2015-09-02 17:57:27 +08:00
|
|
|
crypto-obj-y = init.o
|
|
|
|
|
crypto-obj-y += hash.o
|
2016-03-12 02:09:22 +08:00
|
|
|
crypto-obj-$(CONFIG_NETTLE) += hash-nettle.o
|
|
|
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(CONFIG_GCRYPT)) += hash-gcrypt.o
|
2016-07-05 18:45:42 +08:00
|
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(if $(CONFIG_GCRYPT),n,y)) += hash-glib.o
|
2016-12-13 18:42:56 +08:00
|
|
|
crypto-obj-y += hmac.o
|
|
|
|
|
crypto-obj-$(CONFIG_NETTLE) += hmac-nettle.o
|
|
|
|
|
crypto-obj-$(CONFIG_GCRYPT_HMAC) += hmac-gcrypt.o
|
|
|
|
|
crypto-obj-$(if $(CONFIG_NETTLE),n,$(if $(CONFIG_GCRYPT_HMAC),n,y)) += hmac-glib.o
|
2015-09-02 17:57:27 +08:00
|
|
|
crypto-obj-y += aes.o
|
|
|
|
|
crypto-obj-y += desrfb.o
|
|
|
|
|
crypto-obj-y += cipher.o
|
2017-07-15 02:04:05 +08:00
|
|
|
crypto-obj-$(CONFIG_AF_ALG) += afalg.o
|
2015-03-14 01:39:26 +08:00
|
|
|
crypto-obj-y += tlscreds.o
|
crypto: introduce new module for TLS anonymous credentials
Introduce a QCryptoTLSCredsAnon class which is used to
manage anonymous TLS credentials. Use of this class is
generally discouraged since it does not offer strong
security, but it is required for backwards compatibility
with the current VNC server implementation.
Simple example CLI configuration:
$QEMU -object tls-creds-anon,id=tls0,endpoint=server
Example using pre-created diffie-hellman parameters
$QEMU -object tls-creds-anon,id=tls0,endpoint=server,\
dir=/path/to/creds/dir
The 'id' value in the -object args will be used to associate the
credentials with the network services. For example, when the VNC
server is later converted it would use
$QEMU -object tls-creds-anon,id=tls0,.... \
-vnc 127.0.0.1:1,tls-creds=tls0
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
2015-03-14 01:39:26 +08:00
|
|
|
crypto-obj-y += tlscredsanon.o
|
2015-03-14 01:39:26 +08:00
|
|
|
crypto-obj-y += tlscredsx509.o
|
2015-03-03 01:23:31 +08:00
|
|
|
crypto-obj-y += tlssession.o
|
crypto: add QCryptoSecret object class for password/key handling
Introduce a new QCryptoSecret object class which will be used
for providing passwords and keys to other objects which need
sensitive credentials.
The new object can provide secret values directly as properties,
or indirectly via a file. The latter includes support for file
descriptor passing syntax on UNIX platforms. Ordinarily passing
secret values directly as properties is insecure, since they
are visible in process listings, or in log files showing the
CLI args / QMP commands. It is possible to use AES-256-CBC to
encrypt the secret values though, in which case all that is
visible is the ciphertext. For ad hoc developer testing though,
it is fine to provide the secrets directly without encryption
so this is not explicitly forbidden.
The anticipated scenario is that libvirtd will create a random
master key per QEMU instance (eg /var/run/libvirt/qemu/$VMNAME.key)
and will use that key to encrypt all passwords it provides to
QEMU via '-object secret,....'. This avoids the need for libvirt
(or other mgmt apps) to worry about file descriptor passing.
It also makes life easier for people who are scripting the
management of QEMU, for whom FD passing is significantly more
complex.
Providing data inline (insecure, only for ad hoc dev testing)
$QEMU -object secret,id=sec0,data=letmein
Providing data indirectly in raw format
printf "letmein" > mypasswd.txt
$QEMU -object secret,id=sec0,file=mypasswd.txt
Providing data indirectly in base64 format
$QEMU -object secret,id=sec0,file=mykey.b64,format=base64
Providing data with encryption
$QEMU -object secret,id=master0,file=mykey.b64,format=base64 \
-object secret,id=sec0,data=[base64 ciphertext],\
keyid=master0,iv=[base64 IV],format=base64
Note that 'format' here refers to the format of the ciphertext
data. The decrypted data must always be in raw byte format.
More examples are shown in the updated docs.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-10-14 16:58:38 +08:00
|
|
|
crypto-obj-y += secret.o
|
2015-10-31 13:39:52 +08:00
|
|
|
crypto-obj-$(CONFIG_GCRYPT) += random-gcrypt.o
|
|
|
|
|
crypto-obj-$(if $(CONFIG_GCRYPT),n,$(CONFIG_GNUTLS_RND)) += random-gnutls.o
|
2016-07-21 17:37:14 +08:00
|
|
|
crypto-obj-$(if $(CONFIG_GCRYPT),n,$(if $(CONFIG_GNUTLS_RND),n,y)) += random-platform.o
|
2015-10-14 20:14:04 +08:00
|
|
|
crypto-obj-y += pbkdf.o
|
2016-03-29 22:47:51 +08:00
|
|
|
crypto-obj-$(CONFIG_NETTLE_KDF) += pbkdf-nettle.o
|
|
|
|
|
crypto-obj-$(if $(CONFIG_NETTLE_KDF),n,$(CONFIG_GCRYPT_KDF)) += pbkdf-gcrypt.o
|
2015-10-15 19:35:28 +08:00
|
|
|
crypto-obj-y += ivgen.o
|
|
|
|
|
crypto-obj-y += ivgen-essiv.o
|
|
|
|
|
crypto-obj-y += ivgen-plain.o
|
|
|
|
|
crypto-obj-y += ivgen-plain64.o
|
2015-10-23 23:14:25 +08:00
|
|
|
crypto-obj-y += afsplit.o
|
2016-02-11 22:00:17 +08:00
|
|
|
crypto-obj-y += xts.o
|
2015-10-24 18:44:13 +08:00
|
|
|
crypto-obj-y += block.o
|
|
|
|
|
crypto-obj-y += block-qcow.o
|
2015-10-24 18:55:48 +08:00
|
|
|
crypto-obj-y += block-luks.o
|
2015-09-02 17:57:27 +08:00
|
|
|
|
|
|
|
|
# Let the userspace emulators avoid linking gnutls/etc
|
|
|
|
|
crypto-aes-obj-y = aes.o
|
2015-10-31 13:39:52 +08:00
|
|
|
|
2015-10-14 20:14:04 +08:00
|
|
|
stub-obj-y += pbkdf-stub.o
|