mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-01-12 16:09:39 -05:00
Reorder to be more readable
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
parent
14103e4f89
commit
2b80341d99
@ -30,6 +30,61 @@ const (
|
|||||||
// https://stackoverflow.com/questions/30553386/cryptsetup-backend-safe-with-multithreading
|
// https://stackoverflow.com/questions/30553386/cryptsetup-backend-safe-with-multithreading
|
||||||
var packageLock = sync.Mutex{}
|
var packageLock = sync.Mutex{}
|
||||||
|
|
||||||
|
// KeyCreator is an interface to create data encryption keys.
|
||||||
|
type KeyCreator interface {
|
||||||
|
GetDEK(ctx context.Context, dekID string, dekSize int) ([]byte, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeviceMapper is an interface for device mapper methods.
|
||||||
|
type DeviceMapper interface {
|
||||||
|
// Init initializes a crypt device backed by 'devicePath'.
|
||||||
|
// Sets the deviceMapper to the newly allocated Device or returns any error encountered.
|
||||||
|
Init(devicePath string) error
|
||||||
|
// ActivateByVolumeKey activates a device by using a volume key.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
ActivateByVolumeKey(deviceName, volumeKey string, volumeKeySize, flags int) error
|
||||||
|
// Deactivate deactivates a device.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
Deactivate(deviceName string) error
|
||||||
|
// Format formats a Device, using a specific device type, and type-independent parameters.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
Format(deviceType cryptsetup.DeviceType, genericParams cryptsetup.GenericParams) error
|
||||||
|
// Free releases crypt device context and used memory.
|
||||||
|
Free() bool
|
||||||
|
// Load loads crypt device parameters from the on-disk header.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
Load(cryptsetup.DeviceType) error
|
||||||
|
// Wipe removes existing data and clears the device for use with dm-integrity.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
Wipe(devicePath string, pattern int, offset, length uint64, wipeBlockSize int, flags int, progress func(size, offset uint64) int) error
|
||||||
|
// Resize the crypt device.
|
||||||
|
// Returns nil on success, or an error otherwise.
|
||||||
|
Resize(name string, newSize uint64) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// cryptDevice is a wrapper for cryptsetup.Device.
|
||||||
|
type CryptDevice struct {
|
||||||
|
*cryptsetup.Device
|
||||||
|
}
|
||||||
|
|
||||||
|
// Init initializes a crypt device backed by 'devicePath'.
|
||||||
|
// Sets the cryptDevice's deviceMapper to the newly allocated Device or returns any error encountered.
|
||||||
|
func (c *CryptDevice) Init(devicePath string) error {
|
||||||
|
device, err := cryptsetup.Init(devicePath)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
c.Device = device
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Free releases crypt device context and used memory.
|
||||||
|
func (c *CryptDevice) Free() bool {
|
||||||
|
res := c.Device.Free()
|
||||||
|
c.Device = nil
|
||||||
|
return res
|
||||||
|
}
|
||||||
|
|
||||||
// CryptMapper manages dm-crypt volumes.
|
// CryptMapper manages dm-crypt volumes.
|
||||||
type CryptMapper struct {
|
type CryptMapper struct {
|
||||||
mapper DeviceMapper
|
mapper DeviceMapper
|
||||||
@ -45,67 +100,6 @@ func New(kms KeyCreator, mapper DeviceMapper) *CryptMapper {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// KeyCreator is an interface to create data encryption keys.
|
|
||||||
type KeyCreator interface {
|
|
||||||
GetDEK(ctx context.Context, dekID string, dekSize int) ([]byte, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// DeviceMapper is an interface for device mapper methods.
|
|
||||||
type DeviceMapper interface {
|
|
||||||
// Init initializes a crypt device backed by 'devicePath'.
|
|
||||||
// Sets the deviceMapper to the newly allocated Device or returns any error encountered.
|
|
||||||
// C equivalent: crypt_init
|
|
||||||
Init(devicePath string) error
|
|
||||||
// ActivateByVolumeKey activates a device by using a volume key.
|
|
||||||
// Returns nil on success, or an error otherwise.
|
|
||||||
// C equivalent: crypt_activate_by_volume_key
|
|
||||||
ActivateByVolumeKey(deviceName, volumeKey string, volumeKeySize, flags int) error
|
|
||||||
// Deactivate deactivates a device.
|
|
||||||
// Returns nil on success, or an error otherwise.
|
|
||||||
// C equivalent: crypt_deactivate
|
|
||||||
Deactivate(deviceName string) error
|
|
||||||
// Format formats a Device, using a specific device type, and type-independent parameters.
|
|
||||||
// Returns nil on success, or an error otherwise.
|
|
||||||
// C equivalent: crypt_format
|
|
||||||
Format(deviceType cryptsetup.DeviceType, genericParams cryptsetup.GenericParams) error
|
|
||||||
// Free releases crypt device context and used memory.
|
|
||||||
// C equivalent: crypt_free
|
|
||||||
Free() bool
|
|
||||||
// Load loads crypt device parameters from the on-disk header.
|
|
||||||
// Returns nil on success, or an error otherwise.
|
|
||||||
// C equivalent: crypt_load
|
|
||||||
Load(cryptsetup.DeviceType) error
|
|
||||||
// Wipe removes existing data and clears the device for use with dm-integrity.
|
|
||||||
// Returns nil on success, or an error otherwise.
|
|
||||||
// C equivalent: crypt_wipe
|
|
||||||
Wipe(devicePath string, pattern int, offset, length uint64, wipeBlockSize int, flags int, progress func(size, offset uint64) int) error
|
|
||||||
}
|
|
||||||
|
|
||||||
// cryptDevice is a wrapper for cryptsetup.Device.
|
|
||||||
type CryptDevice struct {
|
|
||||||
*cryptsetup.Device
|
|
||||||
}
|
|
||||||
|
|
||||||
// Init initializes a crypt device backed by 'devicePath'.
|
|
||||||
// Sets the cryptDevice's deviceMapper to the newly allocated Device or returns any error encountered.
|
|
||||||
// C equivalent: crypt_init.
|
|
||||||
func (c *CryptDevice) Init(devicePath string) error {
|
|
||||||
device, err := cryptsetup.Init(devicePath)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
c.Device = device
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Free releases crypt device context and used memory.
|
|
||||||
// C equivalent: crypt_free.
|
|
||||||
func (c *CryptDevice) Free() bool {
|
|
||||||
res := c.Device.Free()
|
|
||||||
c.Device = nil
|
|
||||||
return res
|
|
||||||
}
|
|
||||||
|
|
||||||
// CloseCryptDevice closes the crypt device mapped for volumeID.
|
// CloseCryptDevice closes the crypt device mapped for volumeID.
|
||||||
// Returns nil if the volume does not exist.
|
// Returns nil if the volume does not exist.
|
||||||
func (c *CryptMapper) CloseCryptDevice(volumeID string) error {
|
func (c *CryptMapper) CloseCryptDevice(volumeID string) error {
|
||||||
@ -143,6 +137,24 @@ func (c *CryptMapper) CloseCryptDevice(volumeID string) error {
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// OpenCryptDevice maps the volume at source to the crypt device identified by volumeID.
|
||||||
|
// The key used to encrypt the volume is fetched using CryptMapper's kms client.
|
||||||
|
func (c *CryptMapper) OpenCryptDevice(ctx context.Context, source, volumeID string, integrity bool) (string, error) {
|
||||||
|
klog.V(4).Infof("Fetching data encryption key for volume %q", volumeID)
|
||||||
|
|
||||||
|
keySize := keySizeCrypt
|
||||||
|
if integrity {
|
||||||
|
keySize = keySizeIntegrity
|
||||||
|
}
|
||||||
|
dek, err := c.kms.GetDEK(ctx, volumeID, keySize)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
m := &mount.SafeFormatAndMount{Exec: utilexec.New()}
|
||||||
|
return openCryptDevice(c.mapper, source, volumeID, string(dek), integrity, m.GetDiskFormat)
|
||||||
|
}
|
||||||
|
|
||||||
// closeCryptDevice closes the crypt device mapped for volumeID.
|
// closeCryptDevice closes the crypt device mapped for volumeID.
|
||||||
func closeCryptDevice(device DeviceMapper, source, volumeID, deviceType string) error {
|
func closeCryptDevice(device DeviceMapper, source, volumeID, deviceType string) error {
|
||||||
packageLock.Lock()
|
packageLock.Lock()
|
||||||
@ -166,24 +178,6 @@ func closeCryptDevice(device DeviceMapper, source, volumeID, deviceType string)
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// OpenCryptDevice maps the volume at source to the crypt device identified by volumeID.
|
|
||||||
// The key used to encrypt the volume is fetched using CryptMapper's kms client.
|
|
||||||
func (c *CryptMapper) OpenCryptDevice(ctx context.Context, source, volumeID string, integrity bool) (string, error) {
|
|
||||||
klog.V(4).Infof("Fetching data encryption key for volume %q", volumeID)
|
|
||||||
|
|
||||||
keySize := keySizeCrypt
|
|
||||||
if integrity {
|
|
||||||
keySize = keySizeIntegrity
|
|
||||||
}
|
|
||||||
dek, err := c.kms.GetDEK(ctx, volumeID, keySize)
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
|
|
||||||
m := &mount.SafeFormatAndMount{Exec: utilexec.New()}
|
|
||||||
return openCryptDevice(c.mapper, source, volumeID, string(dek), integrity, m.GetDiskFormat)
|
|
||||||
}
|
|
||||||
|
|
||||||
// openCryptDevice maps the volume at source to the crypt device identified by volumeID.
|
// openCryptDevice maps the volume at source to the crypt device identified by volumeID.
|
||||||
func openCryptDevice(device DeviceMapper, source, volumeID, dek string, integrity bool, diskInfo func(disk string) (string, error)) (string, error) {
|
func openCryptDevice(device DeviceMapper, source, volumeID, dek string, integrity bool, diskInfo func(disk string) (string, error)) (string, error) {
|
||||||
packageLock.Lock()
|
packageLock.Lock()
|
||||||
@ -216,7 +210,7 @@ func openCryptDevice(device DeviceMapper, source, volumeID, dek string, integrit
|
|||||||
needWipe := false
|
needWipe := false
|
||||||
// Try to load LUKS headers
|
// Try to load LUKS headers
|
||||||
// If this fails, the device is either not formatted at all, or already formatted with a different FS
|
// If this fails, the device is either not formatted at all, or already formatted with a different FS
|
||||||
if err := device.Load(nil); err != nil {
|
if err := device.Load(cryptsetup.LUKS2{}); err != nil {
|
||||||
klog.V(4).Infof("Device %q is not formatted as LUKS2 partition, checking for existing format...", source)
|
klog.V(4).Infof("Device %q is not formatted as LUKS2 partition, checking for existing format...", source)
|
||||||
format, err := diskInfo(source)
|
format, err := diskInfo(source)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
Loading…
Reference in New Issue
Block a user