From nobody Sun Feb 8 20:52:22 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1615476444; cv=none; d=zohomail.com; s=zohoarc; b=ZjuXYuzRdOjhTochg/K0iLTPWEYKo1uVTYeeX6jNKRhfSWkiSQzAKSIPweVMyQHYy/+o6kI1RNi+2cLMk2bQstqzEXPRyxuZYeFNYSZJ+EPGVFxTO5vOd8q0xb0joK6MYK1PFGdJ68zwhX10r8S2UY/OI5wByZTjutC2IdiBfzM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1615476444; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=5RpWQJW7Raj3ee0g+gU1/2sbHgannHwTlAuQ8SlNoUU=; b=ZQX3D+LSXRa3KgjJphnDdqFvFC8iojq8VtaoaRD6sF1FK/3BKVJ6+mK2cypJfy30yO/00o3QNNoGYHJ/z3O8roHXHzC4DWLW2f0YVKr47M8v7WJde1ltoQUpUJEfegG3aw83qvlfF+7xfLYq+wmWxuTewIqA5XQ9PTeGL2lEn6s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1615476444318200.28410149063802; Thu, 11 Mar 2021 07:27:24 -0800 (PST) Received: from localhost ([::1]:53570 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lKNDe-0002k4-Vj for importer@patchew.org; Thu, 11 Mar 2021 10:27:23 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:42604) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lKMcX-0005V2-4G for qemu-devel@nongnu.org; Thu, 11 Mar 2021 09:49:01 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:40118) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1lKMcL-00030b-Hq for qemu-devel@nongnu.org; Thu, 11 Mar 2021 09:49:00 -0500 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-597-HptMlQY9Mfmvw-AzRMSoJQ-1; Thu, 11 Mar 2021 09:48:47 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 08D8680BCA6; Thu, 11 Mar 2021 14:48:46 +0000 (UTC) Received: from merkur.fritz.box (ovpn-114-112.ams2.redhat.com [10.36.114.112]) by smtp.corp.redhat.com (Postfix) with ESMTP id DD1075D9F2; Thu, 11 Mar 2021 14:48:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1615474128; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5RpWQJW7Raj3ee0g+gU1/2sbHgannHwTlAuQ8SlNoUU=; b=VEQqGWLWMhm36er5MKmdjPmF+xiGbaralx0vslt7qtaVMgLrI61o9q1T8UQE/cZbtQsPr8 5AaA8LWHwT+S1oIAHYVcyueP4i+c6sBEcxMNkTNaMHZHMD9U+UMLMTGllmZhBeQH4eZTy2 UYfLvC69SY08MA4ABt4UN8EoI1afqDY= X-MC-Unique: HptMlQY9Mfmvw-AzRMSoJQ-1 From: Kevin Wolf To: qemu-block@nongnu.org Subject: [PULL 19/38] qapi/qom: Add ObjectOptions for secret*, deprecate 'loaded' Date: Thu, 11 Mar 2021 15:47:52 +0100 Message-Id: <20210311144811.313451-20-kwolf@redhat.com> In-Reply-To: <20210311144811.313451-1-kwolf@redhat.com> References: <20210311144811.313451-1-kwolf@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=kwolf@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=216.205.24.124; envelope-from=kwolf@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.25, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, peter.maydell@linaro.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @redhat.com) This adds a QAPI schema for the properties of the secret* objects. The 'loaded' property doesn't seem to make sense as an external interface: It is automatically set to true in ucc->complete, and explicitly setting it to true earlier just means that additional options will be silently ignored. In other words, the 'loaded' property is useless. Mark it as deprecated in the schema from the start. Signed-off-by: Kevin Wolf Acked-by: Paolo Bonzini Acked-by: Peter Krempa Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Eric Blake --- qapi/crypto.json | 61 ++++++++++++++++++++++++++++++++++++++ qapi/qom.json | 5 ++++ docs/system/deprecated.rst | 11 +++++++ 3 files changed, 77 insertions(+) diff --git a/qapi/crypto.json b/qapi/crypto.json index 2aebe6fa20..0fef3de66d 100644 --- a/qapi/crypto.json +++ b/qapi/crypto.json @@ -381,3 +381,64 @@ 'discriminator': 'format', 'data': { 'luks': 'QCryptoBlockAmendOptionsLUKS' } } + +## +# @SecretCommonProperties: +# +# Properties for objects of classes derived from secret-common. +# +# @loaded: if true, the secret is loaded immediately when applying this op= tion +# and will probably fail when processing the next option. Don't u= se; +# only provided for compatibility. (default: false) +# +# @format: the data format that the secret is provided in (default: raw) +# +# @keyid: the name of another secret that should be used to decrypt the +# provided data. If not present, the data is assumed to be unencry= pted. +# +# @iv: the random initialization vector used for encryption of this partic= ular +# secret. Should be a base64 encrypted string of the 16-byte IV. Mand= atory +# if @keyid is given. Ignored if @keyid is absent. +# +# Features: +# @deprecated: Member @loaded is deprecated. Setting true doesn't make se= nse, +# and false is already the default. +# +# Since: 2.6 +## +{ 'struct': 'SecretCommonProperties', + 'data': { '*loaded': { 'type': 'bool', 'features': ['deprecated'] }, + '*format': 'QCryptoSecretFormat', + '*keyid': 'str', + '*iv': 'str' } } + +## +# @SecretProperties: +# +# Properties for secret objects. +# +# Either @data or @file must be provided, but not both. +# +# @data: the associated with the secret from +# +# @file: the filename to load the data associated with the secret from +# +# Since: 2.6 +## +{ 'struct': 'SecretProperties', + 'base': 'SecretCommonProperties', + 'data': { '*data': 'str', + '*file': 'str' } } + +## +# @SecretKeyringProperties: +# +# Properties for secret_keyring objects. +# +# @serial: serial number that identifies a key to get from the kernel +# +# Since: 5.1 +## +{ 'struct': 'SecretKeyringProperties', + 'base': 'SecretCommonProperties', + 'data': { 'serial': 'int32' } } diff --git a/qapi/qom.json b/qapi/qom.json index fa56083a0b..a9ab10c124 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -7,6 +7,7 @@ { 'include': 'authz.json' } { 'include': 'block-core.json' } { 'include': 'common.json' } +{ 'include': 'crypto.json' } =20 ## # =3D QEMU Object Model (QOM) @@ -453,6 +454,8 @@ 'rng-builtin', 'rng-egd', 'rng-random', + 'secret', + 'secret_keyring', 'throttle-group' ] } =20 @@ -489,6 +492,8 @@ 'rng-builtin': 'RngProperties', 'rng-egd': 'RngEgdProperties', 'rng-random': 'RngRandomProperties', + 'secret': 'SecretProperties', + 'secret_keyring': 'SecretKeyringProperties', 'throttle-group': 'ThrottleGroupProperties' } } =20 diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 3ce4fe7581..3e9e3a26f6 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -175,6 +175,17 @@ other options have been processed. This will either h= ave no effect (if ``opened`` was the last option) or cause errors. The property is therefore useless and should not be specified. =20 +``loaded`` property of ``secret`` and ``secret_keyring`` objects (since 6.= 0.0) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''= '''' + +The only effect of specifying ``loaded=3Don`` in the command line or QMP +``object-add`` is that the secret is loaded immediately, possibly before a= ll +other options have been processed. This will either have no effect (if +``loaded`` was the last option) or cause options to be effectively ignored= as +if they were not given. The property is therefore useless and should not = be +specified. + + QEMU Machine Protocol (QMP) commands ------------------------------------ =20 --=20 2.29.2