[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 22/26] rbd: New parameter key-secret
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 22/26] rbd: New parameter key-secret |
Date: |
Fri, 15 Jun 2018 16:21:04 +0200 |
From: Markus Armbruster <address@hidden>
Legacy -drive supports "password-secret" parameter that isn't
available with -blockdev / blockdev-add. That's because we backed out
our first try to provide it there due to interface design doubts, in
commit 577d8c9a811, v2.9.0.
This is the second try. It brings back the parameter, except it's
named "key-secret" now.
Let's review our reasons for backing out the first try, as stated in
the commit message:
* BlockdevOptionsRbd member @password-secret isn't actually a
password, it's a key generated by Ceph.
Addressed by the rename.
* We're not sure where member @password-secret belongs (see the
previous commit).
See previous commit.
* How @password-secret interacts with settings from a configuration
file specified with @conf is undocumented.
Not actually true, the documentation for @conf says "Values in the
configuration file will be overridden by options specified via QAPI",
and we've tested this.
Signed-off-by: Markus Armbruster <address@hidden>
Reviewed-by: Kevin Wolf <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
qapi/block-core.json | 6 ++++++
block/rbd.c | 41 +++++++++++++++++++++++++----------------
2 files changed, 31 insertions(+), 16 deletions(-)
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 0f68ca56f3..ab629d1647 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -3204,6 +3204,11 @@
# This maps to Ceph configuration option
# "auth_client_required". (Since 3.0)
#
+# @key-secret: ID of a QCryptoSecret object providing a key
+# for cephx authentication.
+# This maps to Ceph configuration option
+# "key". (Since 3.0)
+#
# @server: Monitor host address and port. This maps
# to the "mon_host" Ceph option.
#
@@ -3216,6 +3221,7 @@
'*snapshot': 'str',
'*user': 'str',
'*auth-client-required': ['RbdAuthMode'],
+ '*key-secret': 'str',
'*server': ['InetSocketAddressBase'] } }
##
diff --git a/block/rbd.c b/block/rbd.c
index ea0575d068..f2c6965418 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -239,24 +239,25 @@ static void qemu_rbd_refresh_limits(BlockDriverState *bs,
Error **errp)
}
-static int qemu_rbd_set_auth(rados_t cluster, const char *secretid,
- BlockdevOptionsRbd *opts,
+static int qemu_rbd_set_auth(rados_t cluster, BlockdevOptionsRbd *opts,
Error **errp)
{
- char *acr;
+ char *key, *acr;
int r;
GString *accu;
RbdAuthModeList *auth;
- if (secretid) {
- gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
- errp);
- if (!secret) {
- return -1;
+ if (opts->key_secret) {
+ key = qcrypto_secret_lookup_as_base64(opts->key_secret, errp);
+ if (!key) {
+ return -EIO;
+ }
+ r = rados_conf_set(cluster, "key", key);
+ g_free(key);
+ if (r < 0) {
+ error_setg_errno(errp, -r, "Could not set 'key'");
+ return r;
}
-
- rados_conf_set(cluster, "key", secret);
- g_free(secret);
}
if (opts->has_auth_client_required) {
@@ -367,9 +368,7 @@ static QemuOptsList runtime_opts = {
},
};
-/* FIXME Deprecate and remove keypairs or make it available in QMP.
- * password_secret should eventually be configurable in opts->location. Support
- * for it in .bdrv_open will make it work here as well. */
+/* FIXME Deprecate and remove keypairs or make it available in QMP. */
static int qemu_rbd_do_create(BlockdevCreateOptions *options,
const char *keypairs, const char
*password_secret,
Error **errp)
@@ -575,6 +574,16 @@ static int qemu_rbd_connect(rados_t *cluster,
rados_ioctx_t *io_ctx,
Error *local_err = NULL;
int r;
+ if (secretid) {
+ if (opts->key_secret) {
+ error_setg(errp,
+ "Legacy 'password-secret' clashes with 'key-secret'");
+ return -EINVAL;
+ }
+ opts->key_secret = g_strdup(secretid);
+ opts->has_key_secret = true;
+ }
+
mon_host = qemu_rbd_mon_host(opts, &local_err);
if (local_err) {
error_propagate(errp, local_err);
@@ -607,8 +616,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t
*io_ctx,
}
}
- if (qemu_rbd_set_auth(*cluster, secretid, opts, errp) < 0) {
- r = -EIO;
+ r = qemu_rbd_set_auth(*cluster, opts, errp);
+ if (r < 0) {
goto failed_shutdown;
}
--
2.13.6
- [Qemu-devel] [PULL 02/26] iotests: Add test 221 to catch qemu-img map regression, (continued)
- [Qemu-devel] [PULL 02/26] iotests: Add test 221 to catch qemu-img map regression, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 07/26] block: Add block-specific QDict header, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 14/26] block-qdict: Simplify qdict_flatten_qdict(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 10/26] block: Fix -drive for certain non-string scalars, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 12/26] block: Factor out qobject_input_visitor_new_flat_confused(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 13/26] block: Make remaining uses of qobject input visitor more robust, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 15/26] block-qdict: Tweak qdict_flatten_qdict(), qdict_flatten_qlist(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 17/26] block-qdict: Simplify qdict_is_list() some, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 16/26] block-qdict: Clean up qdict_crumple() a bit, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 09/26] block: Fix -blockdev for certain non-string scalars, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 22/26] rbd: New parameter key-secret,
Kevin Wolf <=
- [Qemu-devel] [PULL 20/26] block: Fix -blockdev / blockdev-add for empty objects and arrays, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 18/26] check-block-qdict: Rename qdict_flatten()'s variables for clarity, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 19/26] check-block-qdict: Cover flattening of empty lists and dictionaries, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 21/26] rbd: New parameter auth-client-required, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 11/26] block: Clean up a misuse of qobject_to() in .bdrv_co_create_opts(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 23/26] block: Remove deprecated -drive geometry options, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 26/26] block: Remove dead deprecation warning code, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 24/26] block: Remove deprecated -drive option addr, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 25/26] block: Remove deprecated -drive option serial, Kevin Wolf, 2018/06/15