Skip to content

WIP: AF_ALG support for GnuTLS

Stephan Mueller requested to merge smuellerDD/gnutls:afalg into master

This merge request is work in progress to allow discussion of the patch. There are the following issues I currently observe:

  • I took the priority of the cipher algorithms used for registering them with GnuTLS from the cryptodev.c implementation. This value is defined to be 90 which is larger than the software algorithms. According to lib/crypto-backend.c:algo_register, however, algorithms with a lower priority are preferred over ones with higher priority. This implies that with the current priority of 90, AF_ALG ciphers will never be used. Thus, shall the prio of 90 be used which is higher than all software priorities? If yes, shall the register code in afalg.c be changed to not error out if gnutls_crypto*_register return an error (due to the higher priority preventing a registering)?

  • When compiling the code as defined in .gitlab-ci.yml inside the build/ directory, I get the following error which is not thrown when compiling the code from the main directory (hence I am unsure about the cause of this error): libtool: error: 'afalg.lo' is not a valid libtool object

  • The CI test definition of AF_ALG/Fedora/x86_64 as defined in .gitlab-ci.yml will currently fail to compile on GitLab because the software image does not contain libkcapi which is a prerequisite to --enable-afalg. I am unsure how to circumnavigate this issue.

In addition, the following topics have been announced previously that need review and approval:

  • Are the correct GnuTLS error codes used?

  • The AEAD implementation register only the aead_encrypt and aead_decrypt functions. Is this sufficient for all purposes of GnuTLS? Note, the implementation found for other AEAD backends would require hacks that I would like to avoid.

Merge request reports