[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PATCH WIP 14/30] block: remove support for writing to qcow
From: |
Daniel P. Berrange |
Subject: |
[Qemu-block] [PATCH WIP 14/30] block: remove support for writing to qcow/qcow2 encrypted images |
Date: |
Fri, 20 Nov 2015 18:04:14 +0000 |
Refuse to open a qcow/qcow2 image with encryption if write
access has been requested. To enable historic data to be
liberated support for reading images is retained, as it
does not pose an unreasonable support burden now that the
new key handling infrastructure is inplace.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
block.c | 7 -------
block/qcow.c | 6 ++++++
block/qcow2.c | 6 ++++++
tests/qemu-iotests/087.out | 24 ++++--------------------
tests/qemu-iotests/134 | 8 ++++----
tests/qemu-iotests/134.out | 36 +++++++++---------------------------
6 files changed, 29 insertions(+), 58 deletions(-)
diff --git a/block.c b/block.c
index f6d6067..7aa7ffa 100644
--- a/block.c
+++ b/block.c
@@ -920,13 +920,6 @@ static int bdrv_open_common(BlockDriverState *bs,
BdrvChild *file,
goto free_and_fail;
}
- if (bs->encrypted) {
- error_report("Encrypted images are deprecated");
- error_printf("Support for them will be removed in a future release.\n"
- "You can use 'qemu-img convert' to convert your image"
- " to an unencrypted one.\n");
- }
-
ret = refresh_total_sectors(bs, bs->total_sectors);
if (ret < 0) {
error_setg_errno(errp, -ret, "Could not refresh total sector count");
diff --git a/block/qcow.c b/block/qcow.c
index ccf6de1..1914e5e 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -224,6 +224,12 @@ static int qcow_open(BlockDriverState *bs, QDict *options,
int flags,
}
s->crypt_method_header = header.crypt_method;
if (s->crypt_method_header) {
+ if (flags & BDRV_O_RDWR) {
+ error_setg(errp,
+ "Writing of encrypted qcow images is no longer
supported");
+ ret = -ENOSYS;
+ goto fail;
+ }
bs->encrypted = 1;
}
if (!(flags & BDRV_O_NO_IO) &&
diff --git a/block/qcow2.c b/block/qcow2.c
index 900eed1..3ac5a12 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1028,6 +1028,12 @@ static int qcow2_open(BlockDriverState *bs, QDict
*options, int flags,
}
s->crypt_method_header = header.crypt_method;
if (s->crypt_method_header) {
+ if (flags & BDRV_O_RDWR) {
+ error_setg(errp,
+ "Writing of encrypted qcow2 images is no longer
supported");
+ ret = -ENOSYS;
+ goto fail;
+ }
bs->encrypted = 1;
}
diff --git a/tests/qemu-iotests/087.out b/tests/qemu-iotests/087.out
index 2b55b1b..d98881e 100644
--- a/tests/qemu-iotests/087.out
+++ b/tests/qemu-iotests/087.out
@@ -38,21 +38,13 @@ QMP_VERSION
=== Encrypted image ===
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
Testing: -S
QMP_VERSION
{"return": {}}
{"return": {}}
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"return": {}}
+{"error": {"class": "GenericError", "desc": "Writing of encrypted qcow2 images
is no longer supported"}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
@@ -60,22 +52,14 @@ Testing:
QMP_VERSION
{"return": {}}
{"return": {}}
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-{"return": {}}
+{"error": {"class": "GenericError", "desc": "Writing of encrypted qcow2 images
is no longer supported"}}
{"return": {}}
{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event":
"SHUTDOWN"}
=== Missing driver ===
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
Testing: -S
QMP_VERSION
diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
index a247473..5b094bc 100755
--- a/tests/qemu-iotests/134
+++ b/tests/qemu-iotests/134
@@ -55,19 +55,19 @@ TEST_IMG="driver=qcow2,file=$TEST_IMG,keyid=sec0"
echo
echo "== reading whole image =="
-$QEMU_IO --object $SECRET1 -c "read 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "read 0 $size" --source "$TEST_IMG" 2>&1 |
_filter_qemu_io | _filter_testdir
echo
echo "== rewriting whole image =="
-$QEMU_IO --object $SECRET1 -c "write -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "write -P 0xa 0 $size" --source "$TEST_IMG"
2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== verify pattern =="
-$QEMU_IO --object $SECRET1 -c "read -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET1 -c "read -P 0xa 0 $size" --source "$TEST_IMG" 2>&1
| _filter_qemu_io | _filter_testdir
echo
echo "== verify pattern failure with wrong password =="
-$QEMU_IO --object $SECRET2 -c "read -P 0xa 0 $size" --source "$TEST_IMG" |
_filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET2 -c "read -P 0xa 0 $size" --source "$TEST_IMG" 2>&1
| _filter_qemu_io | _filter_testdir
# success, all done
diff --git a/tests/qemu-iotests/134.out b/tests/qemu-iotests/134.out
index 845aa57..f386ebf 100644
--- a/tests/qemu-iotests/134.out
+++ b/tests/qemu-iotests/134.out
@@ -1,38 +1,20 @@
QA output created by 134
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-qemu-img: Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
+qemu-img: TEST_DIR/t.IMGFMT: Writing of encrypted IMGFMT images is no longer
supported
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on
== reading whole image ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== rewriting whole image ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-wrote 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== verify pattern ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
== verify pattern failure with wrong password ==
-Encrypted images are deprecated
-Support for them will be removed in a future release.
-You can use 'qemu-img convert' to convert your image to an unencrypted one.
-Pattern verification failed at offset 0, 134217728 bytes
-read 134217728/134217728 bytes at offset 0
-128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io: can't open device TEST_DIR/t.qcow2: Writing of encrypted qcow2 images
is no longer supported
+no file open, try 'help open'
*** done
--
2.5.0
- [Qemu-block] [PATCH WIP 08/30] qemu-io: add support for --object command line arg, (continued)
- [Qemu-block] [PATCH WIP 08/30] qemu-io: add support for --object command line arg, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 09/30] qemu-io: allow specifying image as a set of options args, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 16/30] crypto: add ability to query the cipher key, block & IV lens, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 15/30] qcow2: make qcow2_encrypt_sectors encrypt in place, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 17/30] crypto: add method for querying hash digest size, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 13/30] block: remove all encryption handling APIs, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 10/30] qemu-nbd: allow specifying image as a set of options args, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 21/30] crypto: add cryptographic random byte source, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 18/30] crypto: move QCryptoHashAlgorithm enum definition into QAPI, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 23/30] crypto: add support for generating initialization vectors, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 14/30] block: remove support for writing to qcow/qcow2 encrypted images,
Daniel P. Berrange <=
- [Qemu-block] [PATCH WIP 12/30] block: rip out all traces of password prompting, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 11/30] qemu-img: allow specifying image as a set of options args, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 24/30] crypto: add support for anti-forensic split algorithm, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 20/30] crypto: ensure qapi/crypto.json is listed in qapi-modules, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 28/30] block: add generic full disk encryption driver, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 22/30] crypto: add support for PBKDF2 algorithm, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 19/30] crypto: move QCryptoCipherAlgorithm/Mode enum definitions into QAPI, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 25/30] crypto: fix transposed arguments in cipher error message, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 29/30] qcow2: convert QCow2 to use QCryptoBlock for encryption, Daniel P. Berrange, 2015/11/20
- [Qemu-block] [PATCH WIP 26/30] crypto: add block encryption framework, Daniel P. Berrange, 2015/11/20