yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
26ba25
From f560f687deba14702f4a8f6987168e2d51c5088a Mon Sep 17 00:00:00 2001
26ba25
From: Markus Armbruster <armbru@redhat.com>
26ba25
Date: Mon, 18 Jun 2018 08:43:30 +0200
26ba25
Subject: [PATCH 032/268] rbd: New parameter key-secret
26ba25
26ba25
RH-Author: Markus Armbruster <armbru@redhat.com>
26ba25
Message-id: <20180618084330.30009-24-armbru@redhat.com>
26ba25
Patchwork-id: 80727
26ba25
O-Subject: [RHEL-7.6 qemu-kvm-rhev PATCH 23/23] rbd: New parameter key-secret
26ba25
Bugzilla: 1557995
26ba25
RH-Acked-by: Max Reitz <mreitz@redhat.com>
26ba25
RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
26ba25
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
26ba25
26ba25
Legacy -drive supports "password-secret" parameter that isn't
26ba25
available with -blockdev / blockdev-add.  That's because we backed out
26ba25
our first try to provide it there due to interface design doubts, in
26ba25
commit 577d8c9a811, v2.9.0.
26ba25
26ba25
This is the second try.  It brings back the parameter, except it's
26ba25
named "key-secret" now.
26ba25
26ba25
Let's review our reasons for backing out the first try, as stated in
26ba25
the commit message:
26ba25
26ba25
    * BlockdevOptionsRbd member @password-secret isn't actually a
26ba25
      password, it's a key generated by Ceph.
26ba25
26ba25
Addressed by the rename.
26ba25
26ba25
    * We're not sure where member @password-secret belongs (see the
26ba25
      previous commit).
26ba25
26ba25
See previous commit.
26ba25
26ba25
    * How @password-secret interacts with settings from a configuration
26ba25
      file specified with @conf is undocumented.
26ba25
26ba25
Not actually true, the documentation for @conf says "Values in the
26ba25
configuration file will be overridden by options specified via QAPI",
26ba25
and we've tested this.
26ba25
26ba25
Signed-off-by: Markus Armbruster <armbru@redhat.com>
26ba25
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
26ba25
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
26ba25
(cherry picked from commit d083f954a95d37b460df0c2fbfe46ad7eb207b10)
26ba25
[Conflict due to lack of commit e8e16d4baff "rbd: Switch to byte-based
26ba25
callbacks" trivially resolved]
26ba25
26ba25
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
26ba25
---
26ba25
 block/rbd.c          | 41 +++++++++++++++++++++++++----------------
26ba25
 qapi/block-core.json |  6 ++++++
26ba25
 2 files changed, 31 insertions(+), 16 deletions(-)
26ba25
26ba25
diff --git a/block/rbd.c b/block/rbd.c
26ba25
index 9c0903f..3242bcd 100644
26ba25
--- a/block/rbd.c
26ba25
+++ b/block/rbd.c
26ba25
@@ -232,24 +232,25 @@ done:
26ba25
 }
26ba25
 
26ba25
 
26ba25
-static int qemu_rbd_set_auth(rados_t cluster, const char *secretid,
26ba25
-                             BlockdevOptionsRbd *opts,
26ba25
+static int qemu_rbd_set_auth(rados_t cluster, BlockdevOptionsRbd *opts,
26ba25
                              Error **errp)
26ba25
 {
26ba25
-    char *acr;
26ba25
+    char *key, *acr;
26ba25
     int r;
26ba25
     GString *accu;
26ba25
     RbdAuthModeList *auth;
26ba25
 
26ba25
-    if (secretid) {
26ba25
-        gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
26ba25
-                                                        errp);
26ba25
-        if (!secret) {
26ba25
-            return -1;
26ba25
+    if (opts->key_secret) {
26ba25
+        key = qcrypto_secret_lookup_as_base64(opts->key_secret, errp);
26ba25
+        if (!key) {
26ba25
+            return -EIO;
26ba25
+        }
26ba25
+        r = rados_conf_set(cluster, "key", key);
26ba25
+        g_free(key);
26ba25
+        if (r < 0) {
26ba25
+            error_setg_errno(errp, -r, "Could not set 'key'");
26ba25
+            return r;
26ba25
         }
26ba25
-
26ba25
-        rados_conf_set(cluster, "key", secret);
26ba25
-        g_free(secret);
26ba25
     }
26ba25
 
26ba25
     if (opts->has_auth_client_required) {
26ba25
@@ -360,9 +361,7 @@ static QemuOptsList runtime_opts = {
26ba25
     },
26ba25
 };
26ba25
 
26ba25
-/* FIXME Deprecate and remove keypairs or make it available in QMP.
26ba25
- * password_secret should eventually be configurable in opts->location. Support
26ba25
- * for it in .bdrv_open will make it work here as well. */
26ba25
+/* FIXME Deprecate and remove keypairs or make it available in QMP. */
26ba25
 static int qemu_rbd_do_create(BlockdevCreateOptions *options,
26ba25
                               const char *keypairs, const char *password_secret,
26ba25
                               Error **errp)
26ba25
@@ -568,6 +567,16 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
26ba25
     Error *local_err = NULL;
26ba25
     int r;
26ba25
 
26ba25
+    if (secretid) {
26ba25
+        if (opts->key_secret) {
26ba25
+            error_setg(errp,
26ba25
+                       "Legacy 'password-secret' clashes with 'key-secret'");
26ba25
+            return -EINVAL;
26ba25
+        }
26ba25
+        opts->key_secret = g_strdup(secretid);
26ba25
+        opts->has_key_secret = true;
26ba25
+    }
26ba25
+
26ba25
     mon_host = qemu_rbd_mon_host(opts, &local_err);
26ba25
     if (local_err) {
26ba25
         error_propagate(errp, local_err);
26ba25
@@ -600,8 +609,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
26ba25
         }
26ba25
     }
26ba25
 
26ba25
-    if (qemu_rbd_set_auth(*cluster, secretid, opts, errp) < 0) {
26ba25
-        r = -EIO;
26ba25
+    r = qemu_rbd_set_auth(*cluster, opts, errp);
26ba25
+    if (r < 0) {
26ba25
         goto failed_shutdown;
26ba25
     }
26ba25
 
26ba25
diff --git a/qapi/block-core.json b/qapi/block-core.json
26ba25
index d1da7d1..51eafdd 100644
26ba25
--- a/qapi/block-core.json
26ba25
+++ b/qapi/block-core.json
26ba25
@@ -3196,6 +3196,11 @@
26ba25
 #                      This maps to Ceph configuration option
26ba25
 #                      "auth_client_required".  (Since 3.0)
26ba25
 #
26ba25
+# @key-secret:         ID of a QCryptoSecret object providing a key
26ba25
+#                      for cephx authentication.
26ba25
+#                      This maps to Ceph configuration option
26ba25
+#                      "key".  (Since 3.0)
26ba25
+#
26ba25
 # @server:             Monitor host address and port.  This maps
26ba25
 #                      to the "mon_host" Ceph option.
26ba25
 #
26ba25
@@ -3208,6 +3213,7 @@
26ba25
             '*snapshot': 'str',
26ba25
             '*user': 'str',
26ba25
             '*auth-client-required': ['RbdAuthMode'],
26ba25
+            '*key-secret': 'str',
26ba25
             '*server': ['InetSocketAddressBase'] } }
26ba25
 
26ba25
 ##
26ba25
-- 
26ba25
1.8.3.1
26ba25