From c6c1511326fda24e0598d2228e750c89b0f066b0 Mon Sep 17 00:00:00 2001 From: James Lu Date: Mon, 9 Sep 2024 10:20:22 +0800 Subject: [PATCH] fix(encrypt): close encrypted volume if it is opened In normal process of attaching a volume via CSI, the encrypted volume should be in closed or inactivated state before Longhorn attempts to open it. ref: longhorn/longhorn 9385 Signed-off-by: James Lu --- csi/crypto/crypto.go | 10 ++++++++++ csi/node_server.go | 12 ++++++++++++ 2 files changed, 22 insertions(+) diff --git a/csi/crypto/crypto.go b/csi/crypto/crypto.go index d22c4ad922..50e87bce3f 100644 --- a/csi/crypto/crypto.go +++ b/csi/crypto/crypto.go @@ -145,6 +145,16 @@ func ResizeEncryptoDevice(volume, passphrase string) error { return err } +// IsDeviceOpenAtNullPath determines if encrypted device is already open at unknown device path. The command 'cryptsetup status [device]' show "device: (null)" +func IsDeviceOpenAtNullPath(device string) (bool, error) { + devPath, mappedFile, err := DeviceEncryptionStatus(device) + if err != nil { + return false, err + } + + return mappedFile != "" && strings.Contains(devPath, "null"), nil +} + // IsDeviceOpen determines if encrypted device is already open. func IsDeviceOpen(device string) (bool, error) { _, mappedFile, err := DeviceEncryptionStatus(device) diff --git a/csi/node_server.go b/csi/node_server.go index cd49366c3d..5ee99bf447 100644 --- a/csi/node_server.go +++ b/csi/node_server.go @@ -487,6 +487,18 @@ func (ns *NodeServer) NodeStageVolume(ctx context.Context, req *csi.NodeStageVol cryptoDevice := crypto.VolumeMapper(volumeID) log.Infof("Volume %s requires crypto device %s", volumeID, cryptoDevice) + // check if the crypto device is open at the null path. + // this will happen if the crypto device is not closed properly and a new attaching request is made on the same node. + // reference issue: https://github.com/longhorn/longhorn/issues/9385 + if isOpenAtNullPath, err := crypto.IsDeviceOpenAtNullPath(cryptoDevice); err != nil { + return nil, status.Error(codes.Internal, err.Error()) + } else if isOpenAtNullPath { + log.Infof("Closing active crypto device %s for volume %s", cryptoDevice, volumeID) + if err := crypto.CloseVolume(volumeID); err != nil { + return nil, status.Error(codes.Internal, err.Error()) + } + } + if err := crypto.OpenVolume(volumeID, devicePath, passphrase); err != nil { return nil, status.Error(codes.Internal, err.Error()) }