[Qemu-devel] [PATCH] crypto: ensure we use a predictable TLS priority setting

[Qemu-devel] [PATCH] crypto: ensure we use a predictable TLS priority setting

[Daniel P. Berrangé]

The TLS test cert generation relies on a fixed set of algorithms that are
only usable under GNUTLS' default priority setting. When building QEMU
with a custom distro specific priority setting, this can cause the TLS
tests to fail. By forcing the tests to always use "NORMAL" priority we
can make them more robust.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/test-crypto-tlssession.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/test-crypto-tlssession.c b/tests/test-crypto-tlssession.c
index 1a4a066d76..82f21c27f2 100644
--- a/tests/test-crypto-tlssession.c
+++ b/tests/test-crypto-tlssession.c
@@ -75,6 +75,7 @@ static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
                      "server" : "client"),
         "dir", certdir,
         "verify-peer", "yes",
+        "priority", "NORMAL",
         /* We skip initial sanity checks here because we
          * want to make sure that problems are being
          * detected at the TLS session validation stage,
-- 
2.14.3

Re: [Qemu-devel] [PATCH] crypto: ensure we use a predictable TLS priority setting

[Eric Blake]

On 02/28/2018 08:06 AM, Daniel P. Berrangé wrote:
> The TLS test cert generation relies on a fixed set of algorithms that are
> only usable under GNUTLS' default priority setting. When building QEMU
> with a custom distro specific priority setting, this can cause the TLS
> tests to fail. By forcing the tests to always use "NORMAL" priority we
> can make them more robust.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   tests/test-crypto-tlssession.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Eric Blake <eblake@redhat.com>

> 
> diff --git a/tests/test-crypto-tlssession.c b/tests/test-crypto-tlssession.c
> index 1a4a066d76..82f21c27f2 100644
> --- a/tests/test-crypto-tlssession.c
> +++ b/tests/test-crypto-tlssession.c
> @@ -75,6 +75,7 @@ static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
>                        "server" : "client"),
>           "dir", certdir,
>           "verify-peer", "yes",
> +        "priority", "NORMAL",
>           /* We skip initial sanity checks here because we
>            * want to make sure that problems are being
>            * detected at the TLS session validation stage,
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org