From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53228) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aT7Vx-0007cU-U7 for qemu-devel@nongnu.org; Tue, 09 Feb 2016 07:35:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aT7Vw-0001aT-Hj for qemu-devel@nongnu.org; Tue, 09 Feb 2016 07:35:29 -0500 Date: Tue, 9 Feb 2016 12:35:19 +0000 From: "Daniel P. Berrange" Message-ID: <20160209123519.GI24614@redhat.com> References: <1453311539-1193-1-git-send-email-berrange@redhat.com> <1453311539-1193-18-git-send-email-berrange@redhat.com> <56B9081E.5030502@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <56B9081E.5030502@redhat.com> Subject: Re: [Qemu-devel] [PATCH v2 17/17] block: remove support for legecy AES qcow/qcow2 encryption Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: Kevin Wolf , Fam Zheng , qemu-devel@nongnu.org, qemu-block@nongnu.org On Mon, Feb 08, 2016 at 02:26:54PM -0700, Eric Blake wrote: > On 01/20/2016 10:38 AM, Daniel P. Berrange wrote: > > Refuse to use images with the legacy AES-CBC encryption > > format in the system emulators. They are still fully > > supported in the qemu-img, qemu-io & qemu-nbd tools in > > order to allow data to be liberated and for compatibility > > with older QEMU versions. Continued support in these tools > > is not a notable burden with the new FDE framework. > > > > Signed-off-by: Daniel P. Berrange > > --- > > > +++ b/block/qcow.c > > @@ -180,6 +180,14 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, > > s->crypt_method_header = header.crypt_method; > > if (s->crypt_method_header) { > > if (s->crypt_method_header == QCOW_CRYPT_AES) { > > + if (bdrv_uses_whitelist()) { > > + error_setg(errp, > > + "Use of AES-CBC encrypted qcow images is no longer " > > + "supported. Please use the qcow2 LUKS format instead."); > > error_setg() should be a single phrase with no trailing punctuation, not > two sentences. Use error_append_hint() for the suggestion of the > replacement. Ah, I didn't know that method existed. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|