Commit d8d5fefd authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/berrange/tags/qcrypto-next-pull-request' into staging 



Merge crypto patches 2018/12/12

 - Fix documentation about default LUKS algorithms
 - Support for multi-threaded block crypto

# gpg: Signature made Wed 12 Dec 2018 11:21:52 GMT
# gpg:                using RSA key BE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>"
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>"
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/qcrypto-next-pull-request:
  crypto: support multiple threads accessing one QCryptoBlock
  crypto/block: introduce qcrypto_block_*crypt_helper functions
  crypto/block: rename qcrypto_block_*crypt_helper
  crypto/block: refactor qcrypto_block_*crypt_helper functions
  crypto/block-luks: fix memory leak in qcrypto_block_luks_create
  crypto: Fix defaults in QCryptoBlockCreateOptionsLUKS

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 2d894e48 c972fa12

block/crypto.c

+1 −0
Original line number Diff line number Diff line
@@ -229,6 +229,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format, 
                                       block_crypto_read_func,

                                       bs,

                                       cflags,

                                       1,

                                       errp);



    if (!crypto->block) {

block/qcow.c

+1 −1
Original line number Diff line number Diff line
@@ -213,7 +213,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, 
                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;

            }

            s->crypto = qcrypto_block_open(crypto_opts, "encrypt.",

                                           NULL, NULL, cflags, errp);

                                           NULL, NULL, cflags, 1, errp);

            if (!s->crypto) {

                ret = -EINVAL;

                goto fail;

block/qcow2.c

+2 −2
Original line number Diff line number Diff line
@@ -294,7 +294,7 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset, 
            }

            s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",

                                           qcow2_crypto_hdr_read_func,

                                           bs, cflags, errp);

                                           bs, cflags, 1, errp);

            if (!s->crypto) {

                return -EINVAL;

            }
@@ -1445,7 +1445,7 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options, 
                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;

            }

            s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",

                                           NULL, NULL, cflags, errp);

                                           NULL, NULL, cflags, 1, errp);

            if (!s->crypto) {

                ret = -EINVAL;

                goto fail;

crypto/block-luks.c

+28 −29
Original line number Diff line number Diff line
@@ -504,7 +504,7 @@ qcrypto_block_luks_load_key(QCryptoBlock *block, 
     * to reset the encryption cipher every time the master

     * key crosses a sector boundary.

     */

    if (qcrypto_block_decrypt_helper(cipher,

    if (qcrypto_block_cipher_decrypt_helper(cipher,

                                            niv,

                                            ivgen,

                                            QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
@@ -636,6 +636,7 @@ qcrypto_block_luks_open(QCryptoBlock *block, 
                        QCryptoBlockReadFunc readfunc,

                        void *opaque,

                        unsigned int flags,

                        size_t n_threads,

                        Error **errp)

{

    QCryptoBlockLUKS *luks;
@@ -836,11 +837,10 @@ qcrypto_block_luks_open(QCryptoBlock *block, 
            goto fail;

        }



        block->cipher = qcrypto_cipher_new(cipheralg,

                                           ciphermode,

                                           masterkey, masterkeylen,

        ret = qcrypto_block_init_cipher(block, cipheralg, ciphermode,

                                        masterkey, masterkeylen, n_threads,

                                        errp);

        if (!block->cipher) {

        if (ret < 0) {

            ret = -ENOTSUP;

            goto fail;

        }
@@ -863,7 +863,7 @@ qcrypto_block_luks_open(QCryptoBlock *block, 


 fail:

    g_free(masterkey);

    qcrypto_cipher_free(block->cipher);

    qcrypto_block_free_cipher(block);

    qcrypto_ivgen_free(block->ivgen);

    g_free(luks);

    g_free(password);
@@ -1030,11 +1030,9 @@ qcrypto_block_luks_create(QCryptoBlock *block, 




    /* Setup the block device payload encryption objects */

    block->cipher = qcrypto_cipher_new(luks_opts.cipher_alg,

                                       luks_opts.cipher_mode,

                                       masterkey, luks->header.key_bytes,

                                       errp);

    if (!block->cipher) {

    if (qcrypto_block_init_cipher(block, luks_opts.cipher_alg,

                                  luks_opts.cipher_mode, masterkey,

                                  luks->header.key_bytes, 1, errp) < 0) {

        goto error;

    }
@@ -1219,7 +1217,7 @@ qcrypto_block_luks_create(QCryptoBlock *block, 


    /* Now we encrypt the split master key with the key generated

     * from the user's password, before storing it */

    if (qcrypto_block_encrypt_helper(cipher, block->niv, ivgen,

    if (qcrypto_block_cipher_encrypt_helper(cipher, block->niv, ivgen,

                                            QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,

                                            0,

                                            splitkey,
@@ -1341,6 +1339,9 @@ qcrypto_block_luks_create(QCryptoBlock *block, 
    qcrypto_ivgen_free(ivgen);

    qcrypto_cipher_free(cipher);



    qcrypto_block_free_cipher(block);

    qcrypto_ivgen_free(block->ivgen);



    g_free(luks);

    return -1;

}
@@ -1406,8 +1407,7 @@ qcrypto_block_luks_decrypt(QCryptoBlock *block, 
{

    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));

    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));

    return qcrypto_block_decrypt_helper(block->cipher,

                                        block->niv, block->ivgen,

    return qcrypto_block_decrypt_helper(block,

                                        QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,

                                        offset, buf, len, errp);

}
@@ -1422,8 +1422,7 @@ qcrypto_block_luks_encrypt(QCryptoBlock *block, 
{

    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));

    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));

    return qcrypto_block_encrypt_helper(block->cipher,

                                        block->niv, block->ivgen,

    return qcrypto_block_encrypt_helper(block,

                                        QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,

                                        offset, buf, len, errp);

}

crypto/block-qcow.c

+13 −13
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ qcrypto_block_qcow_has_format(const uint8_t *buf G_GNUC_UNUSED, 
static int

qcrypto_block_qcow_init(QCryptoBlock *block,

                        const char *keysecret,

                        size_t n_threads,

                        Error **errp)

{

    char *password;
@@ -71,11 +72,11 @@ qcrypto_block_qcow_init(QCryptoBlock *block, 
        goto fail;

    }



    block->cipher = qcrypto_cipher_new(QCRYPTO_CIPHER_ALG_AES_128,

    ret = qcrypto_block_init_cipher(block, QCRYPTO_CIPHER_ALG_AES_128,

                                    QCRYPTO_CIPHER_MODE_CBC,

                                    keybuf, G_N_ELEMENTS(keybuf),

                                       errp);

    if (!block->cipher) {

                                    n_threads, errp);

    if (ret < 0) {

        ret = -ENOTSUP;

        goto fail;

    }
@@ -86,7 +87,7 @@ qcrypto_block_qcow_init(QCryptoBlock *block, 
    return 0;



 fail:

    qcrypto_cipher_free(block->cipher);

    qcrypto_block_free_cipher(block);

    qcrypto_ivgen_free(block->ivgen);

    return ret;

}
@@ -99,6 +100,7 @@ qcrypto_block_qcow_open(QCryptoBlock *block, 
                        QCryptoBlockReadFunc readfunc G_GNUC_UNUSED,

                        void *opaque G_GNUC_UNUSED,

                        unsigned int flags,

                        size_t n_threads,

                        Error **errp)

{

    if (flags & QCRYPTO_BLOCK_OPEN_NO_IO) {
@@ -112,8 +114,8 @@ qcrypto_block_qcow_open(QCryptoBlock *block, 
                       optprefix ? optprefix : "");

            return -1;

        }

        return qcrypto_block_qcow_init(block,

                                       options->u.qcow.key_secret, errp);

        return qcrypto_block_qcow_init(block, options->u.qcow.key_secret,

                                       n_threads, errp);

    }

}
@@ -133,7 +135,7 @@ qcrypto_block_qcow_create(QCryptoBlock *block, 
        return -1;

    }

    /* QCow2 has no special header, since everything is hardwired */

    return qcrypto_block_qcow_init(block, options->u.qcow.key_secret, errp);

    return qcrypto_block_qcow_init(block, options->u.qcow.key_secret, 1, errp);

}
@@ -152,8 +154,7 @@ qcrypto_block_qcow_decrypt(QCryptoBlock *block, 
{

    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE));

    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE));

    return qcrypto_block_decrypt_helper(block->cipher,

                                        block->niv, block->ivgen,

    return qcrypto_block_decrypt_helper(block,

                                        QCRYPTO_BLOCK_QCOW_SECTOR_SIZE,

                                        offset, buf, len, errp);

}
@@ -168,8 +169,7 @@ qcrypto_block_qcow_encrypt(QCryptoBlock *block, 
{

    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE));

    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE));

    return qcrypto_block_encrypt_helper(block->cipher,

                                        block->niv, block->ivgen,

    return qcrypto_block_encrypt_helper(block,

                                        QCRYPTO_BLOCK_QCOW_SECTOR_SIZE,

                                        offset, buf, len, errp);

}