[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PATCH v4 25/26] block: remove all encryption handling APIs
From: |
Daniel P. Berrange |
Subject: |
[Qemu-block] [PATCH v4 25/26] block: remove all encryption handling APIs |
Date: |
Mon, 29 Feb 2016 12:01:00 +0000 |
Now that all encryption keys must be provided upfront via
the QCryptoSecret API and associated block driver properties
there is no need for any explicit encryption handling APIs
in the block layer. Encryption can be handled transparently
within the block driver. We only retain an API for querying
whether an image is encrypted or not, since that is a
potentially useful piece of metadata to report to the user.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
block.c | 82 ++---------------------------------------------
block/crypto.c | 1 -
block/qapi.c | 2 +-
block/qcow.c | 1 -
block/qcow2.c | 1 -
blockdev.c | 41 ++----------------------
include/block/block.h | 4 ---
include/block/block_int.h | 1 -
8 files changed, 5 insertions(+), 128 deletions(-)
diff --git a/block.c b/block.c
index 1fd4a14..861cb76 100644
--- a/block.c
+++ b/block.c
@@ -1691,17 +1691,8 @@ static int bdrv_open_inherit(BlockDriverState **pbs,
const char *filename,
goto close_and_fail;
}
- if (!bdrv_key_required(bs)) {
- if (bs->blk) {
- blk_dev_change_media_cb(bs->blk, true);
- }
- } else if (!runstate_check(RUN_STATE_PRELAUNCH)
- && !runstate_check(RUN_STATE_INMIGRATE)
- && !runstate_check(RUN_STATE_PAUSED)) { /* HACK */
- error_setg(errp,
- "Guest must be stopped for opening of encrypted image");
- ret = -EBUSY;
- goto close_and_fail;
+ if (bs->blk) {
+ blk_dev_change_media_cb(bs->blk, true);
}
QDECREF(options);
@@ -2187,7 +2178,6 @@ static void bdrv_close(BlockDriverState *bs)
bs->backing_format[0] = '\0';
bs->total_sectors = 0;
bs->encrypted = 0;
- bs->valid_key = 0;
bs->sg = 0;
bs->zero_beyond_eof = false;
QDECREF(bs->options);
@@ -2796,74 +2786,6 @@ int bdrv_is_encrypted(BlockDriverState *bs)
return bs->encrypted;
}
-int bdrv_key_required(BlockDriverState *bs)
-{
- BdrvChild *backing = bs->backing;
-
- if (backing && backing->bs->encrypted && !backing->bs->valid_key) {
- return 1;
- }
- return (bs->encrypted && !bs->valid_key);
-}
-
-int bdrv_set_key(BlockDriverState *bs, const char *key)
-{
- int ret;
- if (bs->backing && bs->backing->bs->encrypted) {
- ret = bdrv_set_key(bs->backing->bs, key);
- if (ret < 0)
- return ret;
- if (!bs->encrypted)
- return 0;
- }
- if (!bs->encrypted) {
- return -EINVAL;
- } else if (!bs->drv || !bs->drv->bdrv_set_key) {
- return -ENOMEDIUM;
- }
- ret = bs->drv->bdrv_set_key(bs, key);
- if (ret < 0) {
- bs->valid_key = 0;
- } else if (!bs->valid_key) {
- bs->valid_key = 1;
- if (bs->blk) {
- /* call the change callback now, we skipped it on open */
- blk_dev_change_media_cb(bs->blk, true);
- }
- }
- return ret;
-}
-
-/*
- * Provide an encryption key for @bs.
- * If @key is non-null:
- * If @bs is not encrypted, fail.
- * Else if the key is invalid, fail.
- * Else set @bs's key to @key, replacing the existing key, if any.
- * If @key is null:
- * If @bs is encrypted and still lacks a key, fail.
- * Else do nothing.
- * On failure, store an error object through @errp if non-null.
- */
-void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp)
-{
- if (key) {
- if (!bdrv_is_encrypted(bs)) {
- error_setg(errp, "Node '%s' is not encrypted",
- bdrv_get_device_or_node_name(bs));
- } else if (bdrv_set_key(bs, key) < 0) {
- error_setg(errp, QERR_INVALID_PASSWORD);
- }
- } else {
- if (bdrv_key_required(bs)) {
- error_set(errp, ERROR_CLASS_DEVICE_ENCRYPTED,
- "'%s' (%s) is encrypted",
- bdrv_get_device_or_node_name(bs),
- bdrv_get_encrypted_filename(bs));
- }
- }
-}
-
const char *bdrv_get_format_name(BlockDriverState *bs)
{
return bs->drv ? bs->drv->format_name : NULL;
diff --git a/block/crypto.c b/block/crypto.c
index 72780f6..cf7823c 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -313,7 +313,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat
format,
}
bs->encrypted = 1;
- bs->valid_key = 1;
qemu_co_mutex_init(&crypto->lock);
diff --git a/block/qapi.c b/block/qapi.c
index db2d3fb..400229a 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -43,7 +43,7 @@ BlockDeviceInfo *bdrv_block_device_info(BlockDriverState *bs,
Error **errp)
info->ro = bs->read_only;
info->drv = g_strdup(bs->drv->format_name);
info->encrypted = bs->encrypted;
- info->encryption_key_missing = bdrv_key_required(bs);
+ info->encryption_key_missing = false;
info->cache = g_new(BlockdevCacheInfo, 1);
*info->cache = (BlockdevCacheInfo) {
diff --git a/block/qcow.c b/block/qcow.c
index 5cb5297..003d6d8 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -216,7 +216,6 @@ static int qcow_open(BlockDriverState *bs, QDict *options,
int flags,
goto fail;
}
bs->encrypted = 1;
- bs->valid_key = 1;
}
s->cluster_bits = header.cluster_bits;
s->cluster_size = 1 << s->cluster_bits;
diff --git a/block/qcow2.c b/block/qcow2.c
index 12c53c0..daae6ec 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1224,7 +1224,6 @@ static int qcow2_open(BlockDriverState *bs, QDict
*options, int flags,
s->crypt_method_header = header.crypt_method;
if (s->crypt_method_header) {
bs->encrypted = 1;
- bs->valid_key = 1;
}
s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
diff --git a/blockdev.c b/blockdev.c
index d4bc435..5262e84 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -622,10 +622,6 @@ static BlockBackend *blockdev_init(const char *file, QDict
*bs_opts,
bdrv_set_io_limits(bs, &cfg);
}
- if (bdrv_key_required(bs)) {
- autostart = 0;
- }
-
block_acct_init(blk_get_stats(blk), account_invalid, account_failed);
if (!parse_stats_intervals(blk_get_stats(blk), interval_list, errp)) {
@@ -2277,24 +2273,8 @@ void qmp_block_passwd(bool has_device, const char
*device,
bool has_node_name, const char *node_name,
const char *password, Error **errp)
{
- Error *local_err = NULL;
- BlockDriverState *bs;
- AioContext *aio_context;
-
- bs = bdrv_lookup_bs(has_device ? device : NULL,
- has_node_name ? node_name : NULL,
- &local_err);
- if (local_err) {
- error_propagate(errp, local_err);
- return;
- }
-
- aio_context = bdrv_get_aio_context(bs);
- aio_context_acquire(aio_context);
-
- bdrv_add_key(bs, password, errp);
-
- aio_context_release(aio_context);
+ error_setg_errno(errp, -ENOSYS,
+ "Setting block passwords directly is no longer
supported");
}
void qmp_blockdev_open_tray(const char *device, bool has_force, bool force,
@@ -2549,12 +2529,6 @@ void qmp_blockdev_change_medium(const char *device,
const char *filename,
blk_apply_root_state(blk, medium_bs);
- bdrv_add_key(medium_bs, NULL, &err);
- if (err) {
- error_propagate(errp, err);
- goto fail;
- }
-
qmp_blockdev_open_tray(device, false, false, &err);
if (err) {
error_propagate(errp, err);
@@ -3926,17 +3900,6 @@ void qmp_blockdev_add(BlockdevOptions *options, Error
**errp)
QTAILQ_INSERT_TAIL(&monitor_bdrv_states, bs, monitor_list);
}
- if (bs && bdrv_key_required(bs)) {
- if (blk) {
- blk_unref(blk);
- } else {
- QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
- bdrv_unref(bs);
- }
- error_setg(errp, "blockdev-add doesn't support encrypted devices");
- goto fail;
- }
-
fail:
qmp_output_visitor_cleanup(ov);
}
diff --git a/include/block/block.h b/include/block/block.h
index 4e2653d..7d7f126 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -417,10 +417,6 @@ bool bdrv_chain_contains(BlockDriverState *top,
BlockDriverState *base);
BlockDriverState *bdrv_next_node(BlockDriverState *bs);
BlockDriverState *bdrv_next(BlockDriverState *bs);
int bdrv_is_encrypted(BlockDriverState *bs);
-int bdrv_key_required(BlockDriverState *bs);
-int bdrv_set_key(BlockDriverState *bs, const char *key);
-void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp);
-int bdrv_query_missing_keys(void);
void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
void *opaque);
const char *bdrv_get_node_name(const BlockDriverState *bs);
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 9ef823a..678a0f9 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -376,7 +376,6 @@ struct BlockDriverState {
int read_only; /* if true, the media is read only */
int open_flags; /* flags used to open the file, re-used for re-open */
int encrypted; /* if true, the media is encrypted */
- int valid_key; /* if true, a valid encryption key has been set */
int sg; /* if true, the device is a /dev/sg* */
int copy_on_read; /* if true, copy read backing sectors into image
note this is a reference count */
--
2.5.0
- [Qemu-block] [PATCH v4 10/26] crypto: refactor code for dealing with AES cipher, (continued)
- [Qemu-block] [PATCH v4 10/26] crypto: refactor code for dealing with AES cipher, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 15/26] qemu-img/qemu-io: don't prompt for passwords if not required, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 14/26] block: add flag to indicate that no I/O will be performed, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 17/26] tests: refactor python I/O tests helper main method, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 09/26] crypto: import an implementation of the XTS cipher mode, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 16/26] tests: redirect stderr to stdout for iotests, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 18/26] tests: add output filter to python I/O tests helper, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 24/26] block: rip out all traces of password prompting, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 21/26] qcow2: convert QCow2 to use QCryptoBlock for encryption, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 26/26] block: remove support for legecy AES qcow/qcow2 encryption, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 25/26] block: remove all encryption handling APIs,
Daniel P. Berrange <=
- [Qemu-block] [PATCH v4 13/26] crypto: implement the LUKS block encryption format, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 22/26] qcow: make encrypt_sectors encrypt in place, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 23/26] qcow: convert QCow to use QCryptoBlock for encryption, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 20/26] qcow2: make qcow2_encrypt_sectors encrypt in place, Daniel P. Berrange, 2016/02/29
- [Qemu-block] [PATCH v4 19/26] block: add generic full disk encryption driver, Daniel P. Berrange, 2016/02/29