On 01/20/2016 10:38 AM, Daniel P. Berrange wrote: > Refuse to use images with the legacy AES-CBC encryption > format in the system emulators. They are still fully > supported in the qemu-img, qemu-io & qemu-nbd tools in > order to allow data to be liberated and for compatibility > with older QEMU versions. Continued support in these tools > is not a notable burden with the new FDE framework. > > Signed-off-by: Daniel P. Berrange <berra...@redhat.com> > ---
> +++ b/block/qcow.c
> @@ -180,6 +180,14 @@ static int qcow_open(BlockDriverState *bs, QDict
> *options, int flags,
> s->crypt_method_header = header.crypt_method;
> if (s->crypt_method_header) {
> if (s->crypt_method_header == QCOW_CRYPT_AES) {
> + if (bdrv_uses_whitelist()) {
> + error_setg(errp,
> + "Use of AES-CBC encrypted qcow images is no
> longer "
> + "supported. Please use the qcow2 LUKS format
> instead.");
error_setg() should be a single phrase with no trailing punctuation, not
two sentences. Use error_append_hint() for the suggestion of the
replacement.
> +++ b/block/qcow2.c
> @@ -1209,6 +1209,14 @@ static int qcow2_open(BlockDriverState *bs, QDict
> *options, int flags,
>
> s->crypt_method_header = header.crypt_method;
> if (s->crypt_method_header) {
> + if (bdrv_uses_whitelist() &&
> + s->crypt_method_header == QCOW_CRYPT_AES) {
> + error_setg(errp,
> + "Use of AES-CBC encrypted qcow2 images is no longer "
> + "supported. Please use the qcow2 LUKS format
> instead.");
Ditto
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
