From nobody Mon Feb 9 05:19:28 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1652714055; cv=none; d=zohomail.com; s=zohoarc; b=FNixW61btbz5KOV8KJBanG2lEoaf4t0wACWsQqXkPaSNjKBaHbykcNAzcsBzItiYTKYf6dvzSeejuB9D75+/J0vpVzSuDFvUkxeczfRsP7WxKqq6FodNl6uoko4hMZVDxpLQzUIYgLliG+48NRHPLnB8sOzCNYzLRS1XWXjWhS8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1652714055; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=waeyKoyCGB7CGAikihWfFRquj5PsfJwXbqFY3/XZ0lY=; b=oGPVrm9nOF4/iMlAMTAcfsfsHC0a4sOP2fStAu+be4Sv0YhETY9sw4ArclxOa2RYqDLwp6hlUGufGf/pIazL+vL9LfW3GIoW0QCW+xpt02WHsuqoCsK0aT+Z9DV997uTLqZCVWCIx+4YBPX12rDMtSGmnw/SsqFRXy7bTcUC7HU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1652714055491827.2133696267291; Mon, 16 May 2022 08:14:15 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-656-k4R2a4ahPqWDInWJSQj6ag-1; Mon, 16 May 2022 11:13:05 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id BAF981C01B24; Mon, 16 May 2022 15:12:54 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id A529CC50941; Mon, 16 May 2022 15:12:54 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 78CB81947070; Mon, 16 May 2022 15:12:54 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 011A6194704E for ; Mon, 16 May 2022 15:12:53 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id C9209401DBE; Mon, 16 May 2022 15:12:52 +0000 (UTC) Received: from speedmetal.lan (unknown [10.40.208.21]) by smtp.corp.redhat.com (Postfix) with ESMTP id 2CCE2492C14 for ; Mon, 16 May 2022 15:12:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1652714054; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=waeyKoyCGB7CGAikihWfFRquj5PsfJwXbqFY3/XZ0lY=; b=KuhaXsJ4bu0L5boEEKhEfpFeU18GVny0pszHsJvLUuSVZC6RUO++rcModVNKm/8MNWH3jp F9pow7yVESTql/cVQncj+LDtk054HuICdn2Yf3WXyj8gzaU99w2OBeqN4191b4+GlrrRhA ndSpcjhFtCfge0LfQWaa39AD8HHvCnI= X-MC-Unique: k4R2a4ahPqWDInWJSQj6ag-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Peter Krempa To: libvir-list@redhat.com Subject: [PATCH 09/11] qemuBuildCommandLine: Inline qemuCheckFips Date: Mon, 16 May 2022 17:12:39 +0200 Message-Id: <31d2a578b67e10a5b43bff9aced406bcba615701.1652710341.git.pkrempa@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.10 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1652714057213100001 Content-Type: text/plain; charset="utf-8" Now that we store the state of the host FIPS mode setting in the qemu driver object, we don't need to outsource the logic into 'qemuCheckFips'. Additionally since we no longer support very old qemu's which would not yet have --enable-fips we can drop the part of the comment about very old qemus. Signed-off-by: Peter Krempa --- src/qemu/qemu_command.c | 41 +++++++++++++--------------------------- src/qemu/qemu_command.h | 5 ----- src/qemu/qemu_driver.c | 4 +--- src/qemu/qemu_process.c | 3 --- src/qemu/qemu_process.h | 1 - tests/qemuxml2argvtest.c | 9 +-------- 6 files changed, 15 insertions(+), 48 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index c48575f78c..8705f0018c 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1769,32 +1769,6 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDef *= disk) } -/* QEMU 1.2 and later have a binary flag -enable-fips that must be - * used for VNC auth to obey FIPS settings; but the flag only - * exists on Linux, and with no way to probe for it via QMP. Our - * solution: if FIPS mode is required, then unconditionally use - * the flag, regardless of qemu version, for the following matrix: - * - * old QEMU new QEMU - * FIPS enabled doesn't start VNC auth disabled - * FIPS disabled/missing VNC auth enabled VNC auth enabled - * - * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios - * where FIPS is required, QEMU must be built against libgcrypt - * which automatically enforces FIPS compliance. - */ -bool -qemuCheckFips(virDomainObj *vm) -{ - qemuDomainObjPrivate *priv =3D vm->privateData; - - if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS)) - return false; - - return priv->driver->hostFips; -} - - /** * qemuDiskBusIsSD: * @bus: disk bus @@ -10417,7 +10391,6 @@ qemuBuildCommandLine(virDomainObj *vm, const char *migrateURI, virDomainMomentObj *snapshot, virNetDevVPortProfileOp vmop, - bool enableFips, size_t *nnicindexes, int **nicindexes, unsigned int flags) @@ -10478,7 +10451,19 @@ qemuBuildCommandLine(virDomainObj *vm, if (qemuBuildPflashBlockdevCommandLine(cmd, priv) < 0) return NULL; - if (enableFips) + /* QEMU 1.2 and later have a binary flag -enable-fips that must be + * used for VNC auth to obey FIPS settings; but the flag only + * exists on Linux, and with no way to probe for it via QMP. Our + * solution: if FIPS mode is required, then unconditionally use the fl= ag. + * + * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios + * where FIPS is required, QEMU must be built against libgcrypt + * which automatically enforces FIPS compliance. + * + * Note this is the only use of driver->hostFips. + */ + if (driver->hostFips && + virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS)) virCommandAddArg(cmd, "-enable-fips"); if (qemuBuildMachineCommandLine(cmd, cfg, def, qemuCaps, priv) < 0) diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index db5b532cb8..72b0401c7b 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -51,7 +51,6 @@ virCommand *qemuBuildCommandLine(virDomainObj *vm, const char *migrateURI, virDomainMomentObj *snapshot, virNetDevVPortProfileOp vmop, - bool enableFips, size_t *nnicindexes, int **nicindexes, unsigned int flags); @@ -214,10 +213,6 @@ int qemuGetDriveSourceString(virStorageSource *src, bool qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDef *disk); - -bool -qemuCheckFips(virDomainObj *vm); - virJSONValue *qemuBuildHotpluggableCPUProps(const virDomainVcpuDef *vcpu) ATTRIBUTE_NONNULL(1); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8097dcf144..2ca264d9f9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6391,9 +6391,7 @@ static char *qemuConnectDomainXMLToNative(virConnectP= tr conn, if (qemuConnectDomainXMLToNativePrepareHost(vm) < 0) return NULL; - if (!(cmd =3D qemuProcessCreatePretendCmdBuild(vm, NULL, - qemuCheckFips(vm), - commandlineflags))) + if (!(cmd =3D qemuProcessCreatePretendCmdBuild(vm, NULL, commandlinefl= ags))) return NULL; return virCommandToString(cmd, false); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index fbad1254a0..d50cf2e6be 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7448,7 +7448,6 @@ qemuProcessLaunch(virConnectPtr conn, if (!(cmd =3D qemuBuildCommandLine(vm, incoming ? "defer" : NULL, snapshot, vmop, - qemuCheckFips(vm), &nnicindexes, &nicindexes, 0))) goto cleanup; @@ -7947,14 +7946,12 @@ qemuProcessCreatePretendCmdPrepare(virQEMUDriver *d= river, virCommand * qemuProcessCreatePretendCmdBuild(virDomainObj *vm, const char *migrateURI, - bool enableFips, unsigned int flags) { return qemuBuildCommandLine(vm, migrateURI, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - enableFips, NULL, NULL, flags); diff --git a/src/qemu/qemu_process.h b/src/qemu/qemu_process.h index 9856da3bb5..2387fcdcdc 100644 --- a/src/qemu/qemu_process.h +++ b/src/qemu/qemu_process.h @@ -99,7 +99,6 @@ int qemuProcessCreatePretendCmdPrepare(virQEMUDriver *dri= ver, virCommand *qemuProcessCreatePretendCmdBuild(virDomainObj *vm, const char *migrateURI, - bool enableFips, unsigned int flags); int qemuProcessInit(virQEMUDriver *driver, diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 2385fa1209..50aea47a68 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -386,11 +386,9 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv, unsigned int flags) { qemuDomainObjPrivate *priv =3D vm->privateData; - bool enableFips; size_t i; drv->hostFips =3D flags & FLAG_FIPS_HOST; - enableFips =3D drv->hostFips; if (qemuProcessCreatePretendCmdPrepare(drv, vm, migrateURI, VIR_QEMU_PROCESS_START_COLD) < = 0) @@ -486,12 +484,7 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv, } } - /* we can't use qemuCheckFips() directly as it queries host state */ - if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS)) - enableFips =3D false; - - return qemuProcessCreatePretendCmdBuild(vm, migrateURI, - enableFips, 0); + return qemuProcessCreatePretendCmdBuild(vm, migrateURI, 0); } --=20 2.35.3