From: Max Reitz <mreitz@redhat.com>
To: qemu-block@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>,
Maxim Levitsky <mlevitsk@redhat.com>,
qemu-devel@nongnu.org, Max Reitz <mreitz@redhat.com>
Subject: [PATCH 14/19] block/qcow2: extend qemu-img amend interface with crypto options
Date: Thu, 25 Jun 2020 14:55:43 +0200 [thread overview]
Message-ID: <20200625125548.870061-15-mreitz@redhat.com> (raw)
In-Reply-To: <20200625125548.870061-1-mreitz@redhat.com>
From: Maxim Levitsky <mlevitsk@redhat.com>
Now that we have all the infrastructure in place,
wire it in the qcow2 driver and expose this to the user.
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200608094030.670121-9-mlevitsk@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
block/qcow2.c | 71 +++++++++++++++++++++++++++++++++-----
tests/qemu-iotests/082.out | 45 ++++++++++++++++++++++++
2 files changed, 107 insertions(+), 9 deletions(-)
diff --git a/block/qcow2.c b/block/qcow2.c
index b3ed173a9b..0e72e8fc39 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -176,6 +176,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
return ret;
}
+static QDict*
+qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp)
+{
+ QDict *cryptoopts_qdict;
+ QDict *opts_qdict;
+
+ /* Extract "encrypt." options into a qdict */
+ opts_qdict = qemu_opts_to_qdict(opts, NULL);
+ qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
+ qobject_unref(opts_qdict);
+ qdict_put_str(cryptoopts_qdict, "format", fmt);
+ return cryptoopts_qdict;
+}
/*
* read qcow2 extension and fill bs
@@ -4849,16 +4862,9 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
if (has_luks) {
g_autoptr(QCryptoBlockCreateOptions) create_opts = NULL;
- QDict *opts_qdict;
- QDict *cryptoopts;
+ QDict *cryptoopts = qcow2_extract_crypto_opts(opts, "luks", errp);
size_t headerlen;
- opts_qdict = qemu_opts_to_qdict(opts, NULL);
- qdict_extract_subqdict(opts_qdict, &cryptoopts, "encrypt.");
- qobject_unref(opts_qdict);
-
- qdict_put_str(cryptoopts, "format", "luks");
-
create_opts = block_crypto_create_opts_init(cryptoopts, errp);
qobject_unref(cryptoopts);
if (!create_opts) {
@@ -5262,6 +5268,7 @@ typedef enum Qcow2AmendOperation {
QCOW2_NO_OPERATION = 0,
QCOW2_UPGRADING,
+ QCOW2_UPDATING_ENCRYPTION,
QCOW2_CHANGING_REFCOUNT_ORDER,
QCOW2_DOWNGRADING,
} Qcow2AmendOperation;
@@ -5343,6 +5350,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
int ret;
QemuOptDesc *desc = opts->list->desc;
Qcow2AmendHelperCBInfo helper_cb_info;
+ bool encryption_update = false;
while (desc && desc->name) {
if (!qemu_opt_find(opts, desc->name)) {
@@ -5369,6 +5377,18 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
} else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
+ } else if (g_str_has_prefix(desc->name, "encrypt.")) {
+ if (!s->crypto) {
+ error_setg(errp,
+ "Can't amend encryption options - encryption not present");
+ return -EINVAL;
+ }
+ if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
+ error_setg(errp,
+ "Only LUKS encryption options can be amended");
+ return -ENOTSUP;
+ }
+ encryption_update = true;
} else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
lazy_refcounts);
@@ -5411,7 +5431,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
.original_status_cb = status_cb,
.original_cb_opaque = cb_opaque,
.total_operations = (new_version != old_version)
- + (s->refcount_bits != refcount_bits)
+ + (s->refcount_bits != refcount_bits) +
+ (encryption_update == true)
};
/* Upgrade first (some features may require compat=1.1) */
@@ -5424,6 +5445,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
}
}
+ if (encryption_update) {
+ QDict *amend_opts_dict;
+ QCryptoBlockAmendOptions *amend_opts;
+
+ helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION;
+ amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp);
+ if (!amend_opts_dict) {
+ return -EINVAL;
+ }
+ amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp);
+ qobject_unref(amend_opts_dict);
+ if (!amend_opts) {
+ return -EINVAL;
+ }
+ ret = qcrypto_block_amend_options(s->crypto,
+ qcow2_crypto_hdr_read_func,
+ qcow2_crypto_hdr_write_func,
+ bs,
+ amend_opts,
+ force,
+ errp);
+ qapi_free_QCryptoBlockAmendOptions(amend_opts);
+ if (ret < 0) {
+ return ret;
+ }
+ }
+
if (s->refcount_bits != refcount_bits) {
int refcount_order = ctz32(refcount_bits);
@@ -5683,6 +5731,11 @@ static QemuOptsList qcow2_amend_opts = {
.name = "qcow2-amend-opts",
.head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head),
.desc = {
+ BLOCK_CRYPTO_OPT_DEF_LUKS_STATE("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
QCOW_COMMON_OPTIONS,
{ /* end of list */ }
}
diff --git a/tests/qemu-iotests/082.out b/tests/qemu-iotests/082.out
index b1cf5dfe43..a4a2b69030 100644
--- a/tests/qemu-iotests/082.out
+++ b/tests/qemu-iotests/082.out
@@ -645,6 +645,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -656,6 +661,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -667,6 +677,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -678,6 +693,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -689,6 +709,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -700,6 +725,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -711,6 +741,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -722,6 +757,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -750,6 +790,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
--
2.26.2
next prev parent reply other threads:[~2020-06-25 12:58 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-25 12:55 [PATCH 00/19] block: LUKS encryption slot management + iotest tweaks Max Reitz
2020-06-25 12:55 ` [PATCH 01/19] iotests: Make _filter_img_create more active Max Reitz
2020-06-28 15:12 ` Maxim Levitsky
2020-06-25 12:55 ` [PATCH 02/19] iotests: filter few more luks specific create options Max Reitz
2020-06-25 12:55 ` [PATCH 03/19] iotests/common.rc: Add _require_working_luks Max Reitz
2020-06-28 19:02 ` Maxim Levitsky
2020-06-25 12:55 ` [PATCH 04/19] iotests.py: Add qemu_img_pipe_and_status() Max Reitz
2020-06-29 8:45 ` Maxim Levitsky
2020-06-25 12:55 ` [PATCH 05/19] iotests.py: Add (verify|has)_working_luks() Max Reitz
2020-06-29 10:12 ` Maxim Levitsky
2020-06-30 8:52 ` Max Reitz
2020-06-25 12:55 ` [PATCH 06/19] iotests: Check whether luks works Max Reitz
2020-06-29 12:03 ` Maxim Levitsky
2020-06-30 8:53 ` Max Reitz
2020-06-25 12:55 ` [PATCH 07/19] qcrypto/core: add generic infrastructure for crypto options amendment Max Reitz
2020-06-25 12:55 ` [PATCH 08/19] qcrypto/luks: implement encryption key management Max Reitz
2020-06-25 12:55 ` [PATCH 09/19] block/amend: add 'force' option Max Reitz
2020-06-25 12:55 ` [PATCH 10/19] block/amend: separate amend and create options for qemu-img Max Reitz
2020-06-25 12:55 ` [PATCH 11/19] block/amend: refactor qcow2 amend options Max Reitz
2020-06-25 12:55 ` [PATCH 12/19] block/crypto: rename two functions Max Reitz
2020-06-25 12:55 ` [PATCH 13/19] block/crypto: implement the encryption key management Max Reitz
2020-06-25 12:55 ` Max Reitz [this message]
2020-06-25 12:55 ` [PATCH 15/19] iotests: qemu-img tests for luks " Max Reitz
2020-06-29 12:05 ` Maxim Levitsky
2020-06-30 8:56 ` Max Reitz
2020-06-30 9:23 ` Maxim Levitsky
2020-06-25 12:55 ` [PATCH 16/19] block/core: add generic infrastructure for x-blockdev-amend qmp command Max Reitz
2020-06-25 12:55 ` [PATCH 17/19] block/crypto: implement blockdev-amend Max Reitz
2020-06-25 12:55 ` [PATCH 18/19] block/qcow2: " Max Reitz
2020-06-25 12:55 ` [PATCH 19/19] iotests: add tests for blockdev-amend Max Reitz
2020-06-29 12:06 ` Maxim Levitsky
2020-06-25 13:22 ` [PATCH 00/19] block: LUKS encryption slot management + iotest tweaks no-reply
2020-07-03 11:57 ` Max Reitz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200625125548.870061-15-mreitz@redhat.com \
--to=mreitz@redhat.com \
--cc=kwolf@redhat.com \
--cc=mlevitsk@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).