Skip to content

Commit

Permalink
ceph-disk: fix dmcrypt_map() usage for LUKS activate
Browse files Browse the repository at this point in the history
2943194 added a call to dmcrypt_map()
during disk activation. The change is not suitable for use alongside
the recently added dmcrypt LUKS support, because:
- The callers don't correctly provide cryptsetup_parameters or luks
  arguments.
- dmcrypt_map() calls LuksFormat, which should never be performed
  during disk activation.
- The key file paths don't carry the luks suffix when required.

This commit addresses these issues. Corresponding tests and a udev file
update will follow.

Signed-off-by: David Disseldorp <ddiss@suse.de>
  • Loading branch information
ddiss committed Aug 28, 2015
1 parent 34411ef commit 82a8428
Showing 1 changed file with 44 additions and 9 deletions.
53 changes: 44 additions & 9 deletions src/ceph-disk
Expand Up @@ -879,7 +879,8 @@ def dmcrypt_map(
keypath,
_uuid,
cryptsetup_parameters,
luks
luks,
format_dev=False,
):
"""
Maps a device to a dmcrypt device.
Expand Down Expand Up @@ -916,7 +917,8 @@ def dmcrypt_map(

try:
if luks:
command_check_call(luksFormat_args)
if format_dev:
command_check_call(luksFormat_args)
command_check_call(luksOpen_args)
else:
# Plain mode has no format function, nor any validation that the key is correct.
Expand Down Expand Up @@ -1485,7 +1487,14 @@ def prepare_dev(

dev = None
if osd_dm_keypath:
dev = dmcrypt_map(rawdev, osd_dm_keypath, osd_uuid, cryptsetup_parameters, luks)
dev = dmcrypt_map(
rawdev=rawdev,
keypath=osd_dm_keypath,
_uuid=osd_uuid,
cryptsetup_parameters=cryptsetup_parameters,
luks=luks,
format_dev=True,
)
else:
dev = rawdev

Expand Down Expand Up @@ -2018,11 +2027,24 @@ def mount_activate(
# proceeding.
rawdev = dev
ptype = get_partition_type(rawdev)
if ptype not in [DMCRYPT_OSD_UUID]:
if ptype in [DMCRYPT_OSD_UUID]:
luks = False
cryptsetup_parameters = ['--key-size', '256']
elif ptype in [DMCRYPT_LUKS_OSD_UUID]:
luks = True
cryptsetup_parameters = []
else:
raise Error('activate --dmcrypt called for invalid dev %s' % (dev))
part_uuid = get_partition_uuid(rawdev)
dmcrypt_key_path = os.path.join(dmcrypt_key_dir, part_uuid)
dev = dmcrypt_map(rawdev, dmcrypt_key_path, part_uuid)
dmcrypt_key_path = get_dmcrypt_key_path(part_uuid, dmcrypt_key_dir, luks)
dev = dmcrypt_map(
rawdev=rawdev,
keypath=dmcrypt_key_path,
_uuid=part_uuid,
cryptsetup_parameters=cryptsetup_parameters,
luks=luks,
format_dev=False,
)

try:
fstype = detect_fstype(dev=dev)
Expand Down Expand Up @@ -2366,11 +2388,24 @@ def main_activate_journal(args):
# it before proceeding.
rawdev = args.dev
ptype = get_partition_type(rawdev)
if ptype not in [DMCRYPT_JOURNAL_UUID]:
if ptype in [DMCRYPT_JOURNAL_UUID]:
luks = False
cryptsetup_parameters = ['--key-size', '256']
elif ptype in [DMCRYPT_LUKS_JOURNAL_UUID]:
luks = True
cryptsetup_parameters = []
else:
raise Error('activate-journal --dmcrypt called for invalid dev %s' % (rawdev))
part_uuid = get_partition_uuid(rawdev)
dmcrypt_key_path = os.path.join(args.dmcrypt_key_dir, part_uuid)
dev = dmcrypt_map(rawdev, dmcrypt_key_path, partd_uuid)
dmcrypt_key_path = get_dmcrypt_key_path(part_uuid, args.dmcrypt_key_dir, luks)
dev = dmcrypt_map(
rawdev=rawdev,
keypath=dmcrypt_key_path,
_uuid=part_uuid,
cryptsetup_parameters=cryptsetup_parameters,
luks=luks,
format_dev=False,
)
else:
dev = args.dev

Expand Down

0 comments on commit 82a8428

Please sign in to comment.