{
virBuffer buf = VIR_BUFFER_INITIALIZER;
- if (info.format == VIR_STORAGE_FILE_LUKS) {
- if (!enc) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("missing luks encryption information"));
- goto error;
- }
+ if (info.format == VIR_STORAGE_FILE_RAW && enc) {
virQEMUBuildLuksOpts(&buf, enc, info.secretAlias);
} else {
if (info.backingPath)
if (virStorageGenerateQcowEncryption(conn, vol) < 0)
return -1;
}
- } else if (format == VIR_STORAGE_FILE_LUKS) {
+ } else if (format == VIR_STORAGE_FILE_RAW) {
if (enc->format != VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("unsupported volume encryption format %d"),
int accessRetCode = -1;
char *absolutePath = NULL;
- if (info->format == VIR_STORAGE_FILE_LUKS) {
+ if (info->format == VIR_STORAGE_FILE_RAW) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("cannot set backing store for luks volume"));
+ _("cannot set backing store for raw volume"));
return -1;
}
_("format features only available with qcow2"));
return NULL;
}
- if (info.format == VIR_STORAGE_FILE_LUKS) {
+ if (info.format == VIR_STORAGE_FILE_RAW &&
+ vol->target.encryption != NULL) {
if (inputvol) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("cannot use inputvol with luks volume"));
+ _("cannot use inputvol with encrypted raw volume"));
return NULL;
}
if (!info.encryption) {
_("missing encryption description"));
return NULL;
}
+ if (vol->target.encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
+ type = "luks";
+ } else {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+ _("Only luks encryption is supported for raw files"));
+ return NULL;
+ }
}
if (inputvol &&
if (info.backingPath)
virCommandAddArgList(cmd, "-b", info.backingPath, NULL);
- if (info.format == VIR_STORAGE_FILE_LUKS) {
+ if (info.format == VIR_STORAGE_FILE_RAW &&
+ vol->target.encryption != NULL &&
+ vol->target.encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
if (virStorageBackendCreateQemuImgSecretObject(cmd, vol, &info) < 0) {
VIR_FREE(info.secretAlias);
virCommandFree(cmd);
if (imgformat < 0)
goto cleanup;
- if (vol->target.format == VIR_STORAGE_FILE_LUKS) {
+ if (vol->target.format == VIR_STORAGE_FILE_RAW &&
+ vol->target.encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
if (!(secretPath =
virStorageBackendCreateQemuImgSecretPath(conn, pool, vol)))
goto cleanup;
if (!inputvol)
return NULL;
- /* If either volume is a non-raw file vol, we need to use an external
- * tool for converting
+ /* If either volume is a non-raw file vol, or uses encryption,
+ * we need to use an external tool for converting
*/
if ((vol->type == VIR_STORAGE_VOL_FILE &&
- vol->target.format != VIR_STORAGE_FILE_RAW) ||
+ (vol->target.format != VIR_STORAGE_FILE_RAW ||
+ vol->target.encryption != NULL)) ||
(inputvol->type == VIR_STORAGE_VOL_FILE &&
- inputvol->target.format != VIR_STORAGE_FILE_RAW)) {
+ (inputvol->target.format != VIR_STORAGE_FILE_RAW ||
+ inputvol->target.encryption != NULL))) {
return virStorageBackendCreateQemuImg;
}
#include "dirname.h"
#include "virbuffer.h"
#include "virjson.h"
+#include "virstorageencryption.h"
#define VIR_FROM_THIS VIR_FROM_STORAGE
"cloop", "dmg", "iso",
"vpc", "vdi",
/* Not direct file formats, but used for various drivers */
- "fat", "vhd", "ploop", "luks",
+ "fat", "vhd", "ploop",
/* Formats with backing file below here */
"cow", "qcow", "qcow2", "qed", "vmdk")
#define FILE_TYPE_VERSIONS_LAST 2
+struct FileEncryptionInfo {
+ int format; /* Encryption format to assign */
+
+ int magicOffset; /* Byte offset of the magic */
+ const char *magic; /* Optional string of magic */
+
+ enum lv_endian endian; /* Endianness of file format */
+
+ int versionOffset; /* Byte offset from start of file
+ * where we find version number,
+ * -1 to always fail the version test,
+ * -2 to always pass the version test */
+ int versionSize; /* Size in bytes of version data (0, 2, or 4) */
+ int versionNumbers[FILE_TYPE_VERSIONS_LAST];
+ /* Version numbers to validate. Zeroes are ignored. */
+
+ int modeOffset; /* Byte offset of the format native encryption mode */
+ char modeValue; /* Value expected at offset */
+};
+
/* Either 'magic' or 'extension' *must* be provided */
struct FileTypeInfo {
int magicOffset; /* Byte offset of the magic */
/* Store a COW base image path (possibly relative),
* or NULL if there is no COW base image, to RES;
* return BACKING_STORE_* */
- int qcowCryptOffset; /* Byte offset from start of file
- * where to find encryption mode,
- * -1 if encryption is not used */
+ const struct FileEncryptionInfo *cryptInfo; /* Encryption info */
int (*getBackingStore)(char **res, int *format,
const char *buf, size_t buf_size);
int (*getFeatures)(virBitmapPtr *features, int format,
char *buf, ssize_t len);
};
+
static int cowGetBackingStore(char **, int *,
const char *, size_t);
static int qcow1GetBackingStore(char **, int *,
/* Format described by qemu commit id '3e308f20e' */
#define LUKS_HDR_VERSION_OFFSET LUKS_HDR_MAGIC_LEN
+static struct FileEncryptionInfo const luksEncryptionInfo[] = {
+ {
+ .format = VIR_STORAGE_ENCRYPTION_FORMAT_LUKS,
+
+ /* Magic is 'L','U','K','S', 0xBA, 0xBE */
+ .magicOffset = 0,
+ .magic = "\x4c\x55\x4b\x53\xba\xbe",
+ .endian = LV_BIG_ENDIAN,
+
+ .versionOffset = LUKS_HDR_VERSION_OFFSET,
+ .versionSize = LUKS_HDR_VERSION_LEN,
+ .versionNumbers = {1},
+
+ .modeOffset = -1,
+ .modeValue = -1,
+ },
+ { 0 }
+};
+
+static struct FileEncryptionInfo const qcow1EncryptionInfo[] = {
+ {
+ .format = VIR_STORAGE_ENCRYPTION_FORMAT_QCOW,
+
+ .magicOffset = 0,
+ .magic = NULL,
+ .endian = LV_BIG_ENDIAN,
+
+ .versionOffset = -1,
+ .versionSize = 0,
+ .versionNumbers = {},
+
+ .modeOffset = QCOW1_HDR_CRYPT,
+ .modeValue = 1,
+ },
+ { 0 }
+};
+
+static struct FileEncryptionInfo const qcow2EncryptionInfo[] = {
+ {
+ .format = VIR_STORAGE_ENCRYPTION_FORMAT_QCOW,
+
+ .magicOffset = 0,
+ .magic = NULL,
+ .endian = LV_BIG_ENDIAN,
+
+ .versionOffset = -1,
+ .versionSize = 0,
+ .versionNumbers = {},
+
+ .modeOffset = QCOW2_HDR_CRYPT,
+ .modeValue = 1,
+ },
+ { 0 }
+};
static struct FileTypeInfo const fileTypeInfo[] = {
[VIR_STORAGE_FILE_NONE] = { 0, NULL, NULL, LV_LITTLE_ENDIAN,
- -1, 0, {0}, 0, 0, 0, 0, NULL, NULL },
+ -1, 0, {0}, 0, 0, 0, NULL, NULL, NULL },
[VIR_STORAGE_FILE_RAW] = { 0, NULL, NULL, LV_LITTLE_ENDIAN,
- -1, 0, {0}, 0, 0, 0, 0, NULL, NULL },
+ -1, 0, {0}, 0, 0, 0,
+ luksEncryptionInfo,
+ NULL, NULL },
[VIR_STORAGE_FILE_DIR] = { 0, NULL, NULL, LV_LITTLE_ENDIAN,
- -1, 0, {0}, 0, 0, 0, 0, NULL, NULL },
+ -1, 0, {0}, 0, 0, 0, NULL, NULL, NULL },
[VIR_STORAGE_FILE_BOCHS] = {
/*"Bochs Virtual HD Image", */ /* Untested */
0, NULL, NULL,
LV_LITTLE_ENDIAN, 64, 4, {0x20000},
- 32+16+16+4+4+4+4+4, 8, 1, -1, NULL, NULL
+ 32+16+16+4+4+4+4+4, 8, 1, NULL, NULL, NULL
},
[VIR_STORAGE_FILE_CLOOP] = {
/* #!/bin/sh
*/ /* Untested */
0, NULL, NULL,
LV_LITTLE_ENDIAN, -1, 0, {0},
- -1, 0, 0, -1, NULL, NULL
+ -1, 0, 0, NULL, NULL, NULL
},
[VIR_STORAGE_FILE_DMG] = {
/* XXX QEMU says there's no magic for dmg,
* would have to match) but then disables that check. */
0, NULL, ".dmg",
0, -1, 0, {0},
- -1, 0, 0, -1, NULL, NULL
+ -1, 0, 0, NULL, NULL, NULL
},
[VIR_STORAGE_FILE_ISO] = {
32769, "CD001", ".iso",
LV_LITTLE_ENDIAN, -2, 0, {0},
- -1, 0, 0, -1, NULL, NULL
+ -1, 0, 0, NULL, NULL, NULL
},
[VIR_STORAGE_FILE_VPC] = {
0, "conectix", NULL,
LV_BIG_ENDIAN, 12, 4, {0x10000},
- 8 + 4 + 4 + 8 + 4 + 4 + 2 + 2 + 4, 8, 1, -1, NULL, NULL
+ 8 + 4 + 4 + 8 + 4 + 4 + 2 + 2 + 4, 8, 1, NULL, NULL, NULL
},
/* TODO: add getBackingStore function */
[VIR_STORAGE_FILE_VDI] = {
64, "\x7f\x10\xda\xbe", ".vdi",
LV_LITTLE_ENDIAN, 68, 4, {0x00010001},
- 64 + 5 * 4 + 256 + 7 * 4, 8, 1, -1, NULL, NULL},
+ 64 + 5 * 4 + 256 + 7 * 4, 8, 1, NULL, NULL, NULL},
/* Not direct file formats, but used for various drivers */
[VIR_STORAGE_FILE_FAT] = { 0, NULL, NULL, LV_LITTLE_ENDIAN,
- -1, 0, {0}, 0, 0, 0, 0, NULL, NULL },
+ -1, 0, {0}, 0, 0, 0, NULL, NULL, NULL },
[VIR_STORAGE_FILE_VHD] = { 0, NULL, NULL, LV_LITTLE_ENDIAN,
- -1, 0, {0}, 0, 0, 0, 0, NULL, NULL },
+ -1, 0, {0}, 0, 0, 0, NULL, NULL, NULL },
[VIR_STORAGE_FILE_PLOOP] = { 0, "WithouFreSpacExt", NULL, LV_LITTLE_ENDIAN,
-2, 0, {0}, PLOOP_IMAGE_SIZE_OFFSET, 0,
- PLOOP_SIZE_MULTIPLIER, -1, NULL, NULL },
-
- /* Magic is 'L','U','K','S', 0xBA, 0xBE
- * Set sizeOffset = -1 and let hypervisor handle */
- [VIR_STORAGE_FILE_LUKS] = {
- 0, "\x4c\x55\x4b\x53\xba\xbe", NULL,
- LV_BIG_ENDIAN, LUKS_HDR_VERSION_OFFSET, 2, {1},
- -1, 0, 0, -1, NULL, NULL
- },
+ PLOOP_SIZE_MULTIPLIER, NULL, NULL, NULL },
+
/* All formats with a backing store probe below here */
[VIR_STORAGE_FILE_COW] = {
0, "OOOM", NULL,
LV_BIG_ENDIAN, 4, 4, {2},
- 4+4+1024+4, 8, 1, -1, cowGetBackingStore, NULL
+ 4+4+1024+4, 8, 1, NULL, cowGetBackingStore, NULL
},
[VIR_STORAGE_FILE_QCOW] = {
0, "QFI", NULL,
LV_BIG_ENDIAN, 4, 4, {1},
- QCOWX_HDR_IMAGE_SIZE, 8, 1, QCOW1_HDR_CRYPT, qcow1GetBackingStore, NULL
+ QCOWX_HDR_IMAGE_SIZE, 8, 1,
+ qcow1EncryptionInfo,
+ qcow1GetBackingStore, NULL
},
[VIR_STORAGE_FILE_QCOW2] = {
0, "QFI", NULL,
LV_BIG_ENDIAN, 4, 4, {2, 3},
- QCOWX_HDR_IMAGE_SIZE, 8, 1, QCOW2_HDR_CRYPT, qcow2GetBackingStore,
+ QCOWX_HDR_IMAGE_SIZE, 8, 1,
+ qcow2EncryptionInfo,
+ qcow2GetBackingStore,
qcow2GetFeatures
},
[VIR_STORAGE_FILE_QED] = {
/* http://wiki.qemu.org/Features/QED */
0, "QED", NULL,
LV_LITTLE_ENDIAN, -2, 0, {0},
- QED_HDR_IMAGE_SIZE, 8, 1, -1, qedGetBackingStore, NULL
+ QED_HDR_IMAGE_SIZE, 8, 1, NULL, qedGetBackingStore, NULL
},
[VIR_STORAGE_FILE_VMDK] = {
0, "KDMV", NULL,
LV_LITTLE_ENDIAN, 4, 4, {1, 2},
- 4+4+4, 8, 512, -1, vmdk4GetBackingStore, NULL
+ 4+4+4, 8, 512, NULL, vmdk4GetBackingStore, NULL
},
};
verify(ARRAY_CARDINALITY(fileTypeInfo) == VIR_STORAGE_FILE_LAST);
+
/* qcow2 compatible features in the order they appear on-disk */
enum qcow2CompatibleFeature {
QCOW2_COMPATIBLE_FEATURE_LAZY_REFCOUNTS = 0,
char *buf,
size_t buflen)
{
- int version = 0;
+ int version;
size_t i;
/* Validate version number info */
}
+static bool
+virStorageFileHasEncryptionFormat(const struct FileEncryptionInfo *info,
+ char *buf,
+ size_t len)
+{
+ if (!info->magic && info->modeOffset == -1)
+ return 0; /* Shouldn't happen - expect at least one */
+
+ if (info->magic) {
+ if (!virStorageFileMatchesMagic(info->magicOffset,
+ info->magic,
+ buf, len))
+ return false;
+
+ if (info->versionOffset != -1 &&
+ !virStorageFileMatchesVersion(info->versionOffset,
+ info->versionSize,
+ info->versionNumbers,
+ info->endian,
+ buf, len))
+ return false;
+
+ return true;
+ } else if (info->modeOffset != -1) {
+ if (info->modeOffset >= len)
+ return false;
+
+ if (buf[info->modeOffset] != info->modeValue)
+ return false;
+
+ return true;
+ } else {
+ return false;
+ }
+}
+
+
/* Given a header in BUF with length LEN, as parsed from the storage file
* assuming it has the given FORMAT, populate information into META
* with information about the file and its backing store. Return format
int *backingFormat)
{
int ret = -1;
+ size_t i;
VIR_DEBUG("path=%s, buf=%p, len=%zu, meta->format=%d",
meta->path, buf, len, meta->format);
goto cleanup;
}
+ if (fileTypeInfo[meta->format].cryptInfo != NULL) {
+ for (i = 0; fileTypeInfo[meta->format].cryptInfo[i].format != 0; i++) {
+ if (virStorageFileHasEncryptionFormat(&fileTypeInfo[meta->format].cryptInfo[i],
+ buf, len)) {
+ if (VIR_ALLOC(meta->encryption) < 0)
+ goto cleanup;
+
+ meta->encryption->format = fileTypeInfo[meta->format].cryptInfo[i].format;
+ }
+ }
+ }
+
/* XXX we should consider moving virStorageBackendUpdateVolInfo
* code into this method, for non-magic files
*/
meta->capacity *= fileTypeInfo[meta->format].sizeMultiplier;
}
- if (fileTypeInfo[meta->format].qcowCryptOffset != -1) {
- int crypt_format;
-
- crypt_format = virReadBufInt32BE(buf +
- fileTypeInfo[meta->format].qcowCryptOffset);
- if (crypt_format && !meta->encryption &&
- VIR_ALLOC(meta->encryption) < 0)
- goto cleanup;
- }
-
- if (meta->format == VIR_STORAGE_FILE_LUKS) {
- /* By definition, this is encrypted */
- if (!meta->encryption && VIR_ALLOC(meta->encryption) < 0)
- goto cleanup;
- }
-
VIR_FREE(meta->backingStoreRaw);
if (fileTypeInfo[meta->format].getBackingStore != NULL) {
int store = fileTypeInfo[meta->format].getBackingStore(&meta->backingStoreRaw,
projects / libvirt.git / commitdiff