Since our format is consumable by the fw_cfg device,
we can implement the FW_CFG_DATA_GENERATOR interface.
Acked-by: Laszlo Ersek <ler...@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <phi...@redhat.com>
---
v8: Add example in qemu-options.hx
---
crypto/tls-cipher-suites.c | 19 +++++++++++++++++++
qemu-options.hx | 19 +++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/crypto/tls-cipher-suites.c b/crypto/tls-cipher-suites.c
index f02a041f9a..d6ea0ed190 100644
--- a/crypto/tls-cipher-suites.c
+++ b/crypto/tls-cipher-suites.c
@@ -14,6 +14,7 @@
#include "qemu/error-report.h"
#include "crypto/tlscreds.h"
#include "crypto/tls-cipher-suites.h"
+#include "hw/nvram/fw_cfg.h"
#include "trace.h"
static void parse_cipher_suites(QCryptoTLSCipherSuites *s,
@@ -99,11 +100,28 @@ static void qcrypto_tls_cipher_suites_finalize(Object *obj)
g_free(s->cipher_list);
}
+static const void *qcrypto_tls_cipher_suites_get_data(Object *obj)
+{
+ QCryptoTLSCipherSuites *s = QCRYPTO_TLS_CIPHER_SUITES(obj);
+
+ return s->cipher_list;
+}
+
+static size_t qcrypto_tls_cipher_suites_get_length(Object *obj)
+{
+ QCryptoTLSCipherSuites *s = QCRYPTO_TLS_CIPHER_SUITES(obj);
+
+ return s->cipher_count * sizeof(IANA_TLS_CIPHER);
+}
+
static void qcrypto_tls_cipher_suites_class_init(ObjectClass *oc, void *data)
{
UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
+ FWCfgDataGeneratorClass *fwgc = FW_CFG_DATA_GENERATOR_CLASS(oc);
ucc->complete = qcrypto_tls_cipher_suites_complete;
+ fwgc->get_data = qcrypto_tls_cipher_suites_get_data;
+ fwgc->get_length = qcrypto_tls_cipher_suites_get_length;
}
static const TypeInfo qcrypto_tls_cipher_suites_info = {
@@ -115,6 +133,7 @@ static const TypeInfo qcrypto_tls_cipher_suites_info = {
.class_init = qcrypto_tls_cipher_suites_class_init,
.interfaces = (InterfaceInfo[]) {
{ TYPE_USER_CREATABLE },
+ { TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
}
};
diff --git a/qemu-options.hx b/qemu-options.hx
index c74366d7cc..b12cc910e3 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4585,6 +4585,25 @@ SRST
string as described at
https://gnutls.org/manual/html_node/Priority-Strings.html.
+ An example of use of this object is to enable the UEFI HTTPS Boot.
+ The tls-cipher-suites object exposes the ordered list of permitted
+ TLS cipher suites from the host side to the firmware, via
+ fw_cfg. The list is represented as an array of IANA_TLS_CIPHER
+ objects. The firmware uses the IANA_TLS_CIPHER array for configuring
+ guest-side TLS.
+
+ In the following example, the priority at which the host-side policy
+ is retrieved is given by the ``priority`` property of the new object
+ type. ``priority=@SYSTEM`` may be used to refer to
+ /etc/crypto-policies/back-ends/gnutls.config (given that QEMU uses
+ GNUTLS).
+
+ .. parsed-literal::
+
+ # |qemu_system| \
+ -object tls-cipher-suites,id=mysuite0,priority=@SYSTEM \
+ -fw_cfg name=etc/edk2/https/ciphers,gen_id=mysuite0
+
``-object
filter-buffer,id=id,netdev=netdevid,interval=t[,queue=all|rx|tx][,status=on|off][,position=head|tail|id=<id>][,insert=behind|before]``
Interval t can't be 0, this filter batches the packet delivery:
all packets arriving in a given interval on netdev netdevid are
--
2.21.3
