Re: Qemu Dirty Bitmap backup to encrypted target

[John Snow <jsnow@redhat.com>]

On 9/30/19 3:26 PM, Craig Mull wrote:
> How can have QEMU backup write the output to an encrypted target?
>  
> Blocks in the dirty bitmap are unencrypted, and as such when I write
> them with QEMU backup they are written to the target unencrypted.
>  
> I've experimented with providing a json string as the target but with no
> luck.
>  
> 
> transaction='{ "execute": "transaction", 
> 
>   "arguments": { 
> 
>     "actions": [
> 
>       {"type": "block-dirty-bitmap-add", 
> 
>        "data": {"node": "drive-virtio-disk0", "granularity": 2097152,
> "name": "mybitmap"} },
> 
>       {"type": "drive-backup",
> 
>        "data": {"device": "drive-virtio-disk0", "target":
> "json:{\"encrypt.format\": \"luks\", \"encrypt.key-secret\":
> \"virtio-disk0-luks-secret0\", \"driver\": \"qcow2\", \"file\":
> {\"driver\": \"file\", \"filename\": \"/tmp/target-encrypt-test.qcow2\"}}",
> 
>                 "sync": "full", "format": "qcow2"} } 
> 
>     ] 
> 
>   } 
> 
> }'
> 
>  
> 
> virsh -c qemu:///system qemu-monitor-command --pretty 28 $transaction
> 
>  
> 
> {
> 
>   "id": "libvirt-45",
> 
>   "error": {
> 
>     "class": "GenericError",
> 
>     "desc": "Unknown protocol 'json'"
> 
>   }
> 
> }
> 
>

I'll be honest, I'm not very good at the json specifications and don't
really know when they're appropriate to use. At the basic level,
drive-backup expects a filename. Sometimes the filename can get fancy,
but... I stay away from that.

Try using qmp-blockdev-create to create the target node instead, and
then using blockdev-backup to backup to that target.

--js