Message ID | 20200114193350.10830-8-mlevitsk@redhat.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | LUKS: encryption slot management using amend interface | expand |
On Tue, Jan 14, 2020 at 09:33:44PM +0200, Maxim Levitsky wrote: > Now that we have all the infrastructure in place, > wire it in the qcow2 driver and expose this to the user. > > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> > --- > block/qcow2.c | 101 +++++++++++++++++++++++++++++++++++++++----------- > 1 file changed, 79 insertions(+), 22 deletions(-) > > diff --git a/block/qcow2.c b/block/qcow2.c > index c6c2deee75..1b01174aed 100644 > --- a/block/qcow2.c > +++ b/block/qcow2.c > @@ -173,6 +173,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset, > return ret; > } > > +static QDict* > +qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp) > +{ > + QDict *cryptoopts_qdict; > + QDict *opts_qdict; > + > + /* Extract "encrypt." options into a qdict */ > + opts_qdict = qemu_opts_to_qdict(opts, NULL); > + qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); > + qobject_unref(opts_qdict); > + qdict_put_str(cryptoopts_qdict, "format", "luks"); > + return cryptoopts_qdict; > +} > > /* > * read qcow2 extension and fill bs > @@ -4631,20 +4644,18 @@ static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block, > static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len, > Error **errp) > { > - QDict *opts_qdict; > - QDict *cryptoopts_qdict; > QCryptoBlockCreateOptions *cryptoopts; > + QDict* crypto_opts_dict; > QCryptoBlock *crypto; > > - /* Extract "encrypt." options into a qdict */ > - opts_qdict = qemu_opts_to_qdict(opts, NULL); > - qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); > - qobject_unref(opts_qdict); > + crypto_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); > + if (!crypto_opts_dict) { > + return false; > + } > + > + cryptoopts = block_crypto_create_opts_init(crypto_opts_dict, errp); > + qobject_unref(crypto_opts_dict); > > - /* Build QCryptoBlockCreateOptions object from qdict */ > - qdict_put_str(cryptoopts_qdict, "format", "luks"); > - cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp); > - qobject_unref(cryptoopts_qdict); > if (!cryptoopts) { > return false; > } > @@ -5083,6 +5094,7 @@ typedef enum Qcow2AmendOperation { > QCOW2_NO_OPERATION = 0, > > QCOW2_UPGRADING, > + QCOW2_UPDATING_ENCRYPTION, > QCOW2_CHANGING_REFCOUNT_ORDER, > QCOW2_DOWNGRADING, > } Qcow2AmendOperation; > @@ -5167,6 +5179,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > int ret; > QemuOptDesc *desc = opts->list->desc; > Qcow2AmendHelperCBInfo helper_cb_info; > + bool encryption_update = false; > > while (desc && desc->name) { > if (!qemu_opt_find(opts, desc->name)) { > @@ -5215,9 +5228,17 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > return -ENOTSUP; > } > } else if (g_str_has_prefix(desc->name, "encrypt.")) { > - error_setg(errp, > - "Changing the encryption parameters is not supported"); > - return -ENOTSUP; > + if (!s->crypto) { > + error_setg(errp, > + "Can't amend encryption options - encryption not present"); > + return -EINVAL; > + } > + if (s->crypt_method_header != QCOW_CRYPT_LUKS) { > + error_setg(errp, > + "Only LUKS encryption options can be amended"); > + return -ENOTSUP; > + } > + encryption_update = true; > } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) { > cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, > cluster_size); > @@ -5267,7 +5288,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > .original_status_cb = status_cb, > .original_cb_opaque = cb_opaque, > .total_operations = (new_version != old_version) > - + (s->refcount_bits != refcount_bits) > + + (s->refcount_bits != refcount_bits) + > + (encryption_update == true) > }; > > /* Upgrade first (some features may require compat=1.1) */ > @@ -5280,6 +5302,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > } > } > > + if (encryption_update) { > + QDict *amend_opts_dict; > + QCryptoBlockAmendOptions *amend_opts; > + > + helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION; > + amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); > + if (!amend_opts_dict) { > + return -EINVAL; > + } > + amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp); > + qobject_unref(amend_opts_dict); > + if (!amend_opts) { > + return -EINVAL; > + } > + ret = qcrypto_block_amend_options(s->crypto, > + qcow2_crypto_hdr_read_func, > + qcow2_crypto_hdr_write_func, > + bs, > + amend_opts, > + force, > + errp); > + qapi_free_QCryptoBlockAmendOptions(amend_opts); > + if (ret < 0) { > + return ret; > + } > + } > + > if (s->refcount_bits != refcount_bits) { > int refcount_order = ctz32(refcount_bits); > > @@ -5488,14 +5537,6 @@ void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset, > .type = QEMU_OPT_STRING, \ > .help = "Encrypt the image, format choices: 'aes', 'luks'", \ > }, \ > - BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", \ > - "ID of secret providing qcow AES key or LUKS passphrase"), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), \ > - BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), \ > { \ > .name = BLOCK_OPT_CLUSTER_SIZE, \ > .type = QEMU_OPT_SIZE, \ > @@ -5526,6 +5567,14 @@ static QemuOptsList qcow2_create_opts = { > .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head), > .desc = { > QCOW_COMMON_OPTIONS, > + BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", > + "ID of secret providing qcow AES key or LUKS passphrase"), > + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), > { /* end of list */ } > } These two chunks should habe been in the earlier patch IMHO. > }; > @@ -5535,6 +5584,14 @@ static QemuOptsList qcow2_amend_opts = { > .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head), > .desc = { > QCOW_COMMON_OPTIONS, > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.0."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.1."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.2."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.3."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.4."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.5."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.6."), > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.7."), > { /* end of list */ } Same naming idea about "encrypt.key.0" or "encrypt.keyslot.0" > } > }; > -- > 2.17.2 > Regards, Daniel
On Tue, 2020-01-28 at 17:30 +0000, Daniel P. Berrangé wrote: > On Tue, Jan 14, 2020 at 09:33:44PM +0200, Maxim Levitsky wrote: > > Now that we have all the infrastructure in place, > > wire it in the qcow2 driver and expose this to the user. > > > > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> > > --- > > block/qcow2.c | 101 +++++++++++++++++++++++++++++++++++++++----------- > > 1 file changed, 79 insertions(+), 22 deletions(-) > > > > diff --git a/block/qcow2.c b/block/qcow2.c > > index c6c2deee75..1b01174aed 100644 > > --- a/block/qcow2.c > > +++ b/block/qcow2.c > > @@ -173,6 +173,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset, > > return ret; > > } > > > > +static QDict* > > +qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp) > > +{ > > + QDict *cryptoopts_qdict; > > + QDict *opts_qdict; > > + > > + /* Extract "encrypt." options into a qdict */ > > + opts_qdict = qemu_opts_to_qdict(opts, NULL); > > + qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); > > + qobject_unref(opts_qdict); > > + qdict_put_str(cryptoopts_qdict, "format", "luks"); > > + return cryptoopts_qdict; > > +} > > > > /* > > * read qcow2 extension and fill bs > > @@ -4631,20 +4644,18 @@ static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block, > > static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len, > > Error **errp) > > { > > - QDict *opts_qdict; > > - QDict *cryptoopts_qdict; > > QCryptoBlockCreateOptions *cryptoopts; > > + QDict* crypto_opts_dict; > > QCryptoBlock *crypto; > > > > - /* Extract "encrypt." options into a qdict */ > > - opts_qdict = qemu_opts_to_qdict(opts, NULL); > > - qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); > > - qobject_unref(opts_qdict); > > + crypto_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); > > + if (!crypto_opts_dict) { > > + return false; > > + } > > + > > + cryptoopts = block_crypto_create_opts_init(crypto_opts_dict, errp); > > + qobject_unref(crypto_opts_dict); > > > > - /* Build QCryptoBlockCreateOptions object from qdict */ > > - qdict_put_str(cryptoopts_qdict, "format", "luks"); > > - cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp); > > - qobject_unref(cryptoopts_qdict); > > if (!cryptoopts) { > > return false; > > } > > @@ -5083,6 +5094,7 @@ typedef enum Qcow2AmendOperation { > > QCOW2_NO_OPERATION = 0, > > > > QCOW2_UPGRADING, > > + QCOW2_UPDATING_ENCRYPTION, > > QCOW2_CHANGING_REFCOUNT_ORDER, > > QCOW2_DOWNGRADING, > > } Qcow2AmendOperation; > > @@ -5167,6 +5179,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > > int ret; > > QemuOptDesc *desc = opts->list->desc; > > Qcow2AmendHelperCBInfo helper_cb_info; > > + bool encryption_update = false; > > > > while (desc && desc->name) { > > if (!qemu_opt_find(opts, desc->name)) { > > @@ -5215,9 +5228,17 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > > return -ENOTSUP; > > } > > } else if (g_str_has_prefix(desc->name, "encrypt.")) { > > - error_setg(errp, > > - "Changing the encryption parameters is not supported"); > > - return -ENOTSUP; > > + if (!s->crypto) { > > + error_setg(errp, > > + "Can't amend encryption options - encryption not present"); > > + return -EINVAL; > > + } > > + if (s->crypt_method_header != QCOW_CRYPT_LUKS) { > > + error_setg(errp, > > + "Only LUKS encryption options can be amended"); > > + return -ENOTSUP; > > + } > > + encryption_update = true; > > } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) { > > cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, > > cluster_size); > > @@ -5267,7 +5288,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > > .original_status_cb = status_cb, > > .original_cb_opaque = cb_opaque, > > .total_operations = (new_version != old_version) > > - + (s->refcount_bits != refcount_bits) > > + + (s->refcount_bits != refcount_bits) + > > + (encryption_update == true) > > }; > > > > /* Upgrade first (some features may require compat=1.1) */ > > @@ -5280,6 +5302,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, > > } > > } > > > > + if (encryption_update) { > > + QDict *amend_opts_dict; > > + QCryptoBlockAmendOptions *amend_opts; > > + > > + helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION; > > + amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); > > + if (!amend_opts_dict) { > > + return -EINVAL; > > + } > > + amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp); > > + qobject_unref(amend_opts_dict); > > + if (!amend_opts) { > > + return -EINVAL; > > + } > > + ret = qcrypto_block_amend_options(s->crypto, > > + qcow2_crypto_hdr_read_func, > > + qcow2_crypto_hdr_write_func, > > + bs, > > + amend_opts, > > + force, > > + errp); > > + qapi_free_QCryptoBlockAmendOptions(amend_opts); > > + if (ret < 0) { > > + return ret; > > + } > > + } > > + > > if (s->refcount_bits != refcount_bits) { > > int refcount_order = ctz32(refcount_bits); > > > > @@ -5488,14 +5537,6 @@ void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset, > > .type = QEMU_OPT_STRING, \ > > .help = "Encrypt the image, format choices: 'aes', 'luks'", \ > > }, \ > > - BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", \ > > - "ID of secret providing qcow AES key or LUKS passphrase"), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), \ > > - BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), \ > > { \ > > .name = BLOCK_OPT_CLUSTER_SIZE, \ > > .type = QEMU_OPT_SIZE, \ > > @@ -5526,6 +5567,14 @@ static QemuOptsList qcow2_create_opts = { > > .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head), > > .desc = { > > QCOW_COMMON_OPTIONS, > > + BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", > > + "ID of secret providing qcow AES key or LUKS passphrase"), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), > > { /* end of list */ } > > } > > These two chunks should habe been in the earlier patch IMHO. Yep, these are gone from this patch in the next version I'll post soon. > > > }; > > @@ -5535,6 +5584,14 @@ static QemuOptsList qcow2_amend_opts = { > > .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head), > > .desc = { > > QCOW_COMMON_OPTIONS, > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.0."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.1."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.2."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.3."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.4."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.5."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.6."), > > + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.7."), > > { /* end of list */ } > > Same naming idea about "encrypt.key.0" or "encrypt.keyslot.0" Yep, same applies as I said in comment in the other patch. > > > } > > }; > > -- > > 2.17.2 > > > > Regards, > Daniel Thanks for the review, Best regards, Maxim Levitsky
diff --git a/block/qcow2.c b/block/qcow2.c index c6c2deee75..1b01174aed 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -173,6 +173,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset, return ret; } +static QDict* +qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp) +{ + QDict *cryptoopts_qdict; + QDict *opts_qdict; + + /* Extract "encrypt." options into a qdict */ + opts_qdict = qemu_opts_to_qdict(opts, NULL); + qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); + qobject_unref(opts_qdict); + qdict_put_str(cryptoopts_qdict, "format", "luks"); + return cryptoopts_qdict; +} /* * read qcow2 extension and fill bs @@ -4631,20 +4644,18 @@ static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block, static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len, Error **errp) { - QDict *opts_qdict; - QDict *cryptoopts_qdict; QCryptoBlockCreateOptions *cryptoopts; + QDict* crypto_opts_dict; QCryptoBlock *crypto; - /* Extract "encrypt." options into a qdict */ - opts_qdict = qemu_opts_to_qdict(opts, NULL); - qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); - qobject_unref(opts_qdict); + crypto_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); + if (!crypto_opts_dict) { + return false; + } + + cryptoopts = block_crypto_create_opts_init(crypto_opts_dict, errp); + qobject_unref(crypto_opts_dict); - /* Build QCryptoBlockCreateOptions object from qdict */ - qdict_put_str(cryptoopts_qdict, "format", "luks"); - cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp); - qobject_unref(cryptoopts_qdict); if (!cryptoopts) { return false; } @@ -5083,6 +5094,7 @@ typedef enum Qcow2AmendOperation { QCOW2_NO_OPERATION = 0, QCOW2_UPGRADING, + QCOW2_UPDATING_ENCRYPTION, QCOW2_CHANGING_REFCOUNT_ORDER, QCOW2_DOWNGRADING, } Qcow2AmendOperation; @@ -5167,6 +5179,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, int ret; QemuOptDesc *desc = opts->list->desc; Qcow2AmendHelperCBInfo helper_cb_info; + bool encryption_update = false; while (desc && desc->name) { if (!qemu_opt_find(opts, desc->name)) { @@ -5215,9 +5228,17 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, return -ENOTSUP; } } else if (g_str_has_prefix(desc->name, "encrypt.")) { - error_setg(errp, - "Changing the encryption parameters is not supported"); - return -ENOTSUP; + if (!s->crypto) { + error_setg(errp, + "Can't amend encryption options - encryption not present"); + return -EINVAL; + } + if (s->crypt_method_header != QCOW_CRYPT_LUKS) { + error_setg(errp, + "Only LUKS encryption options can be amended"); + return -ENOTSUP; + } + encryption_update = true; } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) { cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, cluster_size); @@ -5267,7 +5288,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, .original_status_cb = status_cb, .original_cb_opaque = cb_opaque, .total_operations = (new_version != old_version) - + (s->refcount_bits != refcount_bits) + + (s->refcount_bits != refcount_bits) + + (encryption_update == true) }; /* Upgrade first (some features may require compat=1.1) */ @@ -5280,6 +5302,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, } } + if (encryption_update) { + QDict *amend_opts_dict; + QCryptoBlockAmendOptions *amend_opts; + + helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION; + amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); + if (!amend_opts_dict) { + return -EINVAL; + } + amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp); + qobject_unref(amend_opts_dict); + if (!amend_opts) { + return -EINVAL; + } + ret = qcrypto_block_amend_options(s->crypto, + qcow2_crypto_hdr_read_func, + qcow2_crypto_hdr_write_func, + bs, + amend_opts, + force, + errp); + qapi_free_QCryptoBlockAmendOptions(amend_opts); + if (ret < 0) { + return ret; + } + } + if (s->refcount_bits != refcount_bits) { int refcount_order = ctz32(refcount_bits); @@ -5488,14 +5537,6 @@ void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset, .type = QEMU_OPT_STRING, \ .help = "Encrypt the image, format choices: 'aes', 'luks'", \ }, \ - BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", \ - "ID of secret providing qcow AES key or LUKS passphrase"), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), \ - BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), \ { \ .name = BLOCK_OPT_CLUSTER_SIZE, \ .type = QEMU_OPT_SIZE, \ @@ -5526,6 +5567,14 @@ static QemuOptsList qcow2_create_opts = { .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head), .desc = { QCOW_COMMON_OPTIONS, + BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.", + "ID of secret providing qcow AES key or LUKS passphrase"), + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."), + BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."), + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."), + BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."), + BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."), + BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."), { /* end of list */ } } }; @@ -5535,6 +5584,14 @@ static QemuOptsList qcow2_amend_opts = { .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head), .desc = { QCOW_COMMON_OPTIONS, + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.0."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.1."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.2."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.3."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.4."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.5."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.6."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.7."), { /* end of list */ } } };
Now that we have all the infrastructure in place, wire it in the qcow2 driver and expose this to the user. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> --- block/qcow2.c | 101 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 79 insertions(+), 22 deletions(-)