Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-03-05 Thread Maxim Levitsky
On Tue, 2020-03-03 at 11:18 +0200, Maxim Levitsky wrote: > On Sat, 2020-02-15 at 15:51 +0100, Markus Armbruster wrote: > > Review of this patch led to a lengthy QAPI schema design discussion. > > Let me try to condense it into a concrete proposal. > > > > This is about the QAPI schema, and therefo

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-03-03 Thread Maxim Levitsky
On Sat, 2020-02-15 at 15:51 +0100, Markus Armbruster wrote: > Review of this patch led to a lengthy QAPI schema design discussion. > Let me try to condense it into a concrete proposal. > > This is about the QAPI schema, and therefore about QMP. The > human-friendly interface is out of scope. Not

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-25 Thread Max Reitz
On 15.02.20 15:51, Markus Armbruster wrote: > Review of this patch led to a lengthy QAPI schema design discussion. > Let me try to condense it into a concrete proposal. > > This is about the QAPI schema, and therefore about QMP. The > human-friendly interface is out of scope. Not because it's no

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-24 Thread Maxim Levitsky
On Mon, 2020-02-24 at 14:46 +, Daniel P. Berrangé wrote: > On Mon, Feb 17, 2020 at 01:07:23PM +0200, Maxim Levitsky wrote: > > On Mon, 2020-02-17 at 11:37 +0100, Kevin Wolf wrote: > > > Am 15.02.2020 um 15:51 hat Markus Armbruster geschrieben: > > > > Review of this patch led to a lengthy QAPI

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-24 Thread Daniel P . Berrangé
On Mon, Feb 17, 2020 at 01:07:23PM +0200, Maxim Levitsky wrote: > On Mon, 2020-02-17 at 11:37 +0100, Kevin Wolf wrote: > > Am 15.02.2020 um 15:51 hat Markus Armbruster geschrieben: > > > Review of this patch led to a lengthy QAPI schema design discussion. > > > Let me try to condense it into a conc

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-24 Thread Daniel P . Berrangé
On Sat, Feb 15, 2020 at 03:51:46PM +0100, Markus Armbruster wrote: > Review of this patch led to a lengthy QAPI schema design discussion. > Let me try to condense it into a concrete proposal. > > This is about the QAPI schema, and therefore about QMP. The > human-friendly interface is out of scop

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-17 Thread Maxim Levitsky
On Mon, 2020-02-17 at 11:37 +0100, Kevin Wolf wrote: > Am 15.02.2020 um 15:51 hat Markus Armbruster geschrieben: > > Review of this patch led to a lengthy QAPI schema design discussion. > > Let me try to condense it into a concrete proposal. > > > > This is about the QAPI schema, and therefore abo

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-17 Thread Kevin Wolf
Am 15.02.2020 um 15:51 hat Markus Armbruster geschrieben: > Review of this patch led to a lengthy QAPI schema design discussion. > Let me try to condense it into a concrete proposal. > > This is about the QAPI schema, and therefore about QMP. The > human-friendly interface is out of scope. Not b

Re: QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-16 Thread Maxim Levitsky
On Sat, 2020-02-15 at 15:51 +0100, Markus Armbruster wrote: > Review of this patch led to a lengthy QAPI schema design discussion. > Let me try to condense it into a concrete proposal. > > This is about the QAPI schema, and therefore about QMP. The > human-friendly interface is out of scope. Not

QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-15 Thread Markus Armbruster
Review of this patch led to a lengthy QAPI schema design discussion. Let me try to condense it into a concrete proposal. This is about the QAPI schema, and therefore about QMP. The human-friendly interface is out of scope. Not because it's not important (it clearly is!), only because we need to

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Maxim Levitsky
On Thu, 2020-02-06 at 16:19 +0100, Markus Armbruster wrote: > Kevin Wolf writes: > > > Am 06.02.2020 um 14:36 hat Daniel P. Berrangé geschrieben: > > > On Thu, Feb 06, 2020 at 02:20:11PM +0100, Markus Armbruster wrote: > > > > One more question regarding the array in > > > > > > > > { 'struc

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Markus Armbruster
Kevin Wolf writes: > Am 06.02.2020 um 14:36 hat Daniel P. Berrangé geschrieben: >> On Thu, Feb 06, 2020 at 02:20:11PM +0100, Markus Armbruster wrote: >> > One more question regarding the array in >> > >> > { 'struct': 'QCryptoBlockAmendOptionsLUKS', >> > 'data' : { >> >

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Kevin Wolf
Am 06.02.2020 um 14:36 hat Daniel P. Berrangé geschrieben: > On Thu, Feb 06, 2020 at 02:20:11PM +0100, Markus Armbruster wrote: > > One more question regarding the array in > > > > { 'struct': 'QCryptoBlockAmendOptionsLUKS', > > 'data' : { > > 'keys': ['LUKSKeyslotUpdate'

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Max Reitz
On 06.02.20 14:49, Daniel P. Berrangé wrote: > On Thu, Feb 06, 2020 at 02:44:45PM +0100, Markus Armbruster wrote: >> Markus Armbruster writes: >> >>> Kevin Wolf writes: >>> Am 05.02.2020 um 11:03 hat Markus Armbruster geschrieben: > Kevin Wolf writes: >> [...] >> Adding a key gets m

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Daniel P . Berrangé
On Thu, Feb 06, 2020 at 02:44:45PM +0100, Markus Armbruster wrote: > Markus Armbruster writes: > > > Kevin Wolf writes: > > > >> Am 05.02.2020 um 11:03 hat Markus Armbruster geschrieben: > >>> Kevin Wolf writes: > [...] > >>> > Adding a key gets more complicated with your proposed interface bec

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Markus Armbruster
Markus Armbruster writes: > Kevin Wolf writes: > >> Am 05.02.2020 um 11:03 hat Markus Armbruster geschrieben: >>> Kevin Wolf writes: [...] >>> > Adding a key gets more complicated with your proposed interface because >>> > state must be set explicitly now whereas before it was derived >>> > aut

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Daniel P . Berrangé
On Thu, Feb 06, 2020 at 02:20:11PM +0100, Markus Armbruster wrote: > One more question regarding the array in > > { 'struct': 'QCryptoBlockAmendOptionsLUKS', > 'data' : { > 'keys': ['LUKSKeyslotUpdate'], > '*unlock-secret' : 'str' } } > > Why an array?

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-06 Thread Markus Armbruster
One more question regarding the array in { 'struct': 'QCryptoBlockAmendOptionsLUKS', 'data' : { 'keys': ['LUKSKeyslotUpdate'], '*unlock-secret' : 'str' } } Why an array? Do we really need multiple keyslot updates in one amend operation?

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Markus Armbruster
Daniel P. Berrangé writes: > On Wed, Feb 05, 2020 at 10:30:11AM +0100, Kevin Wolf wrote: >> Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: >> > Daniel, Kevin, any comments or objections to the QAPI schema design >> > sketch developed below? >> > >> > For your convenience, here's the r

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Markus Armbruster
Kevin Wolf writes: > Am 05.02.2020 um 11:03 hat Markus Armbruster geschrieben: >> Kevin Wolf writes: >> >> > Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: >> >> Daniel, Kevin, any comments or objections to the QAPI schema design >> >> sketch developed below? >> >> >> >> For your co

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Kevin Wolf
Am 05.02.2020 um 11:03 hat Markus Armbruster geschrieben: > Kevin Wolf writes: > > > Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: > >> Daniel, Kevin, any comments or objections to the QAPI schema design > >> sketch developed below? > >> > >> For your convenience, here's the result a

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Daniel P . Berrangé
On Wed, Feb 05, 2020 at 10:30:11AM +0100, Kevin Wolf wrote: > Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: > > Daniel, Kevin, any comments or objections to the QAPI schema design > > sketch developed below? > > > > For your convenience, here's the result again: > > > > { 'enum':

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Markus Armbruster
Kevin Wolf writes: > Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: >> Daniel, Kevin, any comments or objections to the QAPI schema design >> sketch developed below? >> >> For your convenience, here's the result again: >> >> { 'enum': 'LUKSKeyslotState', >> 'data': [ 'activ

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Kevin Wolf
Am 05.02.2020 um 09:24 hat Markus Armbruster geschrieben: > Daniel, Kevin, any comments or objections to the QAPI schema design > sketch developed below? > > For your convenience, here's the result again: > > { 'enum': 'LUKSKeyslotState', > 'data': [ 'active', 'inactive' ] } > { 'st

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-02-05 Thread Markus Armbruster
Daniel, Kevin, any comments or objections to the QAPI schema design sketch developed below? For your convenience, here's the result again: { 'enum': 'LUKSKeyslotState', 'data': [ 'active', 'inactive' ] } { 'struct': 'LUKSKeyslotActive', 'data': { 'secret': 'str',

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Markus Armbruster
Daniel P. Berrangé writes: > On Thu, Jan 30, 2020 at 03:47:00PM +0100, Markus Armbruster wrote: >> Daniel P. Berrangé writes: >> >> > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: >> >> Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: >> >> > On Tue, Jan 28, 2020 at 05:1

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Maxim Levitsky
On Thu, 2020-01-30 at 15:47 +0100, Markus Armbruster wrote: > Daniel P. Berrangé writes: > > > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: > > > Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > > > > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: >

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Daniel P . Berrangé
On Thu, Jan 30, 2020 at 03:47:00PM +0100, Markus Armbruster wrote: > Daniel P. Berrangé writes: > > > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: > >> Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > >> > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wro

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Markus Armbruster
Kevin Wolf writes: > Am 30.01.2020 um 13:53 hat Daniel P. Berrangé geschrieben: [...] >> Personally I really don't like the idea of using "new-secret:null" >> as a way to request deletion of a keyslot. That's too magical >> for an action that is so dangerous to data IMhO. >> >> I think of these

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Markus Armbruster
Daniel P. Berrangé writes: > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: >> Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: >> > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: >> > > On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: >>

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Daniel P . Berrangé
On Thu, Jan 30, 2020 at 03:23:10PM +0100, Kevin Wolf wrote: > Am 30.01.2020 um 13:53 hat Daniel P. Berrangé geschrieben: > > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: > > > Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > > > > On Tue, Jan 28, 2020 at 05:11:16PM +,

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Kevin Wolf
Am 30.01.2020 um 13:53 hat Daniel P. Berrangé geschrieben: > On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: > > Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > > > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: > > > > On Tue, Jan 21, 2020 at 03:13:01P

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Maxim Levitsky
On Tue, 2020-01-28 at 17:21 +, Daniel P. Berrangé wrote: > On Tue, Jan 14, 2020 at 09:33:39PM +0200, Maxim Levitsky wrote: > > Next few patches will expose that functionality > > to the user. > > > > Signed-off-by: Maxim Levitsky > > --- > > crypto/block-luks.c | 374

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Daniel P . Berrangé
On Thu, Jan 30, 2020 at 01:38:47PM +0100, Kevin Wolf wrote: > Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: > > > On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: > > > > On Tue, 2020-01-21 at 08:54

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-30 Thread Kevin Wolf
Am 28.01.2020 um 18:32 hat Daniel P. Berrangé geschrieben: > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: > > On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: > > > On Tue, 2020-01-21 at 08:54 +0100, Markus Armbruster wrote: > > > > > > > > > > > > > > +## >

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-29 Thread Maxim Levitsky
On Tue, 2020-01-28 at 17:32 +, Daniel P. Berrangé wrote: > On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: > > On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: > > > On Tue, 2020-01-21 at 08:54 +0100, Markus Armbruster wrote: > > > > > > > > > > > > > > +##

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-28 Thread Daniel P . Berrangé
On Tue, Jan 28, 2020 at 05:11:16PM +, Daniel P. Berrangé wrote: > On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: > > On Tue, 2020-01-21 at 08:54 +0100, Markus Armbruster wrote: > > > > > > > > > > +## > > > > +# @LUKSKeyslotUpdate: > > > > +# > > > > +# @keyslot: If

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-28 Thread Daniel P . Berrangé
On Tue, Jan 14, 2020 at 09:33:39PM +0200, Maxim Levitsky wrote: > Next few patches will expose that functionality > to the user. > > Signed-off-by: Maxim Levitsky > --- > crypto/block-luks.c | 374 +++- > qapi/crypto.json| 50 +- > 2 files changed

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-28 Thread Daniel P . Berrangé
On Tue, Jan 21, 2020 at 03:13:01PM +0200, Maxim Levitsky wrote: > On Tue, 2020-01-21 at 08:54 +0100, Markus Armbruster wrote: > > > > > > +## > > > +# @LUKSKeyslotUpdate: > > > +# > > > +# @keyslot: If specified, will update only keyslot with this > > > index > > > +# > > > +# @old-secr

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-21 Thread Maxim Levitsky
On Tue, 2020-01-21 at 08:54 +0100, Markus Armbruster wrote: > > +## > > +# @LUKSKeyslotUpdate: > > +# > > +# @keyslot: If specified, will update only keyslot with this index > > +# > > +# @old-secret: If specified, will only update keyslots that > > +# can be opene

Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-20 Thread Markus Armbruster
Reviewing just the QAPI schema. Maxim Levitsky writes: > Next few patches will expose that functionality > to the user. > > Signed-off-by: Maxim Levitsky > --- > crypto/block-luks.c | 374 +++- > qapi/crypto.json| 50 +- > 2 files changed, 421 i

[PATCH 02/13] qcrypto-luks: implement encryption key management

2020-01-14 Thread Maxim Levitsky
Next few patches will expose that functionality to the user. Signed-off-by: Maxim Levitsky --- crypto/block-luks.c | 374 +++- qapi/crypto.json| 50 +- 2 files changed, 421 insertions(+), 3 deletions(-) diff --git a/crypto/block-luks.c b/crypto/b