[libvirt] [PATCH 11/20] Add volume encryption information handling.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Define an <encryption> tag specifying volume encryption format and
format-depenedent parameters (e.g. passphrase, cipher name, key
length, key).

Currently the only defined parameter is a reference to a "secret"
(passphrase/key) managed using the virSecret* API.

Only the qcow/qcow2 encryption format, and a "default" format used to
let libvirt choose the format during volume creation, is currently
supported.

This patch does not add any users; the <encryption> tag is added in
the following patches to both volumes (to support encrypted volume
creation) and domains.

Changes since the first submission;
- Use <secret type='passphrase' secret_id='...'>
  instead of <passphrase> with in-line passphrase.
- Use a generic "sequence of secrets" representation.
- Output the <secret> elements unconditionally (they don't reveal the
  secrets any more).
- Add format "default", to be used during volume creation only.
- Use "%s", _("...") for all error messages without parameters.
- Add a schema for <encryption>.
- Document <encryption>.
---
 bootstrap                            |    1 +
 docs/format.html                     |    4 +
 docs/formatcaps.html                 |    4 +
 docs/formatdomain.html               |    4 +
 docs/formatnetwork.html              |    4 +
 docs/formatnode.html                 |    4 +
 docs/formatsecret.html               |    4 +
 docs/formatstorage.html              |    4 +
 docs/formatstorageencryption.html    |  218 ++++++++++++++++++++++++++++++
 docs/formatstorageencryption.html.in |   70 ++++++++++
 docs/schemas/Makefile.am             |    1 +
 docs/schemas/storageencryption.rng   |   37 +++++
 docs/sitemap.html                    |    3 +
 docs/sitemap.html.in                 |    4 +
 po/POTFILES.in                       |    1 +
 src/Makefile.am                      |    1 +
 src/libvirt_private.syms             |    5 +
 src/storage_encryption.c             |  241 ++++++++++++++++++++++++++++++++++
 src/storage_encryption.h             |   72 ++++++++++
 19 files changed, 682 insertions(+), 0 deletions(-)
 create mode 100644 docs/formatstorageencryption.html
 create mode 100644 docs/formatstorageencryption.html.in
 create mode 100644 docs/schemas/storageencryption.rng
 create mode 100644 src/storage_encryption.c
 create mode 100644 src/storage_encryption.h

diff --git a/bootstrap b/bootstrap
index 8b81e0e..885b299 100755
--- a/bootstrap
+++ b/bootstrap
@@ -65,6 +65,7 @@ gnulib_tool=$GNULIB_SRCDIR/gnulib-tool
 <$gnulib_tool || exit
 
 modules='
+base64
 c-ctype
 close
 connect
diff --git a/docs/format.html b/docs/format.html
index 8aed8d3..dbdc1e7 100644
--- a/docs/format.html
+++ b/docs/format.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatcaps.html b/docs/formatcaps.html
index 8e2e5d1..cb8130b 100644
--- a/docs/formatcaps.html
+++ b/docs/formatcaps.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <span class="active">Capabilities</span>
                         </div>
                       </li><li>
diff --git a/docs/formatdomain.html b/docs/formatdomain.html
index bbce989..f2d7855 100644
--- a/docs/formatdomain.html
+++ b/docs/formatdomain.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatnetwork.html b/docs/formatnetwork.html
index 6049492..87f15f7 100644
--- a/docs/formatnetwork.html
+++ b/docs/formatnetwork.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatnode.html b/docs/formatnode.html
index cca75ff..ea9c95a 100644
--- a/docs/formatnode.html
+++ b/docs/formatnode.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatsecret.html b/docs/formatsecret.html
index 8c6e0c6..53307a3 100644
--- a/docs/formatsecret.html
+++ b/docs/formatsecret.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatstorage.html b/docs/formatstorage.html
index e21e3d2..19936ae 100644
--- a/docs/formatstorage.html
+++ b/docs/formatstorage.html
@@ -64,6 +64,10 @@
                         </div>
                       </li><li>
                         <div>
+                          <a title="Storage volume encryption XML format" class="inactive" href="formatstorageencryption.html">Storage Encryption</a>
+                        </div>
+                      </li><li>
+                        <div>
                           <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
                         </div>
                       </li><li>
diff --git a/docs/formatstorageencryption.html b/docs/formatstorageencryption.html
new file mode 100644
index 0000000..dd7add2
--- /dev/null
+++ b/docs/formatstorageencryption.html
@@ -0,0 +1,218 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
+<html xmlns="http://www.w3.org/1999/xhtml";>
+<!--
+        This file is autogenerated from formatstorageencryption.html.in
+        Do not edit this file. Changes will be lost.
+      -->
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
+    <link rel="stylesheet" type="text/css" href="main.css" />
+    <link rel="SHORTCUT ICON" href="32favicon.png" />
+    <title>libvirt: Storage volume encryption XML format</title>
+    <meta name="description" content="libvirt, virtualization, virtualization API" />
+  </head>
+  <body>
+    <div id="header">
+      <div id="headerLogo"></div>
+      <div id="headerSearch">
+        <form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><div>
+            <input id="query" name="query" type="text" size="12" value="" />
+            <input id="submit" name="submit" type="submit" value="Search" />
+          </div></form>
+      </div>
+    </div>
+    <div id="body">
+      <div id="menu">
+        <ul class="l0"><li>
+            <div>
+              <a title="Front page of the libvirt website" class="inactive" href="index.html">Home</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Details of new features and bugs fixed in each release" class="inactive" href="news.html">News</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Get the latest source releases, binary builds and get access to the source repository" class="inactive" href="downloads.html">Downloads</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Information for users, administrators and developers" class="active" href="docs.html">Documentation</a>
+              <ul class="l1"><li>
+                  <div>
+                    <a title="Information about deploying and using libvirt" class="inactive" href="deployment.html">Deployment</a>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Overview of the logical subsystems in the libvirt API" class="inactive" href="intro.html">Architecture</a>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Description of the XML formats used in libvirt" class="active" href="format.html">XML format</a>
+                    <ul class="l2"><li>
+                        <div>
+                          <a title="The domain XML format" class="inactive" href="formatdomain.html">Domains</a>
+                        </div>
+                      </li><li>
+                        <div>
+                          <a title="The virtual network XML format" class="inactive" href="formatnetwork.html">Networks</a>
+                        </div>
+                      </li><li>
+                        <div>
+                          <a title="The storage pool and volume XML format" class="inactive" href="formatstorage.html">Storage</a>
+                        </div>
+                      </li><li>
+                        <div>
+                          <span class="active">Storage Encryption</span>
+                        </div>
+                      </li><li>
+                        <div>
+                          <a title="The driver capabilities XML format" class="inactive" href="formatcaps.html">Capabilities</a>
+                        </div>
+                      </li><li>
+                        <div>
+                          <a title="The host device XML format" class="inactive" href="formatnode.html">Node Devices</a>
+                        </div>
+                      </li><li>
+                        <div>
+                          <a title="The secret attribute XML format" class="inactive" href="formatsecret.html">Secrets</a>
+                        </div>
+                      </li></ul>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Hypervisor specific driver information" class="inactive" href="drivers.html">Drivers</a>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Reference manual for the C public API" class="inactive" href="html/index.html">API reference</a>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Bindings of the libvirt API for other languages" class="inactive" href="bindings.html">Language bindings</a>
+                  </div>
+                </li><li>
+                  <div>
+                    <a title="Working on the internals of libvirt API, driver and daemon code" class="inactive" href="internals.html">Internals</a>
+                  </div>
+                </li></ul>
+            </div>
+          </li><li>
+            <div>
+              <a title="User contributed content" class="inactive" href="http://wiki.libvirt.org";>Wiki</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Frequently asked questions" class="inactive" href="FAQ.html">FAQ</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="How and where to report bugs and request features" class="inactive" href="bugs.html">Bug reports</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="How to contact the developers via email and IRC" class="inactive" href="contact.html">Contact</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Miscellaneous links of interest related to libvirt" class="inactive" href="relatedlinks.html">Related Links</a>
+            </div>
+          </li><li>
+            <div>
+              <a title="Overview of all content on the website" class="inactive" href="sitemap.html">Sitemap</a>
+            </div>
+          </li></ul>
+      </div>
+      <div id="content">
+        <h1>Storage volume encryption XML format</h1>
+        <ul><li>
+            <a href="#StorageEncryption">Storage volume encryption XML</a>
+            <ul><li>
+                <a href="#StorageEncryptionUnencrypted">"unencrypted" format</a>
+              </li><li>
+                <a href="#StorageEncryptionDefault">"default" format</a>
+              </li><li>
+                <a href="#StorageEncryptionQcow">"qcow" format</a>
+              </li></ul>
+          </li><li>
+            <a href="#example">Example</a>
+          </li></ul>
+        <h2>
+          <a name="StorageEncryption" id="StorageEncryption">Storage volume encryption XML</a>
+        </h2>
+        <p>
+      Storage volumes may be encrypted, the XML snippet described below is used
+      to represent the details of the encryption.  It can be used as a part
+      of a domain or storage configuration.
+    </p>
+        <p>
+      The top-level tag of volume encryption specification
+      is <code>encryption</code>, with a mandatory
+      attribute <code>format</code>.  Currently defined values
+      of <code>format</code> are <code>unencrypted</code>, <code>default</code>
+      and <code>qcow</code>.  Each value of <code>format</code> implies some
+      expectations about the content of the <code>encryption</code> tag.  Other
+      format values may be defined in the future.
+    </p>
+        <p>
+      The <code>encryption</code> tag can currently contain a sequence of
+      <code>secret</code> tags, each with mandatory attributes <code>type</code>
+      and <code>secret_id</code>.  The only currently defined value of
+      <code>type</code> is <code>passphrase</code>.  <code>secret_id</code>
+      refers to a secret known to libvirt.  libvirt can use a secret value
+      previously set using <code>virSecretSetValue()</code>, or, if supported
+      by the particular volume format and driver, automatically generate a
+      secret value at the time of volume creation, and store it using the
+      specified <code>secret_id</code>.
+    </p>
+        <p>
+    </p>
+        <h3>
+          <a name="StorageEncryptionUnencrypted" id="StorageEncryptionUnencrypted">"unencrypted" format</a>
+        </h3>
+        <p>
+      Specifying an <code>&lt;encryption type="unencrypted"/&gt;</code> is
+      equivalent to omitting the <code>encryption</code> tag altogether.
+    </p>
+        <h3>
+          <a name="StorageEncryptionDefault" id="StorageEncryptionDefault">"default" format</a>
+        </h3>
+        <p>
+      <code>&lt;encryption type="default"/&gt;</code> can be specified only
+      when creating a volume.  If the volume is successfully created, the
+      encryption formats, parameters and secrets will be auto-generated by
+      libvirt and the attached <code>encryption</code> tag will be updated.
+      The unmodified contents of the <code>encryption</code> tag can be used
+      in later operations with the volume, or when setting up a domain that
+      uses the volume.
+    </p>
+        <h3>
+          <a name="StorageEncryptionQcow" id="StorageEncryptionQcow">"qcow" format</a>
+        </h3>
+        <p>
+      The <code>qcow</code> format specifies that the built-in encryption
+      support in <code>qcow</code>- or <code>qcow2</code>-formatted volume
+      images should be used.  A single
+      <code>&lt;secret type='passphrase'&gt;</code> element is expected.  If
+      the <code>secret</code> element is not present during volume creation,
+      a secret is automatically generated and attached to the volume.
+    </p>
+        <h2>
+          <a name="example" id="example">Example</a>
+        </h2>
+        <p>
+      Here is a simple example, specifying use of the <code>qcow</code> format:
+    </p>
+        <pre>
+      &lt;encryption format='qcow'&gt;
+         &lt;secret type='passphrase' secret_id='c1f11a6d-8c5d-4a3e-ac7a-4e171c5e0d4a' /&gt;
+      &lt;/encryption&gt;</pre>
+      </div>
+    </div>
+    <div id="footer">
+      <p id="sponsor">
+	    Sponsored by:<br /><a href="http://et.redhat.com/";><img src="et.png" alt="Project sponsored by Red Hat Emerging Technology" /></a></p>
+    </div>
+  </body>
+</html>
diff --git a/docs/formatstorageencryption.html.in b/docs/formatstorageencryption.html.in
new file mode 100644
index 0000000..739b018
--- /dev/null
+++ b/docs/formatstorageencryption.html.in
@@ -0,0 +1,70 @@
+<html>
+  <body>
+    <h1>Storage volume encryption XML format</h1>
+
+    <ul id="toc"></ul>
+
+    <h2><a name="StorageEncryption">Storage volume encryption XML</a></h2>
+
+    <p>
+      Storage volumes may be encrypted, the XML snippet described below is used
+      to represent the details of the encryption.  It can be used as a part
+      of a domain or storage configuration.
+    </p>
+    <p>
+      The top-level tag of volume encryption specification
+      is <code>encryption</code>, with a mandatory
+      attribute <code>format</code>.  Currently defined values
+      of <code>format</code> are <code>unencrypted</code>, <code>default</code>
+      and <code>qcow</code>.  Each value of <code>format</code> implies some
+      expectations about the content of the <code>encryption</code> tag.  Other
+      format values may be defined in the future.
+    </p>
+    <p>
+      The <code>encryption</code> tag can currently contain a sequence of
+      <code>secret</code> tags, each with mandatory attributes <code>type</code>
+      and <code>secret_id</code>.  The only currently defined value of
+      <code>type</code> is <code>passphrase</code>.  <code>secret_id</code>
+      refers to a secret known to libvirt.  libvirt can use a secret value
+      previously set using <code>virSecretSetValue()</code>, or, if supported
+      by the particular volume format and driver, automatically generate a
+      secret value at the time of volume creation, and store it using the
+      specified <code>secret_id</code>.
+    <p>
+    <h3><a name="StorageEncryptionUnencrypted">"unencrypted" format</a></h3>
+    <p>
+      Specifying an <code>&lt;encryption type="unencrypted"/&gt;</code> is
+      equivalent to omitting the <code>encryption</code> tag altogether.
+    </p>
+    <h3><a name="StorageEncryptionDefault">"default" format</a></h3>
+    <p>
+      <code>&lt;encryption type="default"/&gt;</code> can be specified only
+      when creating a volume.  If the volume is successfully created, the
+      encryption formats, parameters and secrets will be auto-generated by
+      libvirt and the attached <code>encryption</code> tag will be updated.
+      The unmodified contents of the <code>encryption</code> tag can be used
+      in later operations with the volume, or when setting up a domain that
+      uses the volume.
+    </p>
+    <h3><a name="StorageEncryptionQcow">"qcow" format</a></h3>
+    <p>
+      The <code>qcow</code> format specifies that the built-in encryption
+      support in <code>qcow</code>- or <code>qcow2</code>-formatted volume
+      images should be used.  A single
+      <code>&lt;secret type='passphrase'&gt;</code> element is expected.  If
+      the <code>secret</code> element is not present during volume creation,
+      a secret is automatically generated and attached to the volume.
+    </p>
+
+    <h2><a name="example">Example</a></h2>
+
+    <p>
+      Here is a simple example, specifying use of the <code>qcow</code> format:
+    </p>
+
+    <pre>
+      &lt;encryption format='qcow'&gt;
+         &lt;secret type='passphrase' secret_id='c1f11a6d-8c5d-4a3e-ac7a-4e171c5e0d4a' /&gt;
+      &lt;/encryption&gt;</pre>
+  </body>
+</html>
diff --git a/docs/schemas/Makefile.am b/docs/schemas/Makefile.am
index a064518..c217d69 100644
--- a/docs/schemas/Makefile.am
+++ b/docs/schemas/Makefile.am
@@ -6,6 +6,7 @@ schema_DATA = \
 	interface.rng \
 	network.rng \
 	secret.rng \
+	storageencryption.rng \
 	storagepool.rng \
 	storagevol.rng \
 	nodedev.rng \
diff --git a/docs/schemas/storageencryption.rng b/docs/schemas/storageencryption.rng
new file mode 100644
index 0000000..69a2841
--- /dev/null
+++ b/docs/schemas/storageencryption.rng
@@ -0,0 +1,37 @@
+<!-- A Relax NG schema for the libvirt volume encryption XML format -->
+<grammar xmlns="http://relaxng.org/ns/structure/1.0";
+    datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes";>
+
+  <define name='encryption'>
+    <optional>
+      <element name='encryption'>
+	<attribute name='format'>
+	  <choice>
+	    <value>unencrypted</value>
+	    <value>default</value>
+	    <value>qcow</value>
+	  </choice>
+	</attribute>
+	<zeroOrMore>
+	  <ref name='secret'/>
+	</zeroOrMore>
+      </element>
+    </optional>
+  </define>
+
+  <define name='secret'>
+    <element name='secret'>
+      <attribute name='type'>
+	<choice>
+	  <value>passphrase</value>
+	</choice>
+      </attribute>
+      <optional>
+        <attribute name='secret_id'>
+          <text/>
+        </attribute>
+      </optional>
+    </element>
+  </define>
+
+</grammar>
diff --git a/docs/sitemap.html b/docs/sitemap.html
index cf43088..21516be 100644
--- a/docs/sitemap.html
+++ b/docs/sitemap.html
@@ -136,6 +136,9 @@
                 <a href="formatstorage.html">Storage</a>
                 <span>The storage pool and volume XML format</span>
               </li><li>
+                <a href="formatstorageencryption.html">Storage Encryption</a>
+                <span>Storage volume encryption XML format</span>
+              </li><li>
                 <a href="formatcaps.html">Capabilities</a>
                 <span>The driver capabilities XML format</span>
               </li><li>
diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in
index 4c4dfa4..cb0cb89 100644
--- a/docs/sitemap.html.in
+++ b/docs/sitemap.html.in
@@ -99,6 +99,10 @@
                 <span>The storage pool and volume XML format</span>
               </li>
               <li>
+                <a href="formatstorageencryption.html">Storage Encryption</a>
+                <span>Storage volume encryption XML format</span>
+              </li>
+              <li>
                 <a href="formatcaps.html">Capabilities</a>
                 <span>The driver capabilities XML format</span>
               </li>
diff --git a/po/POTFILES.in b/po/POTFILES.in
index cf0ec8d..36b83a2 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -40,6 +40,7 @@ src/storage_backend_logical.c
 src/storage_backend_scsi.c
 src/storage_conf.c
 src/storage_driver.c
+src/storage_encryption.c
 src/test.c
 src/uml_conf.c
 src/uml_driver.c
diff --git a/src/Makefile.am b/src/Makefile.am
index ce33695..2c1c9b4 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -52,6 +52,7 @@ UTIL_SOURCES =							\
 		memory.c memory.h				\
 		pci.c pci.h					\
 		qparams.c qparams.h				\
+		storage_encryption.h storage_encryption.c	\
 		threads.c threads.h				\
 		threads-pthread.h				\
 		threads-win32.h					\
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 343a71e..de4e413 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -332,6 +332,11 @@ virStoragePartedFsTypeTypeToString;
 virStoragePoolObjLock;
 virStoragePoolObjUnlock;
 
+virStorageEncryptionFree;
+virStorageEncryptionDropSecrets;
+virStorageEncryptionParseNode;
+virStorageEncryptionFormat;
+
 
 # threads.h
 virMutexInit;
diff --git a/src/storage_encryption.c b/src/storage_encryption.c
new file mode 100644
index 0000000..15caafd
--- /dev/null
+++ b/src/storage_encryption.c
@@ -0,0 +1,241 @@
+/*
+ * storage_encryption.h: volume encryption information
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+ *
+ * Red Hat Author: Miloslav TrmaÄ? <mitr@xxxxxxxxxx>
+ */
+
+#include <config.h>
+
+#include "internal.h"
+
+#include "base64.h"
+#include "buf.h"
+#include "memory.h"
+#include "storage_conf.h"
+#include "storage_encryption.h"
+#include "util.h"
+#include "xml.h"
+#include "virterror_internal.h"
+
+#define VIR_FROM_THIS VIR_FROM_STORAGE
+
+VIR_ENUM_IMPL(virStorageEncryptionSecretType,
+              VIR_STORAGE_ENCRYPTION_SECRET_TYPE_LAST, "passphrase")
+
+VIR_ENUM_IMPL(virStorageEncryptionFormat,
+              VIR_STORAGE_ENCRYPTION_FORMAT_LAST,
+              "unencrypted", "default", "qcow")
+
+static void
+virStorageEncryptionSecretFree(virStorageEncryptionSecretPtr secret)
+{
+    if (!secret)
+        return;
+    VIR_FREE(secret->secret_id);
+    VIR_FREE(secret);
+}
+
+void
+virStorageEncryptionFree(virStorageEncryptionPtr enc)
+{
+    size_t i;
+
+    if (!enc)
+        return;
+
+    for (i = 0; i < enc->nsecrets; i++)
+        virStorageEncryptionSecretFree(enc->secrets[i]);
+    VIR_FREE(enc->secrets);
+    VIR_FREE(enc);
+}
+
+static virStorageEncryptionSecretPtr
+virStorageEncryptionSecretParse(virConnectPtr conn, xmlXPathContextPtr ctxt,
+                                xmlNodePtr node)
+{
+    xmlNodePtr old_node;
+    virStorageEncryptionSecretPtr ret;
+    char *type_str;
+    int type;
+
+    if (VIR_ALLOC(ret) < 0) {
+        virReportOOMError(conn);
+        return NULL;
+    }
+
+    old_node = ctxt->node;
+    ctxt->node = node;
+
+    type_str = virXPathString(conn, "string(./@type)", ctxt);
+    if (type_str == NULL) {
+        virStorageReportError(conn, VIR_ERR_XML_ERROR, "%s",
+                              _("unknown volume encryption secret type"));
+        goto cleanup;
+    }
+    type = virStorageEncryptionSecretTypeTypeFromString(type_str);
+    if (type < 0) {
+        virStorageReportError(conn, VIR_ERR_XML_ERROR,
+                              _("unknown volume encryption secret type %s"),
+                              type_str);
+        VIR_FREE(type_str);
+        goto cleanup;
+    }
+    VIR_FREE(type_str);
+    ret->type = type;
+
+    ret->secret_id = virXPathString(conn, "string(./@secret_id)", ctxt);
+    ctxt->node = old_node;
+    return ret;
+
+  cleanup:
+    virStorageEncryptionSecretFree(ret);
+    ctxt->node = old_node;
+    return NULL;
+}
+
+static virStorageEncryptionPtr
+virStorageEncryptionParseXML(virConnectPtr conn, xmlXPathContextPtr ctxt)
+{
+    xmlNodePtr *nodes = NULL;
+    virStorageEncryptionPtr ret;
+    char *format_str;
+    int format, i, n;
+
+    if (VIR_ALLOC(ret) < 0) {
+        virReportOOMError(conn);
+        return NULL;
+    }
+
+    format_str = virXPathString(conn, "string(./@format)", ctxt);
+    if (format_str == NULL) {
+        virStorageReportError(conn, VIR_ERR_XML_ERROR, "%s",
+                              _("unknown volume encryption format"));
+        goto cleanup;
+    }
+    format = virStorageEncryptionFormatTypeFromString(format_str);
+    if (format < 0) {
+        virStorageReportError(conn, VIR_ERR_XML_ERROR,
+                              _("unknown volume encryption format type %s"),
+                              format_str);
+        VIR_FREE(format_str);
+        goto cleanup;
+    }
+    VIR_FREE(format_str);
+    ret->format = format;
+
+    n = virXPathNodeSet(conn, "./secret", ctxt, &nodes);
+    if (n < 0){
+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s",
+                              _("cannot extract volume encryption secrets"));
+        goto cleanup;
+    }
+    if (n != 0 && VIR_ALLOC_N(ret->secrets, n) < 0) {
+        virReportOOMError(conn);
+        goto cleanup;
+    }
+    ret->nsecrets = n;
+    for (i = 0; i < n; i++) {
+        ret->secrets[i] = virStorageEncryptionSecretParse(conn, ctxt, nodes[i]);
+        if (ret->secrets[i] == NULL)
+            goto cleanup;
+    }
+    VIR_FREE(nodes);
+
+    return ret;
+
+  cleanup:
+    VIR_FREE(nodes);
+    virStorageEncryptionFree(ret);
+    return NULL;
+}
+
+virStorageEncryptionPtr
+virStorageEncryptionParseNode(virConnectPtr conn,
+                              xmlDocPtr xml, xmlNodePtr root)
+{
+    xmlXPathContextPtr ctxt = NULL;
+    virStorageEncryptionPtr enc = NULL;
+
+    if (STRNEQ((const char *) root->name, "encryption")) {
+        virStorageReportError(conn, VIR_ERR_XML_ERROR,
+                              "%s", _("unknown root element for volume "
+                                      "encryption information"));
+        goto cleanup;
+    }
+
+    ctxt = xmlXPathNewContext(xml);
+    if (ctxt == NULL) {
+        virReportOOMError(conn);
+        goto cleanup;
+    }
+
+    ctxt->node = root;
+    enc = virStorageEncryptionParseXML(conn, ctxt);
+
+  cleanup:
+    xmlXPathFreeContext(ctxt);
+    return enc;
+}
+
+static int
+virStorageEncryptionSecretFormat(virConnectPtr conn,
+                                 virBufferPtr buf,
+                                 virStorageEncryptionSecretPtr secret)
+{
+    const char *type;
+
+    type = virStorageEncryptionSecretTypeTypeToString(secret->type);
+    if (!type) {
+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s",
+                              _("unexpected volume encryption secret type"));
+        return -1;
+    }
+
+    virBufferVSprintf(buf, "    <secret type='%s'", type);
+    if (secret->secret_id != NULL)
+      virBufferEscapeString(buf, " secret_id='%s'", secret->secret_id);
+    virBufferAddLit(buf, "/>\n");
+    return 0;
+}
+
+int
+virStorageEncryptionFormat(virConnectPtr conn,
+                           virBufferPtr buf,
+                           virStorageEncryptionPtr enc)
+{
+    const char *format;
+    size_t i;
+
+    format = virStorageEncryptionFormatTypeToString(enc->format);
+    if (!format) {
+        virStorageReportError(conn, VIR_ERR_INTERNAL_ERROR,
+                              "%s", _("unexpected encryption format"));
+        return -1;
+    }
+    virBufferVSprintf(buf, "  <encryption format='%s'>\n", format);
+
+    for (i = 0; i < enc->nsecrets; i++) {
+      if (virStorageEncryptionSecretFormat(conn, buf, enc->secrets[i]) < 0)
+        return -1;
+    }
+
+    virBufferAddLit(buf, "  </encryption>\n");
+
+    return 0;
+}
diff --git a/src/storage_encryption.h b/src/storage_encryption.h
new file mode 100644
index 0000000..3153ec8
--- /dev/null
+++ b/src/storage_encryption.h
@@ -0,0 +1,72 @@
+/*
+ * storage_encryption.h: volume encryption information
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+ *
+ * Red Hat Author: Miloslav TrmaÄ? <mitr@xxxxxxxxxx>
+ */
+
+#ifndef __VIR_STORAGE_ENCRYPTION_H__
+#define __VIR_STORAGE_ENCRYPTION_H__
+
+#include "internal.h"
+#include "buf.h"
+#include "util.h"
+
+#include <stdbool.h>
+#include <libxml/tree.h>
+
+enum virStorageEncryptionSecretType {
+    VIR_STORAGE_ENCRYPTION_SECRET_TYPE_PASSPHRASE = 0,
+
+    VIR_STORAGE_ENCRYPTION_SECRET_TYPE_LAST
+};
+VIR_ENUM_DECL(virStorageEncryptionSecretType)
+
+typedef struct _virStorageEncryptionSecret virStorageEncryptionSecret;
+typedef virStorageEncryptionSecret *virStorageEncryptionSecretPtr;
+struct _virStorageEncryptionSecret {
+    int type;                   /* enum virStorageEncryptionSecretType */
+    char *secret_id;
+};
+
+enum virStorageEncryptionFormat {
+    VIR_STORAGE_ENCRYPTION_FORMAT_UNENCRYPTED = 0,
+    VIR_STORAGE_ENCRYPTION_FORMAT_DEFAULT, /* Only valid for volume creation */
+    VIR_STORAGE_ENCRYPTION_FORMAT_QCOW, /* Both qcow and qcow2 */
+
+    VIR_STORAGE_ENCRYPTION_FORMAT_LAST,
+};
+VIR_ENUM_DECL(virStorageEncryptionFormat)
+
+typedef struct _virStorageEncryption virStorageEncryption;
+typedef virStorageEncryption *virStorageEncryptionPtr;
+struct _virStorageEncryption {
+    int format;            /* enum virStorageEncryptionFormat */
+
+    size_t nsecrets;
+    virStorageEncryptionSecretPtr *secrets;
+};
+
+void virStorageEncryptionFree(virStorageEncryptionPtr enc);
+virStorageEncryptionPtr virStorageEncryptionParseNode(virConnectPtr conn,
+                                                      xmlDocPtr xml,
+                                                      xmlNodePtr root);
+int virStorageEncryptionFormat(virConnectPtr conn, virBufferPtr buf,
+                               virStorageEncryptionPtr enc);
+
+#endif /* __VIR_STORAGE_ENCRYPTION_H__ */
-- 
1.6.2.5

--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]