[v2,08/14] block/qcow2: extend qemu-img amend interface with crypto options

Message ID	20200130172919.13424-9-mlevitsk@redhat.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=V9eS=3T=nongnu.org=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 52F1120707 From: Maxim Levitsky <mlevitsk@redhat.com> To: qemu-devel@nongnu.org Subject: [PATCH v2 08/14] block/qcow2: extend qemu-img amend interface with crypto options Date: Thu, 30 Jan 2020 19:29:13 +0200 Message-Id: <20200130172919.13424-9-mlevitsk@redhat.com> In-Reply-To: <20200130172919.13424-1-mlevitsk@redhat.com> References: <20200130172919.13424-1-mlevitsk@redhat.com> Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Precedence: list Cc: Kevin Wolf <kwolf@redhat.com>, =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= <berrange@redhat.com>, qemu-block@nongnu.org, John Snow <jsnow@redhat.com>, Markus Armbruster <armbru@redhat.com>, Max Reitz <mreitz@redhat.com>, Maxim Levitsky <mlevitsk@redhat.com> Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" <qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org>
Series	LUKS: encryption slot management using amend interface \| expand [v2,00/14] LUKS: encryption slot management using amend interface [v2,01/14] qcrypto/core: add generic infrastructure for crypto options amendment [v2,02/14] qcrypto/luks: implement encryption key management [v2,03/14] block/amend: add 'force' option [v2,04/14] block/amend: separate amend and create options for qemu-img [v2,05/14] block/amend: refactor qcow2 amend options [v2,06/14] block/crypto: rename two functions [v2,07/14] block/crypto: implement the encryption key management [v2,08/14] block/qcow2: extend qemu-img amend interface with crypto options [v2,09/14] iotests: filter few more luks specific create options [v2,10/14] iotests: qemu-img tests for luks key management [v2,11/14] block/core: add generic infrastructure for x-blockdev-amend qmp command [v2,12/14] block/crypto: implement blockdev-amend [v2,13/14] block/qcow2: implement blockdev-amend [v2,14/14] iotests: add tests for blockdev-amend

diff --git a/block/qcow2.c b/block/qcow2.c index b1a03a56a5..59c8a772cc 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -173,6 +173,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset, return ret; } +static QDict* +qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp) +{ + QDict *cryptoopts_qdict; + QDict *opts_qdict; + + /* Extract "encrypt." options into a qdict */ + opts_qdict = qemu_opts_to_qdict(opts, NULL); + qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); + qobject_unref(opts_qdict); + qdict_put_str(cryptoopts_qdict, "format", "luks"); + return cryptoopts_qdict; +} /* * read qcow2 extension and fill bs @@ -4620,20 +4633,18 @@ static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block, static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len, Error **errp) { - QDict *opts_qdict; - QDict *cryptoopts_qdict; QCryptoBlockCreateOptions *cryptoopts; + QDict *crypto_opts_dict; QCryptoBlock *crypto; - /* Extract "encrypt." options into a qdict */ - opts_qdict = qemu_opts_to_qdict(opts, NULL); - qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt."); - qobject_unref(opts_qdict); + crypto_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); + if (!crypto_opts_dict) { + return false; + } + + cryptoopts = block_crypto_create_opts_init(crypto_opts_dict, errp); + qobject_unref(crypto_opts_dict); - /* Build QCryptoBlockCreateOptions object from qdict */ - qdict_put_str(cryptoopts_qdict, "format", "luks"); - cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp); - qobject_unref(cryptoopts_qdict); if (!cryptoopts) { return false; } @@ -5072,6 +5083,7 @@ typedef enum Qcow2AmendOperation { QCOW2_NO_OPERATION = 0, QCOW2_UPGRADING, + QCOW2_UPDATING_ENCRYPTION, QCOW2_CHANGING_REFCOUNT_ORDER, QCOW2_DOWNGRADING, } Qcow2AmendOperation; @@ -5153,6 +5165,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, int ret; QemuOptDesc *desc = opts->list->desc; Qcow2AmendHelperCBInfo helper_cb_info; + bool encryption_update = false; while (desc && desc->name) { if (!qemu_opt_find(opts, desc->name)) { @@ -5179,6 +5192,18 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE); } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) { backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT); + } else if (g_str_has_prefix(desc->name, "encrypt.")) { + if (!s->crypto) { + error_setg(errp, + "Can't amend encryption options - encryption not present"); + return -EINVAL; + } + if (s->crypt_method_header != QCOW_CRYPT_LUKS) { + error_setg(errp, + "Only LUKS encryption options can be amended"); + return -ENOTSUP; + } + encryption_update = true; } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) { lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS, lazy_refcounts); @@ -5221,7 +5246,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, .original_status_cb = status_cb, .original_cb_opaque = cb_opaque, .total_operations = (new_version != old_version) - + (s->refcount_bits != refcount_bits) + + (s->refcount_bits != refcount_bits) + + (encryption_update == true) }; /* Upgrade first (some features may require compat=1.1) */ @@ -5234,6 +5260,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts, } } + if (encryption_update) { + QDict *amend_opts_dict; + QCryptoBlockAmendOptions *amend_opts; + + helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION; + amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp); + if (!amend_opts_dict) { + return -EINVAL; + } + amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp); + qobject_unref(amend_opts_dict); + if (!amend_opts) { + return -EINVAL; + } + ret = qcrypto_block_amend_options(s->crypto, + qcow2_crypto_hdr_read_func, + qcow2_crypto_hdr_write_func, + bs, + amend_opts, + force, + errp); + qapi_free_QCryptoBlockAmendOptions(amend_opts); + if (ret < 0) { + return ret; + } + } + if (s->refcount_bits != refcount_bits) { int refcount_order = ctz32(refcount_bits); @@ -5488,6 +5541,14 @@ static QemuOptsList qcow2_amend_opts = { .name = "qcow2-amend-opts", .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head), .desc = { + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.0."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.1."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.2."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.3."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.4."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.5."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.6."), + BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT_UPDATE("encrypt.keys.7."), QCOW_COMMON_OPTIONS, { /* end of list */ } } diff --git a/tests/qemu-iotests/082.out b/tests/qemu-iotests/082.out index c68458da8c..56461267e3 100644 --- a/tests/qemu-iotests/082.out +++ b/tests/qemu-iotests/082.out @@ -620,6 +620,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -631,6 +663,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -642,6 +706,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -653,6 +749,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -664,6 +792,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -675,6 +835,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -686,6 +878,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -697,6 +921,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size @@ -725,6 +981,38 @@ Amend options for 'qcow2': compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1]) data_file=<str> - File name of an external data file data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image + encrypt.keys.0.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.0.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.0.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.0.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.1.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.1.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.1.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.1.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.2.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.2.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.2.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.2.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.3.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.3.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.3.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.3.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.4.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.4.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.4.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.4.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.5.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.5.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.5.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.5.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.6.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.6.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.6.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.6.old-secret=<str> - Select all keyslots that match this password + encrypt.keys.7.iter-time=<num> - Time to spend in PBKDF in milliseconds + encrypt.keys.7.keyslot=<num> - Select a single keyslot to modify explicitly + encrypt.keys.7.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase + encrypt.keys.7.old-secret=<str> - Select all keyslots that match this password lazy_refcounts=<bool (on/off)> - Postpone refcount updates refcount_bits=<num> - Width of a reference count entry in bits size=<size> - Virtual disk size

[v2,08/14] block/qcow2: extend qemu-img amend interface with crypto options

Commit Message

Patch