Re: [Qemu-devel] [PATCH v2 14/17] qcow: convert QCow to use QCryptoBlock for encryption

From: Eric Blake <eblake@redhat.com>
To: "Daniel P. Berrange" <berrange@redhat.com>, qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, Fam Zheng <famz@redhat.com>,
	qemu-block@nongnu.org
Subject: Re: [Qemu-devel] [PATCH v2 14/17] qcow: convert QCow to use QCryptoBlock for encryption
Date: Mon, 8 Feb 2016 13:57:31 -0700	[thread overview]
Message-ID: <56B9013B.10403@redhat.com> (raw)
In-Reply-To: <1453311539-1193-15-git-send-email-berrange@redhat.com>

[-- Attachment #1: Type: text/plain, Size: 1596 bytes --]

On 01/20/2016 10:38 AM, Daniel P. Berrange wrote:
> This converts the qcow2 driver to make use of the QCryptoBlock

s/qcow2/qcow/

> APIs for encrypting image content. This is only wired up to
> permit use of the legacy QCow encryption format. Users who wish
> to have the strong LUKS format should switch to qcow2 instead.
> 
> With this change it is now required to use the QCryptoSecret
> object for providing passwords, instead of the current block
> password APIs / interactive prompting.
> 
>   $QEMU \
>     -object secret,id=sec0,filename=/home/berrange/encrypted.pw \
>     -drive file=/home/berrange/encrypted.qcow,key-secret=sec0
> 
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>  block/qcow.c         | 173 +++++++++++++++++++++++----------------------------
>  qapi/block-core.json |  17 ++++-
>  2 files changed, 93 insertions(+), 97 deletions(-)
> 

> +++ b/qapi/block-core.json
> @@ -1756,6 +1756,21 @@
>              'mode':  'Qcow2OverlapCheckMode' } }
>  
>  ##
> +# @BlockdevOptionsQcow
> +#
> +# Driver specific block device options for qcow.
> +#
> +# @key-secret:   #optional ID of the "secret" object providing the
> +#                AES decryption key.

Maybe worth a mention that this is supported for decrypting old images,
but not for use in creating new images (but then again, who creates new
qcow images these days).

With the commit typo fixed,
Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 604 bytes --]