| Summary: | app-emulation/qemu: add gnutls TLS policy support(?) | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Vjaceslavs Klimovs <vklimovs> |
| Component: | Current packages | Assignee: | Matthias Maier <tamiko> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | base-system, sam, slyfox, virtualization |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
patch for app-emulation/qemu
ebuild patch |
||
|
Description
Vjaceslavs Klimovs
2020-10-12 01:52:49 UTC
I think I've got the summary right. CCing base-system in case they have input as the gnutls maintainers. I would prefer Gentoo not to have Gentoo-specific patches around the configuration options. Can you send the patch upstream to qemu-devel@ ML? https://wiki.qemu.org/Contribute/MailingLists has some pointers. Created attachment 666314 [details, diff]
ebuild patch
I was using source patch as an example, it's possible to pass this parameter as part of build configuration, see attached patch.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=59088d47f0af5e6be740f8c86bdfa9afa6b9b78b commit 59088d47f0af5e6be740f8c86bdfa9afa6b9b78b Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2020-10-18 09:24:49 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2020-10-18 09:24:49 +0000 app-emulation/qemu: allow user'specified @QEMU TLS policy Patch-by: Vjaceslavs Klimovs Closes: https://bugs.gentoo.org/747928 Package-Manager: Portage-3.0.8, Repoman-3.0.1 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> app-emulation/qemu/qemu-5.1.0-r2.ebuild | 856 ++++++++++++++++++++++++++++++++ 1 file changed, 856 insertions(+) (In reply to Vjaceslavs Klimovs from comment #3) > Created attachment 666314 [details, diff] [details, diff] > ebuild patch > > I was using source patch as an example, it's possible to pass this parameter > as part of build configuration, see attached patch. Applied. Thank you! I still suggest to send the default change upstream so more distributions could share a common default location for overrides. I apologize for reopening this, but after further testing it's clear that this breaks qemu live migrations over TLS on machines that *do not* specify app specific TLS priority in /etc/gnutls/config. In other words, this works really well on a machine that specifies e.g. [priorities] QEMU = NONE:+VERS-TLS1.2:+AES-128-GCM:+AEAD:+ECDHE-ECDSA:+GROUP-SECP256R1:+SIGN-ECDSA-SHA256 in /etc/gnutls/config, but actually breaks migrations on a machine that does not. Would it be possible for ebuild to install /etc/gnutls/config file with something like: [priorities] QEMU = NORMAL ? Once again I apologize for not testing the proposal more thoroughly before suggesting it. I would prefer if /etc/gnutls/config file would not be owned by 'qemu` package as it does not sound qemu-specific. Would be nice if there was a directory we could throw a file without need to resolve collisions against other package users. Let's remove the Gentoo-specific plumbing meanwhile and expose a mechanism to pass arbitrary configure options to qemu ebuild via /etc/portage/env.d/. The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8afea161831a0e0de8a056438d02637312c48e5b commit 8afea161831a0e0de8a056438d02637312c48e5b Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2020-10-25 19:36:21 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2020-10-25 19:36:49 +0000 app-emulation/qemu: plumb EXTRA_CONF_QEMU variable for ./configure New EXTRA_CONF_QEMU variable To ease passing arbitrary overrides to qemu's configure. Usage example: EXTRA_CONF_QEMU='--tls-priority=@QEMU,NORMAL' emerge -v1 qemu Expected to be used in make.conf or package.env override. Use at your own risk! Closes: https://bugs.gentoo.org/747928 Package-Manager: Portage-3.0.8, Repoman-3.0.2 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> app-emulation/qemu/qemu-5.1.0-r1.ebuild | 4 ++++ app-emulation/qemu/qemu-9999.ebuild | 4 ++++ 2 files changed, 8 insertions(+) Additionally, it has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9221cf6013d85b7bc292a6b44f2ccfeaa9ad52e6 commit 9221cf6013d85b7bc292a6b44f2ccfeaa9ad52e6 Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2020-10-25 19:25:45 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2020-10-25 19:36:49 +0000 app-emulation/qemu: revert "allow user-specified @QEMU TLS policy" `--tls-priority=@QEMU,NORMAL` does not work without extra configuration. Let's remove it for now. Reported-by: Vjaceslavs Klimovs Bug: https://bugs.gentoo.org/747928 Package-Manager: Portage-3.0.8, Repoman-3.0.2 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> app-emulation/qemu/qemu-5.1.0-r2.ebuild | 856 -------------------------------- app-emulation/qemu/qemu-9999.ebuild | 1 - 2 files changed, 857 deletions(-) |
