > manage anonymous TLS credentials. Use of this class is > generally discouraged since it does not offer strong > security, but it is required for backwards compatibility > with the current VNC server implementation. >=20 > Simple example CLI configuration: >=20 > $QEMU -object tls-creds-anon,id=3Dtls0,endpoint=3Dserver >=20 > Example using pre-created diffie-hellman parameters >=20 > $QEMU -object tls-creds-anon,id=3Dtls0,endpoint=3Dserver,\ > dir=3D/path/to/creds/dir >=20 > The 'id' value in the -object args will be used to associate the > credentials with the network services. For eample, when the VNC s/eample/example/ > server is later converted it would use >=20 > $QEMU -object tls-creds-anon,id=3Dtls0,.... \ > -vnc 127.0.0.1:1,tls-creds=3Dtls0 >=20 > Signed-off-by: Daniel P. Berrange > --- > +++ b/crypto/init.c > @@ -20,6 +20,7 @@ > =20 > #include "crypto/init.h" > #include "crypto/tlscreds.h" > +#include "crypto/tlscredsanon.h" > #include "qemu/thread.h" > =20 > #ifdef CONFIG_GNUTLS > @@ -144,6 +145,7 @@ int qcrypto_init(Error **errp) > * clever enough to see the constructor :-( > */ > qcrypto_tls_creds_dummy(); > + qcrypto_tls_creds_anon_dummy(); Are there any gcc hacks such as adding __attribute__((used)) that might help? > +++ b/crypto/tlscredsanon.c > @@ -0,0 +1,235 @@ > +/* #define QCRYPTO_DEBUG */ > + > +#ifdef QCRYPTO_DEBUG > +#define DPRINTF(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); }= while (0) > +#else > +#define DPRINTF(fmt, ...) do { } while (0) > +#endif Again, please rework this to avoid bitrot when debug is off (I'll quit pointing it out, but suspect it to be a common problem in this series) --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --q3SPDGO3WawIWomk88DqUC7hDFk4IKjPE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJV24KmAAoJEKeha0olJ0NqcqkIAJW4bO4ibKiMqU6oNnKNujOq toBLrJzPw7UxGbS4l2IVeZG31TPTfki3Aw5yPDAIVZuVUMuKk8pIFe1WGiTczqMm anrYoY3TGl2M5V/pWsRCWuA/XVwKyYfcLYRxBslMg8Ukr1Ox+X/1lVvR+cpAzV5k zh0sLyAt2s7j9Cz5e1hi5sGbilzclzPi5yv3NwznSfX732pbE3H0AdaRdDGHCV/P N/qRO31rFLofnP5whJ00DUqLKqcXz7FaZDoiA03QMWR2nK7wu2gfutiO2HUVm4uC 59t0kGeby4GDPbYb4Pt0pGSvWa5YVxHjkBWkeC3DReUwS5ibi4UKcYIZfMxpfcY= =xJFZ -----END PGP SIGNATURE----- --q3SPDGO3WawIWomk88DqUC7hDFk4IKjPE--