ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

block: expose crypto option names / defs to other drivers 

The block/crypto.c defines a set of QemuOpts that provide
parameters for encryption. This will also be needed by
the qcow/qcow2 integration, so expose the relevant pieces
in a new block/crypto.h header. Some helper methods taking
QemuOpts are changed to take QDict to simplify usage in
other places.

Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-2-berrange@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
Daniel P. Berrange 2017-06-23 17:24:00 +01:00 committed by Max Reitz
parent 29741be341
commit 306a06e5f7
2 changed files with 117 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
block/crypto.c
View File

@ -24,16 +24,10 @@
#include "sysemu/block-backend.h" #include "sysemu/block-backend.h"
#include "crypto/block.h" #include "crypto/block.h"
#include "qapi/opts-visitor.h" #include "qapi/opts-visitor.h"
#include "qapi/qobject-input-visitor.h"
#include "qapi-visit.h" #include "qapi-visit.h"
#include "qapi/error.h" #include "qapi/error.h"
#include "block/crypto.h"
#define BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET "key-secret"
#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG "cipher-alg"
#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE "cipher-mode"
#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG "ivgen-alg"
#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG "ivgen-hash-alg"
#define BLOCK_CRYPTO_OPT_LUKS_HASH_ALG "hash-alg"
#define BLOCK_CRYPTO_OPT_LUKS_ITER_TIME "iter-time"
typedef struct BlockCrypto BlockCrypto; typedef struct BlockCrypto BlockCrypto;
@ -135,11 +129,7 @@ static QemuOptsList block_crypto_runtime_opts_luks = {
.name = "crypto", .name = "crypto",
.head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head), .head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head),
.desc = { .desc = {
{ BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET,
.name = BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
.type = QEMU_OPT_STRING,
.help = "ID of the secret that provides the encryption key",
},
{ /* end of list */ } { /* end of list */ }
}, },
}; };
@ -154,49 +144,21 @@ static QemuOptsList block_crypto_create_opts_luks = {
.type = QEMU_OPT_SIZE, .type = QEMU_OPT_SIZE,
.help = "Virtual disk size" .help = "Virtual disk size"
}, },
{ BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET,
.name = BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET, BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG,
.type = QEMU_OPT_STRING, BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE,
.help = "ID of the secret that provides the encryption key", BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG,
}, BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG,
{ BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG,
.name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG, BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME,
.type = QEMU_OPT_STRING,
.help = "Name of encryption cipher algorithm",
},
{
.name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE,
.type = QEMU_OPT_STRING,
.help = "Name of encryption cipher mode",
},
{
.name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG,
.type = QEMU_OPT_STRING,
.help = "Name of IV generator algorithm",
},
{
.name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG,
.type = QEMU_OPT_STRING,
.help = "Name of IV generator hash algorithm",
},
{
.name = BLOCK_CRYPTO_OPT_LUKS_HASH_ALG,
.type = QEMU_OPT_STRING,
.help = "Name of encryption hash algorithm",
},
{
.name = BLOCK_CRYPTO_OPT_LUKS_ITER_TIME,
.type = QEMU_OPT_NUMBER,
.help = "Time to spend in PBKDF in milliseconds",
},
{ /* end of list */ } { /* end of list */ }
}, },
}; };
static QCryptoBlockOpenOptions * QCryptoBlockOpenOptions *
block_crypto_open_opts_init(QCryptoBlockFormat format, block_crypto_open_opts_init(QCryptoBlockFormat format,
QemuOpts *opts, QDict *opts,
Error **errp) Error **errp)
{ {
Visitor *v; Visitor *v;
@ -206,7 +168,7 @@ block_crypto_open_opts_init(QCryptoBlockFormat format,
ret = g_new0(QCryptoBlockOpenOptions, 1); ret = g_new0(QCryptoBlockOpenOptions, 1);
ret->format = format; ret->format = format;
v = opts_visitor_new(opts); v = qobject_input_visitor_new_keyval(QOBJECT(opts));
visit_start_struct(v, NULL, NULL, 0, &local_err); visit_start_struct(v, NULL, NULL, 0, &local_err);
if (local_err) { if (local_err) {
@ -240,9 +202,9 @@ block_crypto_open_opts_init(QCryptoBlockFormat format,
} }
static QCryptoBlockCreateOptions * QCryptoBlockCreateOptions *
block_crypto_create_opts_init(QCryptoBlockFormat format, block_crypto_create_opts_init(QCryptoBlockFormat format,
QemuOpts *opts, QDict *opts,
Error **errp) Error **errp)
{ {
Visitor *v; Visitor *v;
@ -252,7 +214,7 @@ block_crypto_create_opts_init(QCryptoBlockFormat format,
ret = g_new0(QCryptoBlockCreateOptions, 1); ret = g_new0(QCryptoBlockCreateOptions, 1);
ret->format = format; ret->format = format;
v = opts_visitor_new(opts); v = qobject_input_visitor_new_keyval(QOBJECT(opts));
visit_start_struct(v, NULL, NULL, 0, &local_err); visit_start_struct(v, NULL, NULL, 0, &local_err);
if (local_err) { if (local_err) {
@ -299,6 +261,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
int ret = -EINVAL; int ret = -EINVAL;
QCryptoBlockOpenOptions *open_opts = NULL; QCryptoBlockOpenOptions *open_opts = NULL;
unsigned int cflags = 0; unsigned int cflags = 0;
QDict *cryptoopts = NULL;
bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
false, errp); false, errp);
@ -313,7 +276,9 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
goto cleanup; goto cleanup;
} }
open_opts = block_crypto_open_opts_init(format, opts, errp); cryptoopts = qemu_opts_to_qdict(opts, NULL);
open_opts = block_crypto_open_opts_init(format, cryptoopts, errp);
if (!open_opts) { if (!open_opts) {
goto cleanup; goto cleanup;
} }
@ -337,6 +302,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
ret = 0; ret = 0;
cleanup: cleanup:
QDECREF(cryptoopts);
qapi_free_QCryptoBlockOpenOptions(open_opts); qapi_free_QCryptoBlockOpenOptions(open_opts);
return ret; return ret;
} }
@ -356,8 +322,11 @@ static int block_crypto_create_generic(QCryptoBlockFormat format,
.opts = opts, .opts = opts,
.filename = filename, .filename = filename,
}; };
QDict *cryptoopts;
create_opts = block_crypto_create_opts_init(format, opts, errp); cryptoopts = qemu_opts_to_qdict(opts, NULL);
create_opts = block_crypto_create_opts_init(format, cryptoopts, errp);
if (!create_opts) { if (!create_opts) {
return -1; return -1;
} }
@ -375,6 +344,7 @@ static int block_crypto_create_generic(QCryptoBlockFormat format,
ret = 0; ret = 0;
cleanup: cleanup:
QDECREF(cryptoopts);
qcrypto_block_free(crypto); qcrypto_block_free(crypto);
blk_unref(data.blk); blk_unref(data.blk);
qapi_free_QCryptoBlockCreateOptions(create_opts); qapi_free_QCryptoBlockCreateOptions(create_opts);

91
block/crypto.h Normal file
View File

@ -0,0 +1,91 @@
/*
* QEMU block full disk encryption
*
* Copyright (c) 2015-2017 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
*
*/
#ifndef BLOCK_CRYPTO_H__
#define BLOCK_CRYPTO_H__
#define BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET "key-secret"
#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG "cipher-alg"
#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE "cipher-mode"
#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG "ivgen-alg"
#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG "ivgen-hash-alg"
#define BLOCK_CRYPTO_OPT_LUKS_HASH_ALG "hash-alg"
#define BLOCK_CRYPTO_OPT_LUKS_ITER_TIME "iter-time"
#define BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET, \
.type = QEMU_OPT_STRING, \
.help = "ID of the secret that provides the keyslot passphrase", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG, \
.type = QEMU_OPT_STRING, \
.help = "Name of encryption cipher algorithm", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE, \
.type = QEMU_OPT_STRING, \
.help = "Name of encryption cipher mode", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG, \
.type = QEMU_OPT_STRING, \
.help = "Name of IV generator algorithm", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG, \
.type = QEMU_OPT_STRING, \
.help = "Name of IV generator hash algorithm", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_HASH_ALG, \
.type = QEMU_OPT_STRING, \
.help = "Name of encryption hash algorithm", \
}
#define BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME \
{ \
.name = BLOCK_CRYPTO_OPT_LUKS_ITER_TIME, \
.type = QEMU_OPT_NUMBER, \
.help = "Time to spend in PBKDF in milliseconds", \
}
QCryptoBlockCreateOptions *
block_crypto_create_opts_init(QCryptoBlockFormat format,
QDict *opts,
Error **errp);
QCryptoBlockOpenOptions *
block_crypto_open_opts_init(QCryptoBlockFormat format,
QDict *opts,
Error **errp);
#endif /* BLOCK_CRYPTO_H__ */