On Wed, Oct 21, 2020 at 11:51:10AM +0200, Paolo Bonzini wrote:
On 21/10/20 10:38, Daniel P. Berrangé wrote:
On Tue, Oct 20, 2020 at 07:22:03PM +0200, Paolo Bonzini wrote:
On 20/10/20 18:22, Daniel P. Berrangé wrote:
@@ -153,6 +153,9 @@ int os_parse_cmd_args(int index, const char *optarg) break; #if defined(CONFIG_LINUX) case QEMU_OPTION_enablefips: + warn_report("-enable-fips is deprecated, please build QEMU with " + "the `libgcrypt` library as the cryptography provider " + "to enable FIPS compliance"); fips_set_state(true); break; #endif
Should you also remove fips_set_state(true) and make fips_get_state() return the contents of /proc/sys/crypto/fips_enabled, so that VNC password authentication is disabled?
I did think about doing that, but decided that since my intention is to delete all trace of fips_get_state / fips_set_state at the end of the deprecation period, that it'd be saner just to leave the semantics unchanged during the deprecation period.
But would it be correct? In order to have the advertised behavior of "enable FIPS compliance just with procfs, no need to do anything in QEMU" you need to disable VNC password authentication; so while fips_set_state is an abomination, fips_get_state should remain.
There's no need for fips_get_state. Once you build QEMU with libgcrypt, when VNC requests a DES cipher handle, gcrypt will return an error as that algorithm is forbidden in FIPS mode. This is the primary reason for outsourcing all crypto to a separate library and ignoring the impls in QEMU. Claiming QEMU is FIPS compliant without using libgcrypt is a bit of joke since we don't do any self-tests of ciphers, hence this deprecation notice is warning people that libgcrypt is going to be mandatory if you care about FIPS.
Deprecation notices shouldn't really be associated with changes in functionality at time they are introduced.
I think you can consider it a bugfix since no one sets fips_enabled without knowing what they're doing.
I just would rather not change semantics of something that we are intending to remove Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|