Skip to content

Commit

Permalink
rbd: log stdError for cryptosetup command
Browse files Browse the repository at this point in the history 
If we hit any error while running the cryptosetup
commands we are logging only the error message.
with only error message it is difficult to analyze
the problem, logging the stdError will help us to
check what is the problem.

updates: ceph#2610

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
  • Loading branch information
@Madhu-1
Madhu-1 committed Nov 8, 2021
1 parent 3686b6d commit 2d89db2
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 22 deletions.
30 changes: 17 additions & 13 deletions internal/util/crypto.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -197,8 +197,9 @@ func VolumeMapper(volumeID string) (mapperFile, mapperFilePath string) {
// EncryptVolume encrypts provided device with LUKS.
func EncryptVolume(ctx context.Context, devicePath, passphrase string) error {
log.DebugLog(ctx, "Encrypting device %s with LUKS", devicePath)
if _, _, err := LuksFormat(devicePath, passphrase); err != nil {
return fmt.Errorf("failed to encrypt device %s with LUKS: %w", devicePath, err)
_, stdErr, err := LuksFormat(devicePath, passphrase)
if err != nil || stdErr != "" {
return fmt.Errorf("failed to encrypt device %s with LUKS: %w stdError:%s", devicePath, err, stdErr)
}

return nil
Expand All @@ -207,9 +208,9 @@ func EncryptVolume(ctx context.Context, devicePath, passphrase string) error {
// OpenEncryptedVolume opens volume so that it can be used by the client.
func OpenEncryptedVolume(ctx context.Context, devicePath, mapperFile, passphrase string) error {
log.DebugLog(ctx, "Opening device %s with LUKS on %s", devicePath, mapperFile)
_, stderr, err := LuksOpen(devicePath, mapperFile, passphrase)
if err != nil {
log.ErrorLog(ctx, "failed to open LUKS device %q: %s", devicePath, stderr)
_, stdErr, err := LuksOpen(devicePath, mapperFile, passphrase)
if err != nil || stdErr != "" {
log.ErrorLog(ctx, "failed to open LUKS device %q: %w stdError:%s", devicePath, err, stdErr)
}

return err
Expand All @@ -218,9 +219,9 @@ func OpenEncryptedVolume(ctx context.Context, devicePath, mapperFile, passphrase
// ResizeEncryptedVolume resizes encrypted volume so that it can be used by the client.
func ResizeEncryptedVolume(ctx context.Context, mapperFile string) error {
log.DebugLog(ctx, "Resizing LUKS device %s", mapperFile)
_, stderr, err := LuksResize(mapperFile)
if err != nil {
log.ErrorLog(ctx, "failed to resize LUKS device %s: %s", mapperFile, stderr)
_, stdErr, err := LuksResize(mapperFile)
if err != nil || stdErr != "" {
log.ErrorLog(ctx, "failed to resize LUKS device %s: %w stdError:%s", mapperFile, err, stdErr)
}

return err
Expand All @@ -229,7 +230,10 @@ func ResizeEncryptedVolume(ctx context.Context, mapperFile string) error {
// CloseEncryptedVolume closes encrypted volume so it can be detached.
func CloseEncryptedVolume(ctx context.Context, mapperFile string) error {
log.DebugLog(ctx, "Closing LUKS device %s", mapperFile)
_, _, err := LuksClose(mapperFile)
_, stdErr, err := LuksClose(mapperFile)
if err != nil || stdErr != "" {
log.ErrorLog(ctx, "failed to close LUKS device %s: %w stdError:%s", mapperFile, err, stdErr)
}

return err
}
Expand All @@ -249,13 +253,13 @@ func DeviceEncryptionStatus(ctx context.Context, devicePath string) (mappedDevic
return devicePath, "", nil
}
mapPath := strings.TrimPrefix(devicePath, mapperFilePathPrefix+"/")
stdout, _, err := LuksStatus(mapPath)
if err != nil {
log.DebugLog(ctx, "device %s is not an active LUKS device: %v", devicePath, err)
stdout, stdErr, err := LuksStatus(mapPath)
if err != nil || stdErr != "" {
log.DebugLog(ctx, "device %s is not an active LUKS device. %v stdError:%s", devicePath, err, stdErr)

return devicePath, "", nil
}
lines := strings.Split(string(stdout), "\n")
lines := strings.Split(stdout, "\n")
if len(lines) < 1 {
return "", "", fmt.Errorf("device encryption status returned no stdout for %s", devicePath)
}
Expand Down
21 changes: 12 additions & 9 deletions internal/util/cryptsetup.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ import (
)

// LuksFormat sets up volume as an encrypted LUKS partition.
func LuksFormat(devicePath, passphrase string) (stdout, stderr []byte, err error) {
func LuksFormat(devicePath, passphrase string) (string, string, error) {
return execCryptsetupCommand(
&passphrase,
"-q",
Expand All @@ -39,28 +39,28 @@ func LuksFormat(devicePath, passphrase string) (stdout, stderr []byte, err error
}

// LuksOpen opens LUKS encrypted partition and sets up a mapping.
func LuksOpen(devicePath, mapperFile, passphrase string) (stdout, stderr []byte, err error) {
func LuksOpen(devicePath, mapperFile, passphrase string) (string, string, error) {
// cryptsetup option --disable-keyring (introduced with cryptsetup v2.0.0)
// will be ignored with luks1
return execCryptsetupCommand(&passphrase, "luksOpen", devicePath, mapperFile, "--disable-keyring", "-d", "/dev/stdin")
}

// LuksResize resizes LUKS encrypted partition.
func LuksResize(mapperFile string) (stdout, stderr []byte, err error) {
func LuksResize(mapperFile string) (string, string, error) {
return execCryptsetupCommand(nil, "resize", mapperFile)
}

// LuksClose removes existing mapping.
func LuksClose(mapperFile string) (stdout, stderr []byte, err error) {
func LuksClose(mapperFile string) (string, string, error) {
return execCryptsetupCommand(nil, "luksClose", mapperFile)
}

// LuksStatus returns encryption status of a provided device.
func LuksStatus(mapperFile string) (stdout, stderr []byte, err error) {
func LuksStatus(mapperFile string) (string, string, error) {
return execCryptsetupCommand(nil, "status", mapperFile)
}

func execCryptsetupCommand(stdin *string, args ...string) (stdout, stderr []byte, err error) {
func execCryptsetupCommand(stdin *string, args ...string) (string, string, error) {
var (
program = "cryptsetup"
cmd = exec.Command(program, args...) // #nosec:G204, commands executing not vulnerable.
Expand All @@ -74,11 +74,14 @@ func execCryptsetupCommand(stdin *string, args ...string) (stdout, stderr []byte
if stdin != nil {
cmd.Stdin = strings.NewReader(*stdin)
}
err := cmd.Run()
stdout := stdoutBuf.String()
stderr := stderrBuf.String()

if err := cmd.Run(); err != nil {
return stdoutBuf.Bytes(), stderrBuf.Bytes(), fmt.Errorf("an error (%v)"+
if err != nil {
return stdout, stderr, fmt.Errorf("an error (%v)"+
" occurred while running %s args: %v", err, program, sanitizedArgs)
}

return stdoutBuf.Bytes(), nil, nil
return stdout, stderr, err
}

0 comments on commit 2d89db2

Please sign in to comment.