def enable():
hutil.do_parse_context('Enable')
# we need to start another subprocess to do it, because the initial process
# would be killed by the wala in 5 minutes.
logger.log('enabling...')
"""
trying to mount the crypted items.
"""
disk_util = DiskUtil(hutil = hutil, patching = MyPatching, logger = logger, encryption_environment = encryption_environment)
bek_util = BekUtil(disk_util, logger)
existed_passphrase_file = None
encryption_config = EncryptionConfig(encryption_environment=encryption_environment, logger = logger)
config_path_result = disk_util.make_sure_path_exists(encryption_environment.encryption_config_path)
if(config_path_result != CommonVariables.process_success):
logger.log(msg="azure encryption path creation failed.",level=CommonVariables.ErrorLevel)
if(encryption_config.config_file_exists()):
existed_passphrase_file = bek_util.get_bek_passphrase_file(encryption_config)
if(existed_passphrase_file is not None):
mount_encrypted_disks(disk_util=disk_util,bek_util=bek_util,encryption_config=encryption_config,passphrase_file=existed_passphrase_file)
else:
logger.log(msg="the config is there, but we could not get the bek file.",level=CommonVariables.WarningLevel)
exit_without_status_report()
# handle the re-call scenario. the re-call would resume?
# if there's one tag for the next reboot.
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
if (not encryption_marker.config_file_exists()):
machine_identity = MachineIdentity()
stored_identity = machine_identity.stored_identity()
if(stored_identity is None):
machine_identity.save_identity()
else:
current_identity = machine_identity.current_identity()
if(current_identity != stored_identity):
current_seq_no = -1
backup_logger.log("machine identity not same, set current_seq_no to " + str(current_seq_no) + " " + str(stored_identity) + " " + str(current_identity), True)
hutil.set_last_seq(current_seq_no)
machine_identity.save_identity()
# we should be careful about proceed for this case, we just
# failed this time to wait for customers' retry.
exit_without_status_report()
hutil.exit_if_same_seq()
hutil.save_seq()
try:
protected_settings_str = hutil._context._config['runtimeSettings'][0]['handlerSettings'].get('protectedSettings')
public_settings_str = hutil._context._config['runtimeSettings'][0]['handlerSettings'].get('publicSettings')
if(isinstance(public_settings_str,basestring)):
public_settings = json.loads(public_settings_str)
else:
public_settings = public_settings_str;
if(isinstance(protected_settings_str,basestring)):
protected_settings = json.loads(protected_settings_str)
else:
protected_settings = protected_settings_str
extension_parameter = ExtensionParameter(hutil, protected_settings, public_settings)
kek_secret_id_created = None
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
if encryption_marker.config_file_exists():
# verify the encryption mark
logger.log(msg="encryption mark is there, starting daemon.",level=CommonVariables.InfoLevel)
start_daemon()
else:
if(encryption_config.config_file_exists() and existed_passphrase_file is not None):
logger.log(msg="config file exists and passphrase file exists.", level=CommonVariables.WarningLevel)
encryption_marker = mark_encryption(command=extension_parameter.command, \
volume_type=extension_parameter.VolumeType, \
disk_format_query=extension_parameter.DiskFormatQuery)
start_daemon()
else:
"""
creating the secret, the secret would be transferred to a bek volume after the updatevm called in powershell.
"""
#store the luks passphrase in the secret.
keyVaultUtil = KeyVaultUtil(logger)
"""
validate the parameters
"""
if(extension_parameter.VolumeType != 'Data'):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status,str(CommonVariables.volue_type_not_support), 'VolumeType ' + str(extension_parameter.VolumeType) + ' is not supported.')
if(extension_parameter.command not in [CommonVariables.EnableEncryption, CommonVariables.EnableEncryptionFormat]):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status,str(CommonVariables.command_not_support), 'Command ' + str(extension_parameter.command) + ' is not supported.')
"""
this is the fresh call case
"""
#handle the passphrase related
if(existed_passphrase_file is None):
if(extension_parameter.passphrase is None or extension_parameter.passphrase == ""):
extension_parameter.passphrase = bek_util.generate_passphrase(extension_parameter.KeyEncryptionAlgorithm)
else:
logger.log(msg="the extension_parameter.passphrase is none")
kek_secret_id_created = keyVaultUtil.create_kek_secret(Passphrase = extension_parameter.passphrase,\
KeyVaultURL = extension_parameter.KeyVaultURL,\
KeyEncryptionKeyURL = extension_parameter.KeyEncryptionKeyURL,\
AADClientID = extension_parameter.AADClientID,\
KeyEncryptionAlgorithm = extension_parameter.KeyEncryptionAlgorithm,\
AADClientSecret = extension_parameter.AADClientSecret,\
DiskEncryptionKeyFileName = extension_parameter.DiskEncryptionKeyFileName)
if(kek_secret_id_created is None):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status, str(CommonVariables.create_encryption_secret_failed), 'Enable failed.')
else:
encryption_config.passphrase_file_name = extension_parameter.DiskEncryptionKeyFileName
encryption_config.bek_filesystem = CommonVariables.BekVolumeFileSystem
encryption_config.secret_id = kek_secret_id_created
encryption_config.commit()
encryption_marker = mark_encryption(command=extension_parameter.command, \
volume_type=extension_parameter.VolumeType, \
disk_format_query=extension_parameter.DiskFormatQuery)
if(kek_secret_id_created != None):
hutil.do_exit(0, 'Enable', CommonVariables.extension_success_status, str(CommonVariables.success), str(kek_secret_id_created))
else:
"""
the enabling called again. the passphrase would be re-used.
"""
hutil.do_exit(0, 'Enable', CommonVariables.extension_success_status, str(CommonVariables.encrypttion_already_enabled), str(kek_secret_id_created))
except Exception as e:
logger.log(msg="Failed to enable the extension with error: %s, stack trace: %s" % (str(e), traceback.format_exc()),level=CommonVariables.ErrorLevel)
hutil.do_exit(0, 'Enable',CommonVariables.extension_error_status,str(CommonVariables.unknown_error), 'Enable failed.')
