2 * QEMU Crypto block device encryption QCow/QCow2 AES-CBC format
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22 * Note that the block encryption implemented in this file is broken
23 * by design. This exists only to allow data to be liberated from
24 * existing qcow[2] images and should not be used in any new areas.
27 #include "qemu/osdep.h"
28 #include "qapi/error.h"
30 #include "block-qcow.h"
31 #include "crypto/secret.h"
33 #define QCRYPTO_BLOCK_QCOW_SECTOR_SIZE 512
37 qcrypto_block_qcow_has_format(const uint8_t *buf G_GNUC_UNUSED
,
38 size_t buf_size G_GNUC_UNUSED
)
45 qcrypto_block_qcow_init(QCryptoBlock
*block
,
46 const char *keysecret
,
54 memset(keybuf
, 0, 16);
56 password
= qcrypto_secret_lookup_as_utf8(keysecret
, errp
);
61 len
= strlen(password
);
62 memcpy(keybuf
, password
, MIN(len
, sizeof(keybuf
)));
65 block
->niv
= qcrypto_cipher_get_iv_len(QCRYPTO_CIPHER_ALG_AES_128
,
66 QCRYPTO_CIPHER_MODE_CBC
);
67 block
->ivgen
= qcrypto_ivgen_new(QCRYPTO_IVGEN_ALG_PLAIN64
,
74 block
->cipher
= qcrypto_cipher_new(QCRYPTO_CIPHER_ALG_AES_128
,
75 QCRYPTO_CIPHER_MODE_CBC
,
76 keybuf
, G_N_ELEMENTS(keybuf
),
83 block
->sector_size
= QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
;
84 block
->payload_offset
= 0;
89 qcrypto_cipher_free(block
->cipher
);
90 qcrypto_ivgen_free(block
->ivgen
);
96 qcrypto_block_qcow_open(QCryptoBlock
*block
,
97 QCryptoBlockOpenOptions
*options
,
98 const char *optprefix
,
99 QCryptoBlockReadFunc readfunc G_GNUC_UNUSED
,
100 void *opaque G_GNUC_UNUSED
,
104 if (flags
& QCRYPTO_BLOCK_OPEN_NO_IO
) {
105 block
->sector_size
= QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
;
106 block
->payload_offset
= 0;
109 if (!options
->u
.qcow
.key_secret
) {
111 "Parameter '%skey-secret' is required for cipher",
112 optprefix
? optprefix
: "");
115 return qcrypto_block_qcow_init(block
,
116 options
->u
.qcow
.key_secret
, errp
);
122 qcrypto_block_qcow_create(QCryptoBlock
*block
,
123 QCryptoBlockCreateOptions
*options
,
124 const char *optprefix
,
125 QCryptoBlockInitFunc initfunc G_GNUC_UNUSED
,
126 QCryptoBlockWriteFunc writefunc G_GNUC_UNUSED
,
127 void *opaque G_GNUC_UNUSED
,
130 if (!options
->u
.qcow
.key_secret
) {
131 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
132 optprefix
? optprefix
: "");
135 /* QCow2 has no special header, since everything is hardwired */
136 return qcrypto_block_qcow_init(block
, options
->u
.qcow
.key_secret
, errp
);
141 qcrypto_block_qcow_cleanup(QCryptoBlock
*block
)
147 qcrypto_block_qcow_decrypt(QCryptoBlock
*block
,
153 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
));
154 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
));
155 return qcrypto_block_decrypt_helper(block
->cipher
,
156 block
->niv
, block
->ivgen
,
157 QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
,
158 offset
, buf
, len
, errp
);
163 qcrypto_block_qcow_encrypt(QCryptoBlock
*block
,
169 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
));
170 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
));
171 return qcrypto_block_encrypt_helper(block
->cipher
,
172 block
->niv
, block
->ivgen
,
173 QCRYPTO_BLOCK_QCOW_SECTOR_SIZE
,
174 offset
, buf
, len
, errp
);
178 const QCryptoBlockDriver qcrypto_block_driver_qcow
= {
179 .open
= qcrypto_block_qcow_open
,
180 .create
= qcrypto_block_qcow_create
,
181 .cleanup
= qcrypto_block_qcow_cleanup
,
182 .decrypt
= qcrypto_block_qcow_decrypt
,
183 .encrypt
= qcrypto_block_qcow_encrypt
,
184 .has_format
= qcrypto_block_qcow_has_format
,