[PATCH 09/11] qemuBuildCommandLine: Inline qemuCheckFips

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Now that we store the state of the host FIPS mode setting in the qemu
driver object, we don't need to outsource the logic into
'qemuCheckFips'.

Additionally since we no longer support very old qemu's which would not
yet have --enable-fips we can drop the part of the comment about very
old qemus.

Signed-off-by: Peter Krempa <pkrempa@xxxxxxxxxx>
---
 src/qemu/qemu_command.c  | 41 +++++++++++++---------------------------
 src/qemu/qemu_command.h  |  5 -----
 src/qemu/qemu_driver.c   |  4 +---
 src/qemu/qemu_process.c  |  3 ---
 src/qemu/qemu_process.h  |  1 -
 tests/qemuxml2argvtest.c |  9 +--------
 6 files changed, 15 insertions(+), 48 deletions(-)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index c48575f78c..8705f0018c 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1769,32 +1769,6 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDef *disk)
 }


-/* QEMU 1.2 and later have a binary flag -enable-fips that must be
- * used for VNC auth to obey FIPS settings; but the flag only
- * exists on Linux, and with no way to probe for it via QMP.  Our
- * solution: if FIPS mode is required, then unconditionally use
- * the flag, regardless of qemu version, for the following matrix:
- *
- *                          old QEMU            new QEMU
- * FIPS enabled             doesn't start       VNC auth disabled
- * FIPS disabled/missing    VNC auth enabled    VNC auth enabled
- *
- * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios
- * where FIPS is required, QEMU must be built against libgcrypt
- * which automatically enforces FIPS compliance.
- */
-bool
-qemuCheckFips(virDomainObj *vm)
-{
-    qemuDomainObjPrivate *priv = vm->privateData;
-
-    if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS))
-        return false;
-
-    return priv->driver->hostFips;
-}
-
-
 /**
  * qemuDiskBusIsSD:
  * @bus: disk bus
@@ -10417,7 +10391,6 @@ qemuBuildCommandLine(virDomainObj *vm,
                      const char *migrateURI,
                      virDomainMomentObj *snapshot,
                      virNetDevVPortProfileOp vmop,
-                     bool enableFips,
                      size_t *nnicindexes,
                      int **nicindexes,
                      unsigned int flags)
@@ -10478,7 +10451,19 @@ qemuBuildCommandLine(virDomainObj *vm,
     if (qemuBuildPflashBlockdevCommandLine(cmd, priv) < 0)
         return NULL;

-    if (enableFips)
+    /* QEMU 1.2 and later have a binary flag -enable-fips that must be
+     * used for VNC auth to obey FIPS settings; but the flag only
+     * exists on Linux, and with no way to probe for it via QMP.  Our
+     * solution: if FIPS mode is required, then unconditionally use the flag.
+     *
+     * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios
+     * where FIPS is required, QEMU must be built against libgcrypt
+     * which automatically enforces FIPS compliance.
+     *
+     * Note this is the only use of driver->hostFips.
+     */
+    if (driver->hostFips &&
+        virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS))
         virCommandAddArg(cmd, "-enable-fips");

     if (qemuBuildMachineCommandLine(cmd, cfg, def, qemuCaps, priv) < 0)
diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
index db5b532cb8..72b0401c7b 100644
--- a/src/qemu/qemu_command.h
+++ b/src/qemu/qemu_command.h
@@ -51,7 +51,6 @@ virCommand *qemuBuildCommandLine(virDomainObj *vm,
                                  const char *migrateURI,
                                  virDomainMomentObj *snapshot,
                                  virNetDevVPortProfileOp vmop,
-                                 bool enableFips,
                                  size_t *nnicindexes,
                                  int **nicindexes,
                                  unsigned int flags);
@@ -214,10 +213,6 @@ int qemuGetDriveSourceString(virStorageSource *src,
 bool
 qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDef *disk);

-
-bool
-qemuCheckFips(virDomainObj *vm);
-
 virJSONValue *qemuBuildHotpluggableCPUProps(const virDomainVcpuDef *vcpu)
     ATTRIBUTE_NONNULL(1);

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 8097dcf144..2ca264d9f9 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6391,9 +6391,7 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn,
     if (qemuConnectDomainXMLToNativePrepareHost(vm) < 0)
         return NULL;

-    if (!(cmd = qemuProcessCreatePretendCmdBuild(vm, NULL,
-                                                 qemuCheckFips(vm),
-                                                 commandlineflags)))
+    if (!(cmd = qemuProcessCreatePretendCmdBuild(vm, NULL, commandlineflags)))
         return NULL;

     return virCommandToString(cmd, false);
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index fbad1254a0..d50cf2e6be 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -7448,7 +7448,6 @@ qemuProcessLaunch(virConnectPtr conn,
     if (!(cmd = qemuBuildCommandLine(vm,
                                      incoming ? "defer" : NULL,
                                      snapshot, vmop,
-                                     qemuCheckFips(vm),
                                      &nnicindexes, &nicindexes, 0)))
         goto cleanup;

@@ -7947,14 +7946,12 @@ qemuProcessCreatePretendCmdPrepare(virQEMUDriver *driver,
 virCommand *
 qemuProcessCreatePretendCmdBuild(virDomainObj *vm,
                                  const char *migrateURI,
-                                 bool enableFips,
                                  unsigned int flags)
 {
     return qemuBuildCommandLine(vm,
                                 migrateURI,
                                 NULL,
                                 VIR_NETDEV_VPORT_PROFILE_OP_NO_OP,
-                                enableFips,
                                 NULL,
                                 NULL,
                                 flags);
diff --git a/src/qemu/qemu_process.h b/src/qemu/qemu_process.h
index 9856da3bb5..2387fcdcdc 100644
--- a/src/qemu/qemu_process.h
+++ b/src/qemu/qemu_process.h
@@ -99,7 +99,6 @@ int qemuProcessCreatePretendCmdPrepare(virQEMUDriver *driver,

 virCommand *qemuProcessCreatePretendCmdBuild(virDomainObj *vm,
                                              const char *migrateURI,
-                                             bool enableFips,
                                              unsigned int flags);

 int qemuProcessInit(virQEMUDriver *driver,
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 2385fa1209..50aea47a68 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -386,11 +386,9 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv,
                                unsigned int flags)
 {
     qemuDomainObjPrivate *priv = vm->privateData;
-    bool enableFips;
     size_t i;

     drv->hostFips = flags & FLAG_FIPS_HOST;
-    enableFips = drv->hostFips;

     if (qemuProcessCreatePretendCmdPrepare(drv, vm, migrateURI,
                                            VIR_QEMU_PROCESS_START_COLD) < 0)
@@ -486,12 +484,7 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv,
         }
     }

-    /* we can't use qemuCheckFips() directly as it queries host state */
-    if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS))
-        enableFips = false;
-
-    return qemuProcessCreatePretendCmdBuild(vm, migrateURI,
-                                            enableFips, 0);
+    return qemuProcessCreatePretendCmdBuild(vm, migrateURI, 0);
 }


-- 
2.35.3




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux