Commit 3e308f20 authored by Daniel P. Berrangé's avatar Daniel P. Berrangé
Browse files

crypto: implement the LUKS block encryption format 



Provide a block encryption implementation that follows the
LUKS/dm-crypt specification.

This supports all combinations of hash, cipher algorithm,
cipher mode and iv generator that are implemented by the
current crypto layer.

There is support for opening existing volumes formatted
by dm-crypt, and for formatting new volumes. In the latter
case it will only use key slot 0.

Reviewed-by: default avatarEric Blake <eblake@redhat.com>
Signed-off-by: default avatarDaniel P. Berrange <berrange@redhat.com>
parent 7d969014

crypto/Makefile.objs

+1 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ crypto-obj-y += afsplit.o 
crypto-obj-y += xts.o

crypto-obj-y += block.o

crypto-obj-y += block-qcow.o

crypto-obj-y += block-luks.o



# Let the userspace emulators avoid linking gnutls/etc

crypto-aes-obj-y = aes.o

crypto/block-luks.c

0 → 100644
+1328 −0

File added.

Preview size limit exceeded, changes collapsed.

crypto/block-luks.h

0 → 100644
+28 −0
Original line number Diff line number Diff line 
/*

 * QEMU Crypto block device encryption LUKS format

 *

 * Copyright (c) 2015-2016 Red Hat, Inc.

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library; if not, see <http://www.gnu.org/licenses/>.

 *

 */



#ifndef QCRYPTO_BLOCK_LUKS_H__

#define QCRYPTO_BLOCK_LUKS_H__



#include "crypto/blockpriv.h"



extern const QCryptoBlockDriver qcrypto_block_driver_luks;



#endif /* QCRYPTO_BLOCK_LUKS_H__ */

crypto/block.c

+2 −0
Original line number Diff line number Diff line
@@ -21,9 +21,11 @@ 
#include "qemu/osdep.h"

#include "crypto/blockpriv.h"

#include "crypto/block-qcow.h"

#include "crypto/block-luks.h"



static const QCryptoBlockDriver *qcrypto_block_drivers[] = {

    [Q_CRYPTO_BLOCK_FORMAT_QCOW] = &qcrypto_block_driver_qcow,

    [Q_CRYPTO_BLOCK_FORMAT_LUKS] = &qcrypto_block_driver_luks,

};

qapi/crypto.json

+46 −3
Original line number Diff line number Diff line
@@ -117,12 +117,13 @@ 
#

# @qcow: QCow/QCow2 built-in AES-CBC encryption. Use only

#        for liberating data from old images.

# @luks: LUKS encryption format. Recommended for new images

#

# Since: 2.6

##

{ 'enum': 'QCryptoBlockFormat',

#  'prefix': 'QCRYPTO_BLOCK_FORMAT',

  'data': ['qcow']}

  'data': ['qcow', 'luks']}



##

# QCryptoBlockOptionsBase:
@@ -151,6 +152,46 @@ 
{ 'struct': 'QCryptoBlockOptionsQCow',

  'data': { '*key-secret': 'str' }}



##

# QCryptoBlockOptionsLUKS:

#

# The options that apply to LUKS encryption format

#

# @key-secret: #optional the ID of a QCryptoSecret object providing the

#              decryption key. Mandatory except when probing image for

#              metadata only.

# Since: 2.6

##

{ 'struct': 'QCryptoBlockOptionsLUKS',

  'data': { '*key-secret': 'str' }}





##

# QCryptoBlockCreateOptionsLUKS:

#

# The options that apply to LUKS encryption format initialization

#

# @cipher-alg: #optional the cipher algorithm for data encryption

#              Currently defaults to 'aes'.

# @cipher-mode: #optional the cipher mode for data encryption

#               Currently defaults to 'cbc'

# @ivgen-alg: #optional the initialization vector generator

#             Currently defaults to 'essiv'

# @ivgen-hash-alg: #optional the initialization vector generator hash

#                  Currently defaults to 'sha256'

# @hash-alg: #optional the master key hash algorithm

#            Currently defaults to 'sha256'

# Since: 2.6

##

{ 'struct': 'QCryptoBlockCreateOptionsLUKS',

  'base': 'QCryptoBlockOptionsLUKS',

  'data': { '*cipher-alg': 'QCryptoCipherAlgorithm',

            '*cipher-mode': 'QCryptoCipherMode',

            '*ivgen-alg': 'QCryptoIVGenAlgorithm',

            '*ivgen-hash-alg': 'QCryptoHashAlgorithm',

            '*hash-alg': 'QCryptoHashAlgorithm'}}





##

# QCryptoBlockOpenOptions:

#
@@ -162,7 +203,8 @@ 
{ 'union': 'QCryptoBlockOpenOptions',

  'base': 'QCryptoBlockOptionsBase',

  'discriminator': 'format',

  'data': { 'qcow': 'QCryptoBlockOptionsQCow' } }

  'data': { 'qcow': 'QCryptoBlockOptionsQCow',

            'luks': 'QCryptoBlockOptionsLUKS' } }





##
@@ -176,4 +218,5 @@ 
{ 'union': 'QCryptoBlockCreateOptions',

  'base': 'QCryptoBlockOptionsBase',

  'discriminator': 'format',

  'data': { 'qcow': 'QCryptoBlockOptionsQCow' } }
 
  'data': { 'qcow': 'QCryptoBlockOptionsQCow',

            'luks': 'QCryptoBlockCreateOptionsLUKS' } }