[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PATCH 17/17] block: remove support for writing to qcow/qco
From: |
Daniel P. Berrange |
Subject: |
[Qemu-block] [PATCH 17/17] block: remove support for writing to qcow/qcow2 encrypted images |
Date: |
Mon, 19 Oct 2015 16:09:49 +0100 |
Refuse to open a qcow/qcow2 image with encryption if write
access has been requested. To enable historic data to be
liberated support for reading images is retained, as it
does not pose an unreasonable support burden now that the
new key handling infrastructure is inplace.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
block.c | 7 -------
block/qcow.c | 6 ++++++
block/qcow2.c | 6 ++++++
tests/qemu-iotests/087.out | 24 ++++--------------------
tests/qemu-iotests/134 | 8 ++++----
tests/qemu-iotests/134.out | 36 +++++++++---------------------------
6 files changed, 29 insertions(+), 58 deletions(-)
diff --git a/block.c b/block.c
index bb8cb96..afb4003 100644
--- a/block.c
+++ b/block.c
@@ -923,13 +923,6 @@ static int bdrv_open_common(BlockDriverState *bs,
BdrvChild *file,
goto free_and_fail;
}
- if (bs->encrypted) {
- error_report("Encrypted images are deprecated");
- error_printf("Support for them will be removed in a future release.\n"
- "You can use 'qemu-img convert' to convert your image"
- " to an unencrypted one.\n");
- }
-
ret = refresh_total_sectors(bs, bs->total_sectors);
if (ret < 0) {
error_setg_errno(errp, -ret, "Could not refresh total sector count");
diff --git a/block/qcow.c b/block/qcow.c
index ccf6de1..1914e5e 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -224,6 +224,12 @@ static int qcow_open(BlockDriverState *bs, QDict *options,
int flags,
}
s->crypt_method_header = header.crypt_method;
if (s->crypt_method_header) {
+ if (flags & BDRV_O_RDWR) {
+ error_setg(errp,
+ "Writing of encrypted qcow images is no longer
supported");
+ ret = -ENOSYS;
+ goto fail;
+ }
bs->encrypted = 1;
}
if (!(flags & BDRV_O_NO_IO) &&
diff --git a/block/qcow2.c b/block/qcow2.c
index c93df92..a2559f8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1028,6 +1028,12 @@ static int qcow2_open(BlockDriverState *bs, QDict
*options, int flags,
}
s->crypt_method_header = header.crypt_method;
if (s->crypt_method_header) {
+ if (flags & BDRV_O_RDWR) {
+ error_setg(errp,
+ "Writing of encrypted qcow2 images is no longer
supported");
+ ret = -ENOSYS;
+ goto fail;
+ }
bs->encrypted = 1;
}
diff --git a/tests/qemu-iotests/087.out b/tests/qemu-iotests/087.out
index 50ce50d..0cd656a 100644
--- a/tests/qemu-iotests/087.out
+++ b/tests/qemu-iotests/087.out
@@ -38,21 +38,13 @@ QMP_VERSION
=== Encrypted image ===
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
Testing: -S
QMP_VERSION
{"return": {}}
{"return": {}}
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"return": {}}
+{"error": {"class": "GenericError", "desc": "Writing of encrypted qcow2 images
is no longer supported"}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
@@ -60,22 +52,14 @@ Testing:
QMP_VERSION
{"return": {}}
{"return": {}}
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"return": {}}
+{"error": {"class": "GenericError", "desc": "Writing of encrypted qcow2 images
is no longer supported"}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
=== Missing driver ===
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
Testing: -S
QMP_VERSION
diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
index a247473..5b094bc 100755
--- a/tests/qemu-iotests/134
+++ b/tests/qemu-iotests/134
@@ -55,19 +55,19 @@ TEST_IMG="driver=qcow2,file=$TEST_IMG,keyid=sec0"
echo
echo "== reading whole image =="
-$QEMU_IO --object $SECRET1 -c "read 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "read 0 $size" --source "$TEST_IMG" 2>&1 |
_filter_qemu_io | _filter_testdir
echo
echo "== rewriting whole image =="
-$QEMU_IO --object $SECRET1 -c "write -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "write -P 0xa 0 $size" --source "$TEST_IMG"
2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== verify pattern =="
-$QEMU_IO --object $SECRET1 -c "read -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "read -P 0xa 0 $size" --source "$TEST_IMG" 2>&1
| _filter_qemu_io | _filter_testdir
echo
echo "== verify pattern failure with wrong password =="
-$QEMU_IO --object $SECRET2 -c "read -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET2 -c "read -P 0xa 0 $size" --source "$TEST_IMG" 2>&1
| _filter_qemu_io | _filter_testdir
# success, all done
diff --git a/tests/qemu-iotests/134.out b/tests/qemu-iotests/134.out
index 845aa57..f386ebf 100644
--- a/tests/qemu-iotests/134.out
+++ b/tests/qemu-iotests/134.out
@@ -1,38 +1,20 @@
QA output created by 134
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
== reading whole image ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== rewriting whole image ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-wrote 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== verify pattern ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== verify pattern failure with wrong password ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-Pattern verification failed at offset 0, 134217728 bytes
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
*** done
--
2.4.3
- [Qemu-block] [PATCH 06/17] qcow: add a 'keyid' parameter to qcow options, (continued)
- [Qemu-block] [PATCH 06/17] qcow: add a 'keyid' parameter to qcow options, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 10/17] qemu-nbd: add support for --object command line arg, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 08/17] qom: add user_creatable_add & user_creatable_del methods, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 09/17] qemu-img: add support for --object command line arg, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 13/17] qemu-nbd: allow specifying image as a set of options args, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 11/17] qemu-io: add support for --object command line arg, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 12/17] qemu-io: allow specifying image as a set of options args, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 16/17] block: remove all encryption handling APIs, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 15/17] block: rip out all traces of password prompting, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 14/17] qemu-img: allow specifying image as a set of options args, Daniel P. Berrange, 2015/10/19
- [Qemu-block] [PATCH 17/17] block: remove support for writing to qcow/qcow2 encrypted images,
Daniel P. Berrange <=
- Re: [Qemu-block] [Qemu-devel] [PATCH 00/17] Framework for securely passing secrets to QEMU, Alex Bennée, 2015/10/19
- Re: [Qemu-block] [Qemu-devel] [PATCH 00/17] Framework for securely passing secrets to QEMU, Dr. David Alan Gilbert, 2015/10/19
- Re: [Qemu-block] [PATCH 00/17] Framework for securely passing secrets to QEMU, Stefan Hajnoczi, 2015/10/23