From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36615) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVOhB-0007AT-8n for qemu-devel@nongnu.org; Tue, 10 Mar 2015 14:16:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YVOh7-0008QV-Gl for qemu-devel@nongnu.org; Tue, 10 Mar 2015 14:15:57 -0400 Date: Tue, 10 Mar 2015 18:15:46 +0000 From: "Daniel P. Berrange" Message-ID: <20150310181546.GH14255@redhat.com> References: <1426008400-22016-1-git-send-email-armbru@redhat.com> <1426008400-22016-2-git-send-email-armbru@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1426008400-22016-2-git-send-email-armbru@redhat.com> Subject: Re: [Qemu-devel] [PATCH RFC 1/2] block: Limit opening of encrypted images to qemu-img Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Markus Armbruster Cc: kwolf@redhat.com, qemu-block@nongnu.org, qemu-devel@nongnu.org, stefanha@redhat.com, kraxel@redhat.com On Tue, Mar 10, 2015 at 06:26:39PM +0100, Markus Armbruster wrote: > Signed-off-by: Markus Armbruster > --- > block/qcow.c | 5 +++++ > block/qcow2.c | 5 +++++ > include/block/block.h | 3 +-- > qemu-img.c | 1 + > 4 files changed, 12 insertions(+), 2 deletions(-) > > diff --git a/block/qcow.c b/block/qcow.c > index 0558969..f54fc86 100644 > --- a/block/qcow.c > +++ b/block/qcow.c > @@ -155,6 +155,11 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, > } > s->crypt_method_header = header.crypt_method; > if (s->crypt_method_header) { > + if (!(flags & BDRV_O_CRYPT_OK)) { > + error_setg(errp, "image is encrypted, use qemu-img to decrypt it"); > + ret = -EINVAL; > + goto fail; > + } > bs->encrypted = 1; > } > s->cluster_bits = header.cluster_bits; > diff --git a/block/qcow2.c b/block/qcow2.c > index 50e0a94..b12c67a 100644 > --- a/block/qcow2.c > +++ b/block/qcow2.c > @@ -693,6 +693,11 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, > } > s->crypt_method_header = header.crypt_method; > if (s->crypt_method_header) { > + if (!(flags & BDRV_O_CRYPT_OK)) { > + error_setg(errp, "image is encrypted, use qemu-img to decrypt it"); > + ret = -EINVAL; > + goto fail; > + } > bs->encrypted = 1; > } > > diff --git a/include/block/block.h b/include/block/block.h > index 649c269..76b6d3c 100644 > --- a/include/block/block.h > +++ b/include/block/block.h > @@ -76,6 +76,7 @@ typedef enum { > #define BDRV_O_PROTOCOL 0x8000 /* if no block driver is explicitly given: > select an appropriate protocol driver, > ignoring the format layer */ > +#define BDRV_O_CRYPT_OK 0x10000 /* open even when image is encrypted */ > > #define BDRV_O_CACHE_MASK (BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH) > > @@ -382,8 +383,6 @@ BlockDriverState *bdrv_next(BlockDriverState *bs); > int bdrv_is_encrypted(BlockDriverState *bs); > int bdrv_key_required(BlockDriverState *bs); > int bdrv_set_key(BlockDriverState *bs, const char *key); > -void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp); Nitpick, this method isn't deleted until your next patch, so this belongs there. > -int bdrv_query_missing_keys(void); Fun, a method which doesn't even exist :-) > void bdrv_iterate_format(void (*it)(void *opaque, const char *name), > void *opaque); > const char *bdrv_get_node_name(const BlockDriverState *bs); > diff --git a/qemu-img.c b/qemu-img.c > index 7ac7f56..bcd7d3f 100644 > --- a/qemu-img.c > +++ b/qemu-img.c > @@ -302,6 +302,7 @@ static BlockBackend *img_open(const char *id, const char *filename, > qdict_put(options, "driver", qstring_from_str(fmt)); > } > > + flags |= BDRV_O_CRYPT_OK; > blk = blk_new_open(id, filename, NULL, options, flags, &local_err); > if (!blk) { > error_report("Could not open '%s': %s", filename, Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|