[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 19/85] qcow2: report encryption specific image inform
From: |
Max Reitz |
Subject: |
[Qemu-devel] [PULL 19/85] qcow2: report encryption specific image information |
Date: |
Tue, 11 Jul 2017 18:07:08 +0200 |
From: "Daniel P. Berrange" <address@hidden>
Currently 'qemu-img info' reports a simple "encrypted: yes"
field. This is not very useful now that qcow2 can support
multiple encryption formats. Users want to know which format
is in use and some data related to it.
Wire up usage of the qcrypto_block_get_info() method so that
'qemu-img info' can report about the encryption format
and parameters in use
$ qemu-img create \
--object secret,id=sec0,data=123456 \
-o encrypt.format=luks,encrypt.key-secret=sec0 \
-f qcow2 demo.qcow2 1G
Formatting 'demo.qcow2', fmt=qcow2 size=1073741824 \
encryption=off encrypt.format=luks encrypt.key-secret=sec0 \
cluster_size=65536 lazy_refcounts=off refcount_bits=16
$ qemu-img info demo.qcow2
image: demo.qcow2
file format: qcow2
virtual size: 1.0G (1073741824 bytes)
disk size: 480K
encrypted: yes
cluster_size: 65536
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
encrypt:
ivgen alg: plain64
hash alg: sha256
cipher alg: aes-256
uuid: 3fa930c4-58c8-4ef7-b3c5-314bb5af21f3
format: luks
cipher mode: xts
slots:
[0]:
active: true
iters: 1839058
key offset: 4096
stripes: 4000
[1]:
active: false
key offset: 262144
[2]:
active: false
key offset: 520192
[3]:
active: false
key offset: 778240
[4]:
active: false
key offset: 1036288
[5]:
active: false
key offset: 1294336
[6]:
active: false
key offset: 1552384
[7]:
active: false
key offset: 1810432
payload offset: 2068480
master key iters: 438487
corrupt: false
With the legacy "AES" encryption we just report the format
name
$ qemu-img create \
--object secret,id=sec0,data=123456 \
-o encrypt.format=aes,encrypt.key-secret=sec0 \
-f qcow2 demo.qcow2 1G
Formatting 'demo.qcow2', fmt=qcow2 size=1073741824 \
encryption=off encrypt.format=aes encrypt.key-secret=sec0 \
cluster_size=65536 lazy_refcounts=off refcount_bits=16
$ ./qemu-img info demo.qcow2
image: demo.qcow2
file format: qcow2
virtual size: 1.0G (1073741824 bytes)
disk size: 196K
encrypted: yes
cluster_size: 65536
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
encrypt:
format: aes
corrupt: false
Reviewed-by: Alberto Garcia <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Max Reitz <address@hidden>
---
qapi/block-core.json | 27 ++++++++++++++++++++++++++-
block/qcow2.c | 32 +++++++++++++++++++++++++++++++-
2 files changed, 57 insertions(+), 2 deletions(-)
diff --git a/qapi/block-core.json b/qapi/block-core.json
index d04d277..9570963 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -33,6 +33,27 @@
'vm-clock-sec': 'int', 'vm-clock-nsec': 'int' } }
##
+# @ImageInfoSpecificQCow2EncryptionBase:
+#
+# @format: The encryption format
+#
+# Since: 2.10
+##
+{ 'struct': 'ImageInfoSpecificQCow2EncryptionBase',
+ 'data': { 'format': 'BlockdevQcow2EncryptionFormat'}}
+
+##
+# @ImageInfoSpecificQCow2Encryption:
+#
+# Since: 2.10
+##
+{ 'union': 'ImageInfoSpecificQCow2Encryption',
+ 'base': 'ImageInfoSpecificQCow2EncryptionBase',
+ 'discriminator': 'format',
+ 'data': { 'aes': 'QCryptoBlockInfoQCow',
+ 'luks': 'QCryptoBlockInfoLUKS' } }
+
+##
# @ImageInfoSpecificQCow2:
#
# @compat: compatibility level
@@ -44,6 +65,9 @@
#
# @refcount-bits: width of a refcount entry in bits (since 2.3)
#
+# @encrypt: details about encryption parameters; only set if image
+# is encrypted (since 2.10)
+#
# Since: 1.7
##
{ 'struct': 'ImageInfoSpecificQCow2',
@@ -51,7 +75,8 @@
'compat': 'str',
'*lazy-refcounts': 'bool',
'*corrupt': 'bool',
- 'refcount-bits': 'int'
+ 'refcount-bits': 'int',
+ '*encrypt': 'ImageInfoSpecificQCow2Encryption'
} }
##
diff --git a/block/qcow2.c b/block/qcow2.c
index f597fd0..5339aa0 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -3241,8 +3241,14 @@ static int qcow2_get_info(BlockDriverState *bs,
BlockDriverInfo *bdi)
static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs)
{
BDRVQcow2State *s = bs->opaque;
- ImageInfoSpecific *spec_info = g_new(ImageInfoSpecific, 1);
+ ImageInfoSpecific *spec_info;
+ QCryptoBlockInfo *encrypt_info = NULL;
+ if (s->crypto != NULL) {
+ encrypt_info = qcrypto_block_get_info(s->crypto, &error_abort);
+ }
+
+ spec_info = g_new(ImageInfoSpecific, 1);
*spec_info = (ImageInfoSpecific){
.type = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
.u.qcow2.data = g_new(ImageInfoSpecificQCow2, 1),
@@ -3269,6 +3275,30 @@ static ImageInfoSpecific
*qcow2_get_specific_info(BlockDriverState *bs)
assert(false);
}
+ if (encrypt_info) {
+ ImageInfoSpecificQCow2Encryption *qencrypt =
+ g_new(ImageInfoSpecificQCow2Encryption, 1);
+ switch (encrypt_info->format) {
+ case Q_CRYPTO_BLOCK_FORMAT_QCOW:
+ qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
+ qencrypt->u.aes = encrypt_info->u.qcow;
+ break;
+ case Q_CRYPTO_BLOCK_FORMAT_LUKS:
+ qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
+ qencrypt->u.luks = encrypt_info->u.luks;
+ break;
+ default:
+ abort();
+ }
+ /* Since we did shallow copy above, erase any pointers
+ * in the original info */
+ memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
+ qapi_free_QCryptoBlockInfo(encrypt_info);
+
+ spec_info->u.qcow2.data->has_encrypt = true;
+ spec_info->u.qcow2.data->encrypt = qencrypt;
+ }
+
return spec_info;
}
--
2.9.4
- [Qemu-devel] [PULL 09/85] qcow: convert QCow to use QCryptoBlock for encryption, (continued)
- [Qemu-devel] [PULL 09/85] qcow: convert QCow to use QCryptoBlock for encryption, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 07/85] block: deprecate "encryption=on" in favor of "encrypt.format=aes", Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 12/85] qcow2: extend specification to cover LUKS encryption, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 11/85] qcow2: convert QCow2 to use QCryptoBlock for encryption, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 14/85] qcow2: add iotests to cover LUKS encryption support, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 15/85] iotests: enable tests 134 and 158 to work with qcow (v1), Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 13/85] qcow2: add support for LUKS encryption format, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 16/85] block: rip out all traces of password prompting, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 17/85] block: remove all encryption handling APIs, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 18/85] block: pass option prefix down to crypto layer, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 19/85] qcow2: report encryption specific image information,
Max Reitz <=
- [Qemu-devel] [PULL 21/85] iotests: 181 does not work for all formats, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 20/85] docs: document encryption options for qcow, qcow2 and luks, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 22/85] mirror: Fix inconsistent backing AioContext for after mirroring, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 23/85] specs/qcow2: fix bitmap granularity qemu-specific note, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 24/85] specs/qcow2: do not use wording 'bitmap header', Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 25/85] hbitmap: improve dirty iter, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 26/85] tests: add hbitmap iter test, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 27/85] block: fix bdrv_dirty_bitmap_granularity signature, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 28/85] block/dirty-bitmap: add deserialize_ones func, Max Reitz, 2017/07/11
- [Qemu-devel] [PULL 29/85] qcow2-refcount: rename inc_refcounts() and make it public, Max Reitz, 2017/07/11