@@ -176,6 +176,19 @@ static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
return ret;
}
+static QDict*
+qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp)
+{
+ QDict *cryptoopts_qdict;
+ QDict *opts_qdict;
+
+ /* Extract "encrypt." options into a qdict */
+ opts_qdict = qemu_opts_to_qdict(opts, NULL);
+ qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
+ qobject_unref(opts_qdict);
+ qdict_put_str(cryptoopts_qdict, "format", "luks");
+ return cryptoopts_qdict;
+}
/*
* read qcow2 extension and fill bs
@@ -4615,20 +4628,18 @@ static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
Error **errp)
{
- QDict *opts_qdict;
- QDict *cryptoopts_qdict;
QCryptoBlockCreateOptions *cryptoopts;
+ QDict *crypto_opts_dict;
QCryptoBlock *crypto;
- /* Extract "encrypt." options into a qdict */
- opts_qdict = qemu_opts_to_qdict(opts, NULL);
- qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
- qobject_unref(opts_qdict);
+ crypto_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp);
+ if (!crypto_opts_dict) {
+ return false;
+ }
+
+ cryptoopts = block_crypto_create_opts_init(crypto_opts_dict, errp);
+ qobject_unref(crypto_opts_dict);
- /* Build QCryptoBlockCreateOptions object from qdict */
- qdict_put_str(cryptoopts_qdict, "format", "luks");
- cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
- qobject_unref(cryptoopts_qdict);
if (!cryptoopts) {
return false;
}
@@ -5067,6 +5078,7 @@ typedef enum Qcow2AmendOperation {
QCOW2_NO_OPERATION = 0,
QCOW2_UPGRADING,
+ QCOW2_UPDATING_ENCRYPTION,
QCOW2_CHANGING_REFCOUNT_ORDER,
QCOW2_DOWNGRADING,
} Qcow2AmendOperation;
@@ -5148,6 +5160,7 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
int ret;
QemuOptDesc *desc = opts->list->desc;
Qcow2AmendHelperCBInfo helper_cb_info;
+ bool encryption_update = false;
while (desc && desc->name) {
if (!qemu_opt_find(opts, desc->name)) {
@@ -5174,6 +5187,18 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
} else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
+ } else if (g_str_has_prefix(desc->name, "encrypt.")) {
+ if (!s->crypto) {
+ error_setg(errp,
+ "Can't amend encryption options - encryption not present");
+ return -EINVAL;
+ }
+ if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
+ error_setg(errp,
+ "Only LUKS encryption options can be amended");
+ return -ENOTSUP;
+ }
+ encryption_update = true;
} else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
lazy_refcounts);
@@ -5216,7 +5241,8 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
.original_status_cb = status_cb,
.original_cb_opaque = cb_opaque,
.total_operations = (new_version != old_version)
- + (s->refcount_bits != refcount_bits)
+ + (s->refcount_bits != refcount_bits) +
+ (encryption_update == true)
};
/* Upgrade first (some features may require compat=1.1) */
@@ -5229,6 +5255,33 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
}
}
+ if (encryption_update) {
+ QDict *amend_opts_dict;
+ QCryptoBlockAmendOptions *amend_opts;
+
+ helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION;
+ amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp);
+ if (!amend_opts_dict) {
+ return -EINVAL;
+ }
+ amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp);
+ qobject_unref(amend_opts_dict);
+ if (!amend_opts) {
+ return -EINVAL;
+ }
+ ret = qcrypto_block_amend_options(s->crypto,
+ qcow2_crypto_hdr_read_func,
+ qcow2_crypto_hdr_write_func,
+ bs,
+ amend_opts,
+ force,
+ errp);
+ qapi_free_QCryptoBlockAmendOptions(amend_opts);
+ if (ret < 0) {
+ return ret;
+ }
+ }
+
if (s->refcount_bits != refcount_bits) {
int refcount_order = ctz32(refcount_bits);
@@ -5483,6 +5536,11 @@ static QemuOptsList qcow2_amend_opts = {
.name = "qcow2-amend-opts",
.head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head),
.desc = {
+ BLOCK_CRYPTO_OPT_DEF_LUKS_STATE("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET("encrypt."),
+ BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
QCOW_COMMON_OPTIONS,
{ /* end of list */ }
}
@@ -620,6 +620,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -631,6 +636,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -642,6 +652,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -653,6 +668,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -664,6 +684,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -675,6 +700,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -686,6 +716,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -697,6 +732,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
@@ -725,6 +765,11 @@ Amend options for 'qcow2':
compat=<str> - Compatibility level (v2 [0.10] or v3 [1.1])
data_file=<str> - File name of an external data file
data_file_raw=<bool (on/off)> - The external data file must stay valid as a raw image
+ encrypt.iter-time=<num> - Time to spend in PBKDF in milliseconds
+ encrypt.keyslot=<num> - Select a single keyslot to modify explicitly
+ encrypt.new-secret=<str> - New secret to set in the matching keyslots. Empty string to erase
+ encrypt.old-secret=<str> - Select all keyslots that match this password
+ encrypt.state=<str> - Select new state of affected keyslots (active/inactive)
lazy_refcounts=<bool (on/off)> - Postpone refcount updates
refcount_bits=<num> - Width of a reference count entry in bits
size=<size> - Virtual disk size
Now that we have all the infrastructure in place, wire it in the qcow2 driver and expose this to the user. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> --- block/qcow2.c | 80 ++++++++++++++++++++++++++++++++------ tests/qemu-iotests/082.out | 45 +++++++++++++++++++++ 2 files changed, 114 insertions(+), 11 deletions(-)