[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH RESEND v3 00/10] Support generic Luks encryption
From: |
Hyman Huang |
Subject: |
[PATCH RESEND v3 00/10] Support generic Luks encryption |
Date: |
Mon, 25 Dec 2023 13:45:02 +0800 |
v3:
- Rebase on master
- Add a test case for detached LUKS header
- Adjust the design to honour preallocation of the payload device
- Adjust the design to honour the payload offset from the header,
even when detached
- Support detached LUKS header creation using qemu-img
- Support detached LUKS header querying
- Do some code clean
Thanks for commenting on this series, please review.
Best regared,
Yong
v2:
- Simplify the design by reusing the LUKS driver to implement
the generic Luks encryption, thank Daniel for the insightful
advice.
- rebase on master.
This functionality was motivated by the following to-do list seen
in crypto documents:
https://wiki.qemu.org/Features/Block/Crypto
The last chapter says we should "separate header volume":
The LUKS format has ability to store the header in a separate volume
from the payload. We should extend the LUKS driver in QEMU to support
this use case.
By enhancing the LUKS driver, it is possible to enable
the detachable LUKS header and, as a result, achieve
general encryption for any disk format that QEMU has
supported.
Take the qcow2 as an example, the usage of the generic
LUKS encryption as follows:
1. add a protocol blockdev node of data disk
$ virsh qemu-monitor-command vm '{"execute":"blockdev-add",
> "arguments":{"node-name":"libvirt-1-storage", "driver":"file",
> "filename":"/path/to/test_disk.qcow2"}}'
2. add a protocol blockdev node of LUKS header as above.
$ virsh qemu-monitor-command vm '{"execute":"blockdev-add",
> "arguments":{"node-name":"libvirt-2-storage", "driver":"file",
> "filename": "/path/to/cipher.gluks" }}'
3. add the secret for decrypting the cipher stored in LUKS
header above
$ virsh qemu-monitor-command vm '{"execute":"object-add",
> "arguments":{"qom-type":"secret", "id":
> "libvirt-2-storage-secret0", "data":"abc123"}}'
4. add the qcow2-drived blockdev format node
$ virsh qemu-monitor-command vm '{"execute":"blockdev-add",
> "arguments":{"node-name":"libvirt-1-format", "driver":"qcow2",
> "file":"libvirt-1-storage"}}'
5. add the luks-drived blockdev to link the qcow2 disk with
LUKS header by specifying the field "header"
$ virsh qemu-monitor-command vm '{"execute":"blockdev-add",
> "arguments":{"node-name":"libvirt-2-format", "driver":"luks",
> "file":"libvirt-1-format", "header":"libvirt-2-storage",
> "key-secret":"libvirt-2-format-secret0"}}'
6. add the virtio-blk device finally
$ virsh qemu-monitor-command vm '{"execute":"device_add",
> "arguments": {"num-queues":"1", "driver":"virtio-blk-pci",
> "drive": "libvirt-2-format", "id":"virtio-disk2"}}'
The generic LUKS encryption method of starting a virtual
machine (VM) is somewhat similar to hot-plug in that both
maintaining the same json command while the starting VM
changes the "blockdev-add/device_add" parameters to
"blockdev/device".
Hyman Huang (10):
crypto: Introduce option and structure for detached LUKS header
crypto: Support generic LUKS encryption
qapi: Make parameter 'file' optional for BlockdevCreateOptionsLUKS
crypto: Introduce creation option and structure for detached LUKS
header
crypto: Mark the payload_offset_sector invalid for detached LUKS
header
block: Support detached LUKS header creation using blockdev-create
block: Support detached LUKS header creation using qemu-img
crypto: Introduce 'detached-header' field in QCryptoBlockInfoLUKS
tests: Add detached LUKS header case
MAINTAINERS: Add section "Detached LUKS header"
MAINTAINERS | 5 +
block.c | 5 +-
block/crypto.c | 146 ++++++++++--
block/crypto.h | 8 +
crypto/block-luks.c | 49 +++-
crypto/block.c | 1 +
crypto/blockpriv.h | 3 +
qapi/block-core.json | 14 +-
qapi/crypto.json | 13 +-
tests/qemu-iotests/210.out | 4 +
tests/qemu-iotests/tests/luks-detached-header | 214 ++++++++++++++++++
.../tests/luks-detached-header.out | 5 +
12 files changed, 436 insertions(+), 31 deletions(-)
create mode 100755 tests/qemu-iotests/tests/luks-detached-header
create mode 100644 tests/qemu-iotests/tests/luks-detached-header.out
--
2.39.1
- [PATCH RESEND v3 00/10] Support generic Luks encryption,
Hyman Huang <=
- [PATCH RESEND v3 01/10] crypto: Introduce option and structure for detached LUKS header, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 02/10] crypto: Support generic LUKS encryption, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 03/10] qapi: Make parameter 'file' optional for BlockdevCreateOptionsLUKS, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 04/10] crypto: Introduce creation option and structure for detached LUKS header, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 05/10] crypto: Mark the payload_offset_sector invalid for detached LUKS header, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 06/10] block: Support detached LUKS header creation using blockdev-create, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 07/10] block: Support detached LUKS header creation using qemu-img, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 08/10] crypto: Introduce 'detached-header' field in QCryptoBlockInfoLUKS, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 09/10] tests: Add detached LUKS header case, Hyman Huang, 2023/12/25
- [PATCH RESEND v3 10/10] MAINTAINERS: Add section "Detached LUKS header", Hyman Huang, 2023/12/25