qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Daniel P. Berrange" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, qemu-block@nongnu.org
Subject: [Qemu-devel] [PATCH 0/5] Misc fixes and testing of qcow[2] encryption
Date: Tue, 12 May 2015 17:09:17 +0100	[thread overview]
Message-ID: <1431446962-9860-1-git-send-email-berrange@redhat.com> (raw)

I realize that qcow[2] encryption is a feature we have deprecated
and will remove support for running it with the QEMU system
emulators in this cycle. We do still need to make sure it continues
to work for the sake of letting people run qemu-img convert to
retrieve their data though.

Some of the other patches I'm working on which introduce a cypto
cipher API touch this qcow2 code, thus I wanted to be able to test
that it doesn't break anything.

I found that qemu-iotests didn't have any coverage of the qcow2
encryption code. For added fun, I then discovered that qemu-io
doesn't check if an encryption key is required, so ends up
writing plain text to the files instead of cipher, and returning
cipher text for reads, instead of plain text. IOW qemu-io will
corrupt encrypted qcow2 files on write.

This series adds some asserts that will protect against this kind
of mistake, adds support for getting passwords to qemu-io (in the
same manner that qemu-img supports), and finally adds a test case
for reading/writing encrypted qcow2.

Daniel P. Berrange (5):
  qcow2/qcow: protect against uninitialized encryption key
  util: move read_password method out of qemu-img into osdep/oslib
  util: allow \n to terminate password input
  qemu-io: prompt for encryption keys when required
  tests: add test case for encrypted qcow2 read/write

 block/qcow.c               | 10 +++--
 block/qcow2-cluster.c      |  3 +-
 block/qcow2.c              | 18 ++++++---
 include/qemu/osdep.h       |  2 +
 qemu-img.c                 | 93 +---------------------------------------------
 qemu-io.c                  | 21 +++++++++++
 tests/qemu-iotests/131     | 69 ++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/131.out | 46 +++++++++++++++++++++++
 tests/qemu-iotests/group   |  1 +
 util/oslib-posix.c         | 67 +++++++++++++++++++++++++++++++++
 util/oslib-win32.c         | 24 ++++++++++++
 11 files changed, 252 insertions(+), 102 deletions(-)
 create mode 100755 tests/qemu-iotests/131
 create mode 100644 tests/qemu-iotests/131.out

-- 
2.1.0

             reply	other threads:[~2015-05-12 16:09 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-05-12 16:09 Daniel P. Berrange [this message]
2015-05-12 16:09 ` [Qemu-devel] [PATCH 1/5] qcow2/qcow: protect against uninitialized encryption key Daniel P. Berrange
2015-05-12 18:06   ` Eric Blake
2015-05-12 16:09 ` [Qemu-devel] [PATCH 2/5] util: move read_password method out of qemu-img into osdep/oslib Daniel P. Berrange
2015-05-12 18:22   ` Eric Blake
2015-05-12 16:09 ` [Qemu-devel] [PATCH 3/5] util: allow \n to terminate password input Daniel P. Berrange
2015-05-12 18:23   ` Eric Blake
2015-05-12 16:09 ` [Qemu-devel] [PATCH 4/5] qemu-io: prompt for encryption keys when required Daniel P. Berrange
2015-05-12 18:32   ` Eric Blake
2015-05-13  8:09     ` Daniel P. Berrange
2015-05-13 10:50       ` Markus Armbruster
2015-05-12 16:09 ` [Qemu-devel] [PATCH 5/5] tests: add test case for encrypted qcow2 read/write Daniel P. Berrange
2015-05-12 18:35   ` Eric Blake
2015-05-12 19:06     ` [Qemu-devel] [Qemu-block] " John Snow
2015-05-12 19:52       ` Eric Blake
2015-05-12 19:54         ` John Snow
2015-05-18 15:38 ` [Qemu-devel] [PATCH 0/5] Misc fixes and testing of qcow[2] encryption Kevin Wolf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1431446962-9860-1-git-send-email-berrange@redhat.com \
    --to=berrange@redhat.com \
    --cc=kwolf@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).