From 0f0cda49a72983b58b43ce3bf96a0c8e452a0d70 Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Mon, 8 Nov 2021 13:26:23 +0530 Subject: [PATCH] rbd: log stdError for cryptosetup command If we hit any error while running the cryptosetup commands we are logging only the error message. with only error message it is difficult to analyze the problem, logging the stdError will help us to check what is the problem. updates: #2610 Signed-off-by: Madhu Rajanna --- internal/util/crypto.go | 40 ++++++++++++++++++++----------------- internal/util/cryptsetup.go | 21 ++++++++++--------- 2 files changed, 34 insertions(+), 27 deletions(-) diff --git a/internal/util/crypto.go b/internal/util/crypto.go index d04ab2cf7..7f30879ea 100644 --- a/internal/util/crypto.go +++ b/internal/util/crypto.go @@ -196,20 +196,21 @@ func VolumeMapper(volumeID string) (mapperFile, mapperFilePath string) { // EncryptVolume encrypts provided device with LUKS. func EncryptVolume(ctx context.Context, devicePath, passphrase string) error { - log.DebugLog(ctx, "Encrypting device %s with LUKS", devicePath) - if _, _, err := LuksFormat(devicePath, passphrase); err != nil { - return fmt.Errorf("failed to encrypt device %s with LUKS: %w", devicePath, err) + log.DebugLog(ctx, "Encrypting device %q with LUKS", devicePath) + _, stdErr, err := LuksFormat(devicePath, passphrase) + if err != nil || stdErr != "" { + log.ErrorLog(ctx, "failed to encrypt device %q with LUKS (%v): %s", devicePath, err, stdErr) } - return nil + return err } // OpenEncryptedVolume opens volume so that it can be used by the client. func OpenEncryptedVolume(ctx context.Context, devicePath, mapperFile, passphrase string) error { - log.DebugLog(ctx, "Opening device %s with LUKS on %s", devicePath, mapperFile) - _, stderr, err := LuksOpen(devicePath, mapperFile, passphrase) - if err != nil { - log.ErrorLog(ctx, "failed to open LUKS device %q: %s", devicePath, stderr) + log.DebugLog(ctx, "Opening device %q with LUKS on %q", devicePath, mapperFile) + _, stdErr, err := LuksOpen(devicePath, mapperFile, passphrase) + if err != nil || stdErr != "" { + log.ErrorLog(ctx, "failed to open device %q (%v): %s", devicePath, err, stdErr) } return err @@ -217,10 +218,10 @@ func OpenEncryptedVolume(ctx context.Context, devicePath, mapperFile, passphrase // ResizeEncryptedVolume resizes encrypted volume so that it can be used by the client. func ResizeEncryptedVolume(ctx context.Context, mapperFile string) error { - log.DebugLog(ctx, "Resizing LUKS device %s", mapperFile) - _, stderr, err := LuksResize(mapperFile) - if err != nil { - log.ErrorLog(ctx, "failed to resize LUKS device %s: %s", mapperFile, stderr) + log.DebugLog(ctx, "Resizing LUKS device %q", mapperFile) + _, stdErr, err := LuksResize(mapperFile) + if err != nil || stdErr != "" { + log.ErrorLog(ctx, "failed to resize LUKS device %q (%v): %s", mapperFile, err, stdErr) } return err @@ -228,8 +229,11 @@ func ResizeEncryptedVolume(ctx context.Context, mapperFile string) error { // CloseEncryptedVolume closes encrypted volume so it can be detached. func CloseEncryptedVolume(ctx context.Context, mapperFile string) error { - log.DebugLog(ctx, "Closing LUKS device %s", mapperFile) - _, _, err := LuksClose(mapperFile) + log.DebugLog(ctx, "Closing LUKS device %q", mapperFile) + _, stdErr, err := LuksClose(mapperFile) + if err != nil || stdErr != "" { + log.ErrorLog(ctx, "failed to close LUKS device %q (%v): %s", mapperFile, err, stdErr) + } return err } @@ -249,13 +253,13 @@ func DeviceEncryptionStatus(ctx context.Context, devicePath string) (mappedDevic return devicePath, "", nil } mapPath := strings.TrimPrefix(devicePath, mapperFilePathPrefix+"/") - stdout, _, err := LuksStatus(mapPath) - if err != nil { - log.DebugLog(ctx, "device %s is not an active LUKS device: %v", devicePath, err) + stdout, stdErr, err := LuksStatus(mapPath) + if err != nil || stdErr != "" { + log.DebugLog(ctx, "%q is not an active LUKS device (%v): %s", devicePath, err, stdErr) return devicePath, "", nil } - lines := strings.Split(string(stdout), "\n") + lines := strings.Split(stdout, "\n") if len(lines) < 1 { return "", "", fmt.Errorf("device encryption status returned no stdout for %s", devicePath) } diff --git a/internal/util/cryptsetup.go b/internal/util/cryptsetup.go index ce9e4f018..f9677f743 100644 --- a/internal/util/cryptsetup.go +++ b/internal/util/cryptsetup.go @@ -24,7 +24,7 @@ import ( ) // LuksFormat sets up volume as an encrypted LUKS partition. -func LuksFormat(devicePath, passphrase string) (stdout, stderr []byte, err error) { +func LuksFormat(devicePath, passphrase string) (string, string, error) { return execCryptsetupCommand( &passphrase, "-q", @@ -39,28 +39,28 @@ func LuksFormat(devicePath, passphrase string) (stdout, stderr []byte, err error } // LuksOpen opens LUKS encrypted partition and sets up a mapping. -func LuksOpen(devicePath, mapperFile, passphrase string) (stdout, stderr []byte, err error) { +func LuksOpen(devicePath, mapperFile, passphrase string) (string, string, error) { // cryptsetup option --disable-keyring (introduced with cryptsetup v2.0.0) // will be ignored with luks1 return execCryptsetupCommand(&passphrase, "luksOpen", devicePath, mapperFile, "--disable-keyring", "-d", "/dev/stdin") } // LuksResize resizes LUKS encrypted partition. -func LuksResize(mapperFile string) (stdout, stderr []byte, err error) { +func LuksResize(mapperFile string) (string, string, error) { return execCryptsetupCommand(nil, "resize", mapperFile) } // LuksClose removes existing mapping. -func LuksClose(mapperFile string) (stdout, stderr []byte, err error) { +func LuksClose(mapperFile string) (string, string, error) { return execCryptsetupCommand(nil, "luksClose", mapperFile) } // LuksStatus returns encryption status of a provided device. -func LuksStatus(mapperFile string) (stdout, stderr []byte, err error) { +func LuksStatus(mapperFile string) (string, string, error) { return execCryptsetupCommand(nil, "status", mapperFile) } -func execCryptsetupCommand(stdin *string, args ...string) (stdout, stderr []byte, err error) { +func execCryptsetupCommand(stdin *string, args ...string) (string, string, error) { var ( program = "cryptsetup" cmd = exec.Command(program, args...) // #nosec:G204, commands executing not vulnerable. @@ -74,11 +74,14 @@ func execCryptsetupCommand(stdin *string, args ...string) (stdout, stderr []byte if stdin != nil { cmd.Stdin = strings.NewReader(*stdin) } + err := cmd.Run() + stdout := stdoutBuf.String() + stderr := stderrBuf.String() - if err := cmd.Run(); err != nil { - return stdoutBuf.Bytes(), stderrBuf.Bytes(), fmt.Errorf("an error (%v)"+ + if err != nil { + return stdout, stderr, fmt.Errorf("an error (%v)"+ " occurred while running %s args: %v", err, program, sanitizedArgs) } - return stdoutBuf.Bytes(), nil, nil + return stdout, stderr, err }