On 9/30/19 3:26 PM, Craig Mull wrote:
> How can have QEMU backup write the output to an encrypted target?
>
> Blocks in the dirty bitmap are unencrypted, and as such when I write
> them with QEMU backup they are written to the target unencrypted.
>
> I've experimented with providing a json string as the target but with no
> luck.
>
>
> transaction='{ "execute": "transaction",
>
> "arguments": {
>
> "actions": [
>
> {"type": "block-dirty-bitmap-add",
>
> "data": {"node": "drive-virtio-disk0", "granularity": 2097152,
> "name": "mybitmap"} },
>
> {"type": "drive-backup",
>
> "data": {"device": "drive-virtio-disk0", "target":
> "json:{\"encrypt.format\": \"luks\", \"encrypt.key-secret\":
> \"virtio-disk0-luks-secret0\", \"driver\": \"qcow2\", \"file\":
> {\"driver\": \"file\", \"filename\": \"/tmp/target-encrypt-test.qcow2\"}}",
>
> "sync": "full", "format": "qcow2"} }
>
> ]
>
> }
>
> }'
>
>
>
> virsh -c qemu:///system qemu-monitor-command --pretty 28 $transaction
>
>
>
> {
>
> "id": "libvirt-45",
>
> "error": {
>
> "class": "GenericError",
>
> "desc": "Unknown protocol 'json'"
>
> }
>
> }
>
>
I'll be honest, I'm not very good at the json specifications and don't
really know when they're appropriate to use. At the basic level,
drive-backup expects a filename. Sometimes the filename can get fancy,
but... I stay away from that.
Try using qmp-blockdev-create to create the target node instead, and
then using blockdev-backup to backup to that target.
--js
