Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: data lost caused by Longhorn CSI plugin doing a wrong re-encryption of volume in rare race condition (backport #3566) #3568

Merged
merged 3 commits into from
Feb 14, 2025
Merged

fix: data lost caused by Longhorn CSI plugin doing a wrong re-encryption of volume in rare race condition (backport #3566) #3568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
01d90cd
fix: data lost caused by Longhorn CSI plugin doing a wrong re-encrypt…
PhanLe1010 Feb 14, 2025
d947560
chore(vendor): update dependencies
derekbit Feb 14, 2025
1d6bbad
fix: fix conflicts
derekbit Feb 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion csi/crypto/crypto.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,21 @@ func VolumeMapper(volume string) string {

// EncryptVolume encrypts provided device with LUKS.
func EncryptVolume(devicePath, passphrase string, cryptoParams *EncryptParams) error {
isEncrypted, err := isDeviceEncrypted(devicePath)
if err != nil {
logrus.WithError(err).Warnf("Failed to check IsDeviceEncrypted before encrypting volume %v", devicePath)
return err
}
if isEncrypted {
logrus.Infof("The device %v is already encrypted. Skipping the encryption to avoid data lost", devicePath)
return nil
}

namespaces := []lhtypes.Namespace{lhtypes.NamespaceMnt, lhtypes.NamespaceIpc}
nsexec, err := lhns.NewNamespaceExecutor(lhtypes.ProcessNone, lhtypes.HostProcDirectory, namespaces)
if err != nil {
return err
}

logrus.Infof("Encrypting device %s with LUKS", devicePath)
if _, err := nsexec.LuksFormat(
devicePath, passphrase,
Expand Down Expand Up @@ -161,6 +170,15 @@ func IsDeviceOpen(device string) (bool, error) {
return mappedFile != "", err
}

func isDeviceEncrypted(devicePath string) (bool, error) {
namespaces := []lhtypes.Namespace{lhtypes.NamespaceMnt, lhtypes.NamespaceIpc}
nsexec, err := lhns.NewNamespaceExecutor(lhtypes.ProcessNone, lhtypes.HostProcDirectory, namespaces)
if err != nil {
return false, err
}
return nsexec.IsLuks(devicePath, lhtypes.LuksTimeout)
}

// DeviceEncryptionStatus looks to identify if the passed device is a LUKS mapping
// and if so what the device is and the mapper name as used by LUKS.
// If not, just returns the original device and an empty string.
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ require (
github.com/kubernetes-csi/csi-lib-utils v0.6.1
github.com/longhorn/backing-image-manager v1.7.2
github.com/longhorn/backupstore v0.0.0-20250209090923-c552364ab3ac
github.com/longhorn/go-common-libs v0.0.0-20250210035242-5fafd2e6171a
github.com/longhorn/go-common-libs v0.0.0-20250214072736-3008fa6b826f
github.com/longhorn/go-iscsi-helper v0.0.0-20250111093313-7e1930499625
github.com/longhorn/go-spdk-helper v0.0.0-20241216160651-bcce92add55b
github.com/longhorn/longhorn-engine v1.7.2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,8 +161,8 @@ github.com/longhorn/backing-image-manager v1.7.2 h1:yVu03EE3WmkNWMSdS4M8LciLJqya
github.com/longhorn/backing-image-manager v1.7.2/go.mod h1:hsntkXAMiaThQiPDulAbZCUcxKhaiDBX58HPwxa1wZs=
github.com/longhorn/backupstore v0.0.0-20250209090923-c552364ab3ac h1:zjvNWC5xZFjQtBM5iAX1pNJkZanyDB+YLrB1VWSFSaU=
github.com/longhorn/backupstore v0.0.0-20250209090923-c552364ab3ac/go.mod h1:XAuYr2VfgSrine1YUNKagH6dFf5Z1xMLMkp5FxuzZS4=
github.com/longhorn/go-common-libs v0.0.0-20250210035242-5fafd2e6171a h1:vchYifra9CzQ4FLXfkW4WPUu3pSWzknjP3vdng2MpDA=
github.com/longhorn/go-common-libs v0.0.0-20250210035242-5fafd2e6171a/go.mod h1:WHFO5jD8wdnSSB5g+/mKNzcC0bglsPpH7ZBfFNlOMko=
github.com/longhorn/go-common-libs v0.0.0-20250214072736-3008fa6b826f h1:hTJufjYuG5O09pApC2qtSvBYPcvEWh+jA+DUqVV+d84=
github.com/longhorn/go-common-libs v0.0.0-20250214072736-3008fa6b826f/go.mod h1:9aezM1ef3JFYww2tCbeEoRr5091C4T6SNyp6LJ87Kqc=
github.com/longhorn/go-iscsi-helper v0.0.0-20250111093313-7e1930499625 h1:d39A3041RyFve26tIuKUuzrh2CkBY970xlGIXgMA998=
github.com/longhorn/go-iscsi-helper v0.0.0-20250111093313-7e1930499625/go.mod h1:yIm3sGRuYOw/Y3XzRhG5+3FlZBOfrU5EZOavzwL2jVs=
github.com/longhorn/go-spdk-helper v0.0.0-20241216160651-bcce92add55b h1:fzyWJOiUPzwkY/VShltuhP6eUpkv6RMFqSVuVFt/Z2M=
Expand Down
21 changes: 21 additions & 0 deletions vendor/github.com/longhorn/go-common-libs/ns/crypto.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion vendor/modules.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,7 +244,7 @@ github.com/longhorn/backupstore/logging
github.com/longhorn/backupstore/systembackup
github.com/longhorn/backupstore/types
github.com/longhorn/backupstore/util
# github.com/longhorn/go-common-libs v0.0.0-20250210035242-5fafd2e6171a
# github.com/longhorn/go-common-libs v0.0.0-20250214072736-3008fa6b826f
## explicit; go 1.22.7
github.com/longhorn/go-common-libs/backup
github.com/longhorn/go-common-libs/exec
Expand Down