[Bug 2150143] [NEW] Enable AF_ALG in gnutls

[Wesley Hershberger]

Public bug reported:

Copying Debian #1134722 to Ubuntu; original report included below.

A while ago, gnutls upstream added support for AF_ALG as an
alternative crypto backend [1]. The feature is disabled in the latest
version of gnutls in sid:

configure: External hardware support:

  /dev/crypto:          no
  AF_ALG support:       no
  Hardware accel:       x86-64
  Padlock accel:        yes
  Random gen. variant:  getrandom
  PKCS#11 support:      yes
  TPM support:          no
  TPM2 support:         no
  KTLS support:         no

It would be nice to enable this feature to allow userspace programs
using gnutls (QEMU in my case) to use hardware-accelerated crypto
(Intel QAT or others).

I'm attaching a (partial) patch with the compile flag & build-dep on
libkcapi. When applied to 3.8.12-2ubuntu1 the tests fail
(tests/slow/test-ciphers.sh, no more information provided in the log),
so this probably will take some additional investigation.

This probably also implies adding a runtime-dep on libkcapi and needs
kernel module af_alg loaded.

I also saw #1072514 which I guess serves the same purpose from a
different angle.

Thanks for your consideration.
~Wesley

[1] https://blogs.gnome.org/dueno/af_alg-support-in-gnutls/

** Affects: gnutls
     Importance: Unknown
         Status: Unknown

** Affects: gnutls28 (Ubuntu)
     Importance: Undecided
         Status: New

** Attachment added: "enable-af-alg.patch"
   https://bugs.launchpad.net/bugs/2150143/+attachment/5964544/+files/enable-af-alg.patch

** Bug watch added: Debian Bug tracker #1134722
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134722

** Also affects: gnutls via
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134722
   Importance: Unknown
       Status: Unknown

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gnutls28 in Ubuntu.
https://bugs.launchpad.net/bugs/2150143

Title:
  Enable AF_ALG in gnutls

Status in Gnutls:
  Unknown
Status in gnutls28 package in Ubuntu:
  New

Bug description:
  Copying Debian #1134722 to Ubuntu; original report included below.

  A while ago, gnutls upstream added support for AF_ALG as an
  alternative crypto backend [1]. The feature is disabled in the latest
  version of gnutls in sid:

  configure: External hardware support:

    /dev/crypto:          no
    AF_ALG support:       no
    Hardware accel:       x86-64
    Padlock accel:        yes
    Random gen. variant:  getrandom
    PKCS#11 support:      yes
    TPM support:          no
    TPM2 support:         no
    KTLS support:         no

  It would be nice to enable this feature to allow userspace programs
  using gnutls (QEMU in my case) to use hardware-accelerated crypto
  (Intel QAT or others).

  I'm attaching a (partial) patch with the compile flag & build-dep on
  libkcapi. When applied to 3.8.12-2ubuntu1 the tests fail
  (tests/slow/test-ciphers.sh, no more information provided in the log),
  so this probably will take some additional investigation.

  This probably also implies adding a runtime-dep on libkcapi and needs
  kernel module af_alg loaded.

  I also saw #1072514 which I guess serves the same purpose from a
  different angle.

  Thanks for your consideration.
  ~Wesley

  [1] https://blogs.gnome.org/dueno/af_alg-support-in-gnutls/

To manage notifications about this bug go to:
https://bugs.launchpad.net/gnutls/+bug/2150143/+subscriptions