]> git.proxmox.com Git - mirror_qemu.git/commit - block/crypto.c
block: add generic full disk encryption driver
authorDaniel P. Berrange <berrange@redhat.com>
Mon, 21 Mar 2016 14:11:47 +0000 (14:11 +0000)
committerKevin Wolf <kwolf@redhat.com>
Wed, 30 Mar 2016 10:11:26 +0000 (12:11 +0200)
commit78368575a63df3ef95653024fa21a91d441b0c8d
tree9f2bd5f94db1285c2f95a040a5c0a1f3dacdf64b
parenta2d1c8fd84de207ab8e078d00851e0b93b50756d
block: add generic full disk encryption driver

Add a block driver that is capable of supporting any full disk
encryption format. This utilizes the previously added block
encryption code, and at this time supports the LUKS format.

The driver code is capable of supporting any format supported
by the QCryptoBlock module, so it registers one block driver
for each format. This patch only registers the "luks" driver
since the "qcow" driver is there only for back-compatibility
with existing qcow built-in encryption.

New LUKS compatible volumes can be formatted using qemu-img
with defaults for all settings.

$ qemu-img create --object secret,data=123456,id=sec0 \
      -f luks -o key-secret=sec0 demo.luks 10G

Alternatively the cryptographic settings can be explicitly
set

$ qemu-img create --object secret,data=123456,id=sec0 \
      -f luks -o key-secret=sec0,cipher-alg=aes-256,\
                 cipher-mode=cbc,ivgen-alg=plain64,hash-alg=sha256 \
      demo.luks 10G

And query its size

$ qemu-img info demo.img
image: demo.img
file format: luks
virtual size: 10G (10737418240 bytes)
disk size: 132K
encrypted: yes

Note that it was not necessary to provide the password
when querying info for the volume. The password is only
required when performing I/O on the volume

All volumes created by this new 'luks' driver should be
capable of being opened by the kernel dm-crypt driver.

The only algorithms listed in the LUKS spec that are
not currently supported by this impl are sha512 and
ripemd160 hashes and cast6 cipher.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
[ kwolf - Added #include to resolve conflict with da34e65c ]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/Makefile.objs
block/crypto.c [new file with mode: 0644]
qapi/block-core.json