[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PATCH v1 14/15] block: remove all encryption handling APIs
From: |
Daniel P. Berrange |
Subject: |
[Qemu-block] [PATCH v1 14/15] block: remove all encryption handling APIs |
Date: |
Tue, 12 Jan 2016 18:56:21 +0000 |
Now that all encryption keys must be provided upfront via
the QCryptoSecret API and associated block driver properties
there is no need for any explicit encryption handling APIs
in the block layer. Encryption can be handled transparently
within the block driver. We only retain an API for querying
whether an image is encrypted or not, since that is a
potentially useful piece of metadata to report to the user.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
block.c | 82 ++--------------------------------------------
block/qapi.c | 2 +-
blockdev.c | 40 ++--------------------
include/block/block.h | 4 ---
include/block/block_int.h | 1 -
tests/qemu-iotests/087.out | 4 +--
6 files changed, 7 insertions(+), 126 deletions(-)
diff --git a/block.c b/block.c
index 01655de..d123cbc 100644
--- a/block.c
+++ b/block.c
@@ -1696,17 +1696,8 @@ static int bdrv_open_inherit(BlockDriverState **pbs,
const char *filename,
goto close_and_fail;
}
- if (!bdrv_key_required(bs)) {
- if (bs->blk) {
- blk_dev_change_media_cb(bs->blk, true);
- }
- } else if (!runstate_check(RUN_STATE_PRELAUNCH)
- && !runstate_check(RUN_STATE_INMIGRATE)
- && !runstate_check(RUN_STATE_PAUSED)) { /* HACK */
- error_setg(errp,
- "Guest must be stopped for opening of encrypted image");
- ret = -EBUSY;
- goto close_and_fail;
+ if (bs->blk) {
+ blk_dev_change_media_cb(bs->blk, true);
}
QDECREF(options);
@@ -2193,7 +2184,6 @@ void bdrv_close(BlockDriverState *bs)
bs->backing_format[0] = '\0';
bs->total_sectors = 0;
bs->encrypted = 0;
- bs->valid_key = 0;
bs->sg = 0;
bs->zero_beyond_eof = false;
QDECREF(bs->options);
@@ -2777,74 +2767,6 @@ int bdrv_is_encrypted(BlockDriverState *bs)
return bs->encrypted;
}
-int bdrv_key_required(BlockDriverState *bs)
-{
- BdrvChild *backing = bs->backing;
-
- if (backing && backing->bs->encrypted && !backing->bs->valid_key) {
- return 1;
- }
- return (bs->encrypted && !bs->valid_key);
-}
-
-int bdrv_set_key(BlockDriverState *bs, const char *key)
-{
- int ret;
- if (bs->backing && bs->backing->bs->encrypted) {
- ret = bdrv_set_key(bs->backing->bs, key);
- if (ret < 0)
- return ret;
- if (!bs->encrypted)
- return 0;
- }
- if (!bs->encrypted) {
- return -EINVAL;
- } else if (!bs->drv || !bs->drv->bdrv_set_key) {
- return -ENOMEDIUM;
- }
- ret = bs->drv->bdrv_set_key(bs, key);
- if (ret < 0) {
- bs->valid_key = 0;
- } else if (!bs->valid_key) {
- bs->valid_key = 1;
- if (bs->blk) {
- /* call the change callback now, we skipped it on open */
- blk_dev_change_media_cb(bs->blk, true);
- }
- }
- return ret;
-}
-
-/*
- * Provide an encryption key for @bs.
- * If @key is non-null:
- * If @bs is not encrypted, fail.
- * Else if the key is invalid, fail.
- * Else set @bs's key to @key, replacing the existing key, if any.
- * If @key is null:
- * If @bs is encrypted and still lacks a key, fail.
- * Else do nothing.
- * On failure, store an error object through @errp if non-null.
- */
-void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp)
-{
- if (key) {
- if (!bdrv_is_encrypted(bs)) {
- error_setg(errp, "Node '%s' is not encrypted",
- bdrv_get_device_or_node_name(bs));
- } else if (bdrv_set_key(bs, key) < 0) {
- error_setg(errp, QERR_INVALID_PASSWORD);
- }
- } else {
- if (bdrv_key_required(bs)) {
- error_set(errp, ERROR_CLASS_DEVICE_ENCRYPTED,
- "'%s' (%s) is encrypted",
- bdrv_get_device_or_node_name(bs),
- bdrv_get_encrypted_filename(bs));
- }
- }
-}
-
const char *bdrv_get_format_name(BlockDriverState *bs)
{
return bs->drv ? bs->drv->format_name : NULL;
diff --git a/block/qapi.c b/block/qapi.c
index 58d3975..639b231 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -42,7 +42,7 @@ BlockDeviceInfo *bdrv_block_device_info(BlockDriverState *bs,
Error **errp)
info->ro = bs->read_only;
info->drv = g_strdup(bs->drv->format_name);
info->encrypted = bs->encrypted;
- info->encryption_key_missing = bdrv_key_required(bs);
+ info->encryption_key_missing = false;
info->cache = g_new(BlockdevCacheInfo, 1);
*info->cache = (BlockdevCacheInfo) {
diff --git a/blockdev.c b/blockdev.c
index 2df0c6d..85e436a 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -623,10 +623,6 @@ static BlockBackend *blockdev_init(const char *file, QDict
*bs_opts,
bdrv_set_io_limits(bs, &cfg);
}
- if (bdrv_key_required(bs)) {
- autostart = 0;
- }
-
block_acct_init(blk_get_stats(blk), account_invalid, account_failed);
if (!parse_stats_intervals(blk_get_stats(blk), interval_list, errp)) {
@@ -2263,24 +2259,8 @@ void qmp_block_passwd(bool has_device, const char
*device,
bool has_node_name, const char *node_name,
const char *password, Error **errp)
{
- Error *local_err = NULL;
- BlockDriverState *bs;
- AioContext *aio_context;
-
- bs = bdrv_lookup_bs(has_device ? device : NULL,
- has_node_name ? node_name : NULL,
- &local_err);
- if (local_err) {
- error_propagate(errp, local_err);
- return;
- }
-
- aio_context = bdrv_get_aio_context(bs);
- aio_context_acquire(aio_context);
-
- bdrv_add_key(bs, password, errp);
-
- aio_context_release(aio_context);
+ error_setg_errno(errp, -ENOSYS,
+ "Setting block passwords directly is no longer
supported");
}
void qmp_blockdev_open_tray(const char *device, bool has_force, bool force,
@@ -2507,12 +2487,6 @@ void qmp_blockdev_change_medium(const char *device,
const char *filename,
blk_apply_root_state(blk, medium_bs);
- bdrv_add_key(medium_bs, NULL, &err);
- if (err) {
- error_propagate(errp, err);
- goto fail;
- }
-
qmp_blockdev_open_tray(device, false, false, &err);
if (err) {
error_propagate(errp, err);
@@ -3851,16 +3825,6 @@ void qmp_blockdev_add(BlockdevOptions *options, Error
**errp)
}
}
- if (bs && bdrv_key_required(bs)) {
- if (blk) {
- blk_unref(blk);
- } else {
- bdrv_unref(bs);
- }
- error_setg(errp, "blockdev-add doesn't support encrypted devices");
- goto fail;
- }
-
fail:
qmp_output_visitor_cleanup(ov);
}
diff --git a/include/block/block.h b/include/block/block.h
index 73ffbd5..379a24c 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -414,10 +414,6 @@ bool bdrv_chain_contains(BlockDriverState *top,
BlockDriverState *base);
BlockDriverState *bdrv_next_node(BlockDriverState *bs);
BlockDriverState *bdrv_next(BlockDriverState *bs);
int bdrv_is_encrypted(BlockDriverState *bs);
-int bdrv_key_required(BlockDriverState *bs);
-int bdrv_set_key(BlockDriverState *bs, const char *key);
-void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp);
-int bdrv_query_missing_keys(void);
void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
void *opaque);
const char *bdrv_get_node_name(const BlockDriverState *bs);
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 256609d..191ce83 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -374,7 +374,6 @@ struct BlockDriverState {
int read_only; /* if true, the media is read only */
int open_flags; /* flags used to open the file, re-used for re-open */
int encrypted; /* if true, the media is encrypted */
- int valid_key; /* if true, a valid encryption key has been set */
int sg; /* if true, the device is a /dev/sg* */
int copy_on_read; /* if true, copy read backing sectors into image
note this is a reference count */
diff --git a/tests/qemu-iotests/087.out b/tests/qemu-iotests/087.out
index 85752bb..2b55b1b 100644
--- a/tests/qemu-iotests/087.out
+++ b/tests/qemu-iotests/087.out
@@ -52,7 +52,7 @@ QMP_VERSION
Encrypted images are deprecated
Support for them will be removed in a future release.
You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"error": {"class": "GenericError", "desc": "blockdev-add doesn't support
encrypted devices"}}
+{"return": {}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
@@ -63,7 +63,7 @@ QMP_VERSION
Encrypted images are deprecated
Support for them will be removed in a future release.
You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"error": {"class": "GenericError", "desc": "Guest must be stopped for opening
of encrypted image"}}
+{"return": {}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
--
2.5.0
- [Qemu-block] [PATCH v1 02/15] crypto: add support for PBKDF2 algorithm, (continued)
- [Qemu-block] [PATCH v1 02/15] crypto: add support for PBKDF2 algorithm, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 03/15] crypto: add support for generating initialization vectors, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 11/15] qcow: make encrypt_sectors encrypt in place, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 09/15] qcow2: make qcow2_encrypt_sectors encrypt in place, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 07/15] block: add flag to indicate that no I/O will be performed, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 12/15] qcow: convert QCow to use QCryptoBlock for encryption, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 14/15] block: remove all encryption handling APIs,
Daniel P. Berrange <=
- [Qemu-block] [PATCH v1 08/15] block: add generic full disk encryption driver, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 15/15] block: remove support for legecy AES qcow/qcow2 encryption, Daniel P. Berrange, 2016/01/12
- [Qemu-block] [PATCH v1 05/15] crypto: add block encryption framework, Daniel P. Berrange, 2016/01/12
[Qemu-block] [PATCH v1 04/15] crypto: add support for anti-forensic split algorithm, Daniel P. Berrange, 2016/01/12