fix(encrypt): close encrypted volume if it is opened

In normal process of attaching a volume via CSI, the encrypted volume
should be in closed or inactivated state before Longhorn attempts to
open it.

ref: longhorn/longhorn 9385

Signed-off-by: James Lu <james.lu@suse.com>

csi/crypto/crypto.go

@@ -145,6 +145,16 @@ func ResizeEncryptoDevice(volume, passphrase string) error {
 	return err
 }
 
+// IsDeviceOpenAtNullPath determines if encrypted device is already open at unknown device path. The command 'cryptsetup status [device]' show "device:  (null)"
+func IsDeviceOpenAtNullPath(device string) (bool, error) {
+	devPath, mappedFile, err := DeviceEncryptionStatus(device)
+	if err != nil {
+		return false, err
+	}
+
+	return mappedFile != "" && strings.Contains(devPath, "null"), nil
+}
+
 // IsDeviceOpen determines if encrypted device is already open.
 func IsDeviceOpen(device string) (bool, error) {
 	_, mappedFile, err := DeviceEncryptionStatus(device)

csi/node_server.go

@@ -487,6 +487,18 @@ func (ns *NodeServer) NodeStageVolume(ctx context.Context, req *csi.NodeStageVol
 		cryptoDevice := crypto.VolumeMapper(volumeID)
 		log.Infof("Volume %s requires crypto device %s", volumeID, cryptoDevice)
 
+		// check if the crypto device is open at the null path.
+		// this will happen if the crypto device is not closed properly and a new attaching request is made on the same node.
+		// reference issue: https://github.com/longhorn/longhorn/issues/9385
+		if isOpenAtNullPath, err := crypto.IsDeviceOpenAtNullPath(cryptoDevice); err != nil {
+			return nil, status.Error(codes.Internal, err.Error())
+		} else if isOpenAtNullPath {
+			log.Infof("Closing active crypto device %s for volume %s", cryptoDevice, volumeID)
+			if err := crypto.CloseVolume(volumeID); err != nil {
+				return nil, status.Error(codes.Internal, err.Error())
+			}
+		}
+
 		if err := crypto.OpenVolume(volumeID, devicePath, passphrase); err != nil {
 			return nil, status.Error(codes.Internal, err.Error())
 		}