Re: Qemu Dirty Bitmap backup to encrypted target

[Kevin Wolf <kwolf@redhat.com>]

Am 01.10.2019 um 02:24 hat John Snow geschrieben:
> 
> 
> On 9/30/19 3:26 PM, Craig Mull wrote:
> > How can have QEMU backup write the output to an encrypted target?
> >  
> > Blocks in the dirty bitmap are unencrypted, and as such when I write
> > them with QEMU backup they are written to the target unencrypted.
> >  
> > I've experimented with providing a json string as the target but with no
> > luck.
> >  
> > 
> > transaction='{ "execute": "transaction", 
> > 
> >   "arguments": { 
> > 
> >     "actions": [
> > 
> >       {"type": "block-dirty-bitmap-add", 
> > 
> >        "data": {"node": "drive-virtio-disk0", "granularity": 2097152,
> > "name": "mybitmap"} },
> > 
> >       {"type": "drive-backup",
> > 
> >        "data": {"device": "drive-virtio-disk0", "target":
> > "json:{\"encrypt.format\": \"luks\", \"encrypt.key-secret\":
> > \"virtio-disk0-luks-secret0\", \"driver\": \"qcow2\", \"file\":
> > {\"driver\": \"file\", \"filename\": \"/tmp/target-encrypt-test.qcow2\"}}",
> > 
> >                 "sync": "full", "format": "qcow2"} } 
> > 
> >     ] 
> > 
> >   } 
> > 
> > }'
> > 
> >  
> > 
> > virsh -c qemu:///system qemu-monitor-command --pretty 28 $transaction
> > 
> >  
> > 
> > {
> > 
> >   "id": "libvirt-45",
> > 
> >   "error": {
> > 
> >     "class": "GenericError",
> > 
> >     "desc": "Unknown protocol 'json'"
> > 
> >   }
> > 
> > }
> > 
> >
> 
> I'll be honest, I'm not very good at the json specifications and don't
> really know when they're appropriate to use. At the basic level,
> drive-backup expects a filename. Sometimes the filename can get fancy,
> but... I stay away from that.
> 
> Try using qmp-blockdev-create to create the target node instead, and
> then using blockdev-backup to backup to that target.

As the actual invocation is a virsh command, I think this is more of a
libvirt question than a QEMU one.

I suspect that libvirt won't support this without -blockdev support
(which will enable blockdev-backup instead of drive-backup), but even
then libvirt might not even offer an API for an encrypted target. Not
sure, though, so CCing Peter.

Kevin