mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 05:35:25 +00:00
qemu: add luks-any encryption support for RBD images
The newly added luks-any rbd encryption format in qemu allows for opening both LUKS and LUKS2 encryption formats. This commit enables libvirt uses to use this wildcard format. Signed-off-by: Or Ozeri <oro@il.ibm.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
This commit is contained in:
parent
5a42a8c38c
commit
5589a3e1f3
@ -109,6 +109,15 @@ to a qemu VM using the qemu VM driver. A single
|
||||
``<secret type='passphrase'...>`` element is expected (except for the case of
|
||||
RBD layered encryption mentioned above).
|
||||
|
||||
``luks-any`` format
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The ``luks-any`` format is currently supported only by the ``librbd`` engine,
|
||||
and can only be applied to RBD network disks (RBD images). This format will try
|
||||
to parse the disk as either LUKS or LUKS2, depending on the actual on-disk
|
||||
format. A single ``<secret type='passphrase'...>`` element is expected (except
|
||||
for the case of RBD layered encryption mentioned above) :since:`Since 9.3.0` .
|
||||
|
||||
Examples
|
||||
--------
|
||||
|
||||
|
@ -14,6 +14,7 @@
|
||||
<value>qcow</value>
|
||||
<value>luks</value>
|
||||
<value>luks2</value>
|
||||
<value>luks-any</value>
|
||||
</choice>
|
||||
</attribute>
|
||||
<optional>
|
||||
|
@ -41,7 +41,7 @@ VIR_ENUM_IMPL(virStorageEncryptionSecret,
|
||||
|
||||
VIR_ENUM_IMPL(virStorageEncryptionFormat,
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_LAST,
|
||||
"default", "qcow", "luks", "luks2",
|
||||
"default", "qcow", "luks", "luks2", "luks-any",
|
||||
);
|
||||
|
||||
VIR_ENUM_IMPL(virStorageEncryptionEngine,
|
||||
|
@ -66,6 +66,7 @@ typedef enum {
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_QCOW, /* Both qcow and qcow2 */
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_LUKS,
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_LUKS2,
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_LUKS_ANY,
|
||||
|
||||
VIR_STORAGE_ENCRYPTION_FORMAT_LAST,
|
||||
} virStorageEncryptionFormatType;
|
||||
|
@ -1095,6 +1095,7 @@ virStorageVolTypeToString;
|
||||
|
||||
# conf/storage_encryption_conf.h
|
||||
virStorageEncryptionFormat;
|
||||
virStorageEncryptionFormatTypeToString;
|
||||
virStorageEncryptionFree;
|
||||
virStorageEncryptionParseNode;
|
||||
|
||||
|
@ -575,6 +575,10 @@ qemuBlockStorageSourceGetRBDProps(virStorageSource *src,
|
||||
encformat = "luks2";
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS_ANY:
|
||||
encformat = "luks-any";
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_QCOW:
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_DEFAULT:
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LAST:
|
||||
@ -1052,10 +1056,8 @@ qemuBlockStorageSourceGetCryptoProps(virStorageSource *src,
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS2:
|
||||
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
||||
_("luks2 is currently not supported by the qemu encryption engine"));
|
||||
return -1;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS_ANY:
|
||||
/* validation code asserts the above cases are impossible */
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_DEFAULT:
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LAST:
|
||||
default:
|
||||
|
@ -5186,8 +5186,10 @@ qemuDomainValidateStorageSource(virStorageSource *src,
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS2:
|
||||
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
||||
_("luks2 is currently not supported by the qemu encryption engine"));
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS_ANY:
|
||||
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
|
||||
_("'%s' is currently not supported by the qemu encryption engine"),
|
||||
virStorageEncryptionFormatTypeToString(src->encryption->format));
|
||||
return -1;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_DEFAULT:
|
||||
@ -5227,6 +5229,29 @@ qemuDomainValidateStorageSource(virStorageSource *src,
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
switch ((virStorageEncryptionFormatType) src->encryption->format) {
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS:
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS2:
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LUKS_ANY:
|
||||
if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_RBD_ENCRYPTION_LUKS_ANY)) {
|
||||
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
||||
_("luks-any encryption is not supported by this QEMU binary"));
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_QCOW:
|
||||
/* validation code above already asserts this case is impossible */
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_DEFAULT:
|
||||
case VIR_STORAGE_ENCRYPTION_FORMAT_LAST:
|
||||
default:
|
||||
virReportEnumRangeError(virStorageEncryptionFormatType,
|
||||
src->encryption->format);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_ENCRYPTION_ENGINE_DEFAULT:
|
||||
|
@ -0,0 +1 @@
|
||||
unsupported configuration: luks-any encryption is not supported by this QEMU binary
|
@ -0,0 +1,37 @@
|
||||
LC_ALL=C \
|
||||
PATH=/bin \
|
||||
HOME=/var/lib/libvirt/qemu/domain--1-encryptdisk \
|
||||
USER=test \
|
||||
LOGNAME=test \
|
||||
XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-encryptdisk/.local/share \
|
||||
XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-encryptdisk/.cache \
|
||||
XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-encryptdisk/.config \
|
||||
/usr/bin/qemu-system-x86_64 \
|
||||
-name guest=encryptdisk,debug-threads=on \
|
||||
-S \
|
||||
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-encryptdisk/master-key.aes"}' \
|
||||
-machine pc-i440fx-2.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
|
||||
-accel tcg \
|
||||
-cpu qemu64 \
|
||||
-m 1024 \
|
||||
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
|
||||
-overcommit mem-lock=off \
|
||||
-smp 1,sockets=1,cores=1,threads=1 \
|
||||
-uuid 496898a6-e6ff-f7c8-5dc2-3cf410945ee9 \
|
||||
-display none \
|
||||
-no-user-config \
|
||||
-nodefaults \
|
||||
-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
|
||||
-mon chardev=charmonitor,id=monitor,mode=control \
|
||||
-rtc base=utc \
|
||||
-no-shutdown \
|
||||
-boot strict=on \
|
||||
-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
|
||||
-object '{"qom-type":"secret","id":"libvirt-1-format-encryption-secret0","data":"9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1","keyid":"masterKey0","iv":"AAECAwQFBgcICQoLDA0ODw==","format":"base64"}' \
|
||||
-blockdev '{"driver":"rbd","pool":"pool","image":"image","server":[{"host":"mon1.example.org","port":"6321"},{"host":"mon2.example.org","port":"6322"},{"host":"mon3.example.org","port":"6322"}],"encrypt":{"format":"luks-any","key-secret":"libvirt-1-format-encryption-secret0"},"node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
|
||||
-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-1-format","id":"virtio-disk0","bootindex":1}' \
|
||||
-audiodev '{"id":"audio1","driver":"none"}' \
|
||||
-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
|
||||
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
|
||||
-msg timestamp=on
|
@ -0,0 +1,39 @@
|
||||
<domain type='qemu'>
|
||||
<name>encryptdisk</name>
|
||||
<uuid>496898a6-e6ff-f7c8-5dc2-3cf410945ee9</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<currentMemory unit='KiB'>524288</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-i440fx-2.1'>hvm</type>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<disk type='network' device='disk'>
|
||||
<driver name='qemu' type='raw'/>
|
||||
<source protocol='rbd' name='pool/image'>
|
||||
<host name='mon1.example.org' port='6321'/>
|
||||
<host name='mon2.example.org' port='6322'/>
|
||||
<host name='mon3.example.org' port='6322'/>
|
||||
<encryption format='luks-any' engine='librbd'>
|
||||
<secret type='passphrase' uuid='0a81f5b2-8403-7b23-c8d6-21ccc2f80fb0'/>
|
||||
</encryption>
|
||||
</source>
|
||||
<target dev='vda' bus='virtio'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pci-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<memballoon model='virtio'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
|
||||
</memballoon>
|
||||
</devices>
|
||||
</domain>
|
@ -1251,6 +1251,8 @@ mymain(void)
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption");
|
||||
DO_TEST_CAPS_VER_PARSE_ERROR("disk-network-rbd-encryption-layering", "7.2.0");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption-layering");
|
||||
DO_TEST_CAPS_VER_PARSE_ERROR("disk-network-rbd-encryption-luks-any", "7.2.0");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption-luks-any");
|
||||
DO_TEST_CAPS_LATEST_PARSE_ERROR("disk-encryption-wrong");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-no-colon");
|
||||
/* qemu-6.0 is the last qemu version supporting sheepdog */
|
||||
|
@ -0,0 +1,44 @@
|
||||
<domain type='qemu'>
|
||||
<name>encryptdisk</name>
|
||||
<uuid>496898a6-e6ff-f7c8-5dc2-3cf410945ee9</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<currentMemory unit='KiB'>524288</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-i440fx-2.1'>hvm</type>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<cpu mode='custom' match='exact' check='none'>
|
||||
<model fallback='forbid'>qemu64</model>
|
||||
</cpu>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<disk type='network' device='disk'>
|
||||
<driver name='qemu' type='raw'/>
|
||||
<source protocol='rbd' name='pool/image'>
|
||||
<host name='mon1.example.org' port='6321'/>
|
||||
<host name='mon2.example.org' port='6322'/>
|
||||
<host name='mon3.example.org' port='6322'/>
|
||||
<encryption format='luks-any' engine='librbd'>
|
||||
<secret type='passphrase' uuid='0a81f5b2-8403-7b23-c8d6-21ccc2f80fb0'/>
|
||||
</encryption>
|
||||
</source>
|
||||
<target dev='vda' bus='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0' model='piix3-uhci'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pci-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<audio id='1' type='none'/>
|
||||
<memballoon model='virtio'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
|
||||
</memballoon>
|
||||
</devices>
|
||||
</domain>
|
@ -326,6 +326,7 @@ mymain(void)
|
||||
DO_TEST_NOCAPS("disk-network-rbd");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption-layering");
|
||||
DO_TEST_CAPS_LATEST("disk-network-rbd-encryption-luks-any");
|
||||
DO_TEST_NOCAPS("disk-network-source-auth");
|
||||
DO_TEST_NOCAPS("disk-network-sheepdog");
|
||||
DO_TEST_NOCAPS("disk-network-vxhs");
|
||||
|
Loading…
Reference in New Issue
Block a user