mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-11-27 16:50:23 +00:00
0ec6e10bf2
By default, `cryptsetup luksFormat` uses Argon2i as Password-Based Key
Derivation Function (PBKDF), which not only has a CPU cost, but also a memory
cost (to make brute-force attacks harder).
The memory cost is based on the available system memory by default, which in
the context of Ceph CSI can be a problem for two reasons:
1. Pods can have a memory limit (much lower that the memory available on the
node, usually) which isn't taken into account by `cryptsetup`, so it can get
OOM-killed when formating a new volume;
2. The amount of memory that was used during `cryptsetup luksFormat` will then
be needed for `cryptsetup luksOpen`, so if the volume was formated on a node
with a lot of memory, but then needs to be opened on a different node with
less memory, `cryptsetup` will get OOM-killed.
This commit sets the PBKDF memory limit to a fixed value to ensure consistent
memory usage regardless of the specifications of the nodes where the volume
happens to be formatted in the first place.
The limit is set to a relatively low value (32 MiB) so that the `csi-rbdplugin`
container in the `nodeplugin` pod doesn't require an extravagantly high memory
limit in order to format/open volumes (particularly with operations happening
in parallel), while at the same time not being so low as to render it
completely pointless.
Signed-off-by: Benoît Knecht <bknecht@protonmail.ch>
(cherry picked from commit 1852e977f8)
94 lines
2.6 KiB
Go
94 lines
2.6 KiB
Go
/*
|
|
Copyright 2019 The Ceph-CSI Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package util
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"os/exec"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
// Limit memory used by Argon2i PBKDF to 32 MiB.
|
|
const cryptsetupPBKDFMemoryLimit = 32 << 10 // 32768 KiB
|
|
|
|
// LuksFormat sets up volume as an encrypted LUKS partition.
|
|
func LuksFormat(devicePath, passphrase string) (string, string, error) {
|
|
return execCryptsetupCommand(
|
|
&passphrase,
|
|
"-q",
|
|
"luksFormat",
|
|
"--type",
|
|
"luks2",
|
|
"--hash",
|
|
"sha256",
|
|
"--pbkdf-memory",
|
|
strconv.Itoa(cryptsetupPBKDFMemoryLimit),
|
|
devicePath,
|
|
"-d",
|
|
"/dev/stdin")
|
|
}
|
|
|
|
// LuksOpen opens LUKS encrypted partition and sets up a mapping.
|
|
func LuksOpen(devicePath, mapperFile, passphrase string) (string, string, error) {
|
|
// cryptsetup option --disable-keyring (introduced with cryptsetup v2.0.0)
|
|
// will be ignored with luks1
|
|
return execCryptsetupCommand(&passphrase, "luksOpen", devicePath, mapperFile, "--disable-keyring", "-d", "/dev/stdin")
|
|
}
|
|
|
|
// LuksResize resizes LUKS encrypted partition.
|
|
func LuksResize(mapperFile string) (string, string, error) {
|
|
return execCryptsetupCommand(nil, "resize", mapperFile)
|
|
}
|
|
|
|
// LuksClose removes existing mapping.
|
|
func LuksClose(mapperFile string) (string, string, error) {
|
|
return execCryptsetupCommand(nil, "luksClose", mapperFile)
|
|
}
|
|
|
|
// LuksStatus returns encryption status of a provided device.
|
|
func LuksStatus(mapperFile string) (string, string, error) {
|
|
return execCryptsetupCommand(nil, "status", mapperFile)
|
|
}
|
|
|
|
func execCryptsetupCommand(stdin *string, args ...string) (string, string, error) {
|
|
var (
|
|
program = "cryptsetup"
|
|
cmd = exec.Command(program, args...) // #nosec:G204, commands executing not vulnerable.
|
|
sanitizedArgs = StripSecretInArgs(args)
|
|
stdoutBuf bytes.Buffer
|
|
stderrBuf bytes.Buffer
|
|
)
|
|
|
|
cmd.Stdout = &stdoutBuf
|
|
cmd.Stderr = &stderrBuf
|
|
if stdin != nil {
|
|
cmd.Stdin = strings.NewReader(*stdin)
|
|
}
|
|
err := cmd.Run()
|
|
stdout := stdoutBuf.String()
|
|
stderr := stderrBuf.String()
|
|
|
|
if err != nil {
|
|
return stdout, stderr, fmt.Errorf("an error (%v)"+
|
|
" occurred while running %s args: %v", err, program, sanitizedArgs)
|
|
}
|
|
|
|
return stdout, stderr, err
|
|
}
|