def get_encryption_status(self):
encryption_status = {
"data": "NotEncrypted",
"os": "NotEncrypted"
}
mount_items = self.get_mount_items()
os_drive_encrypted = False
data_drives_found = False
data_drives_encrypted = True
for mount_item in mount_items:
if mount_item["fs"] in ["ext2", "ext4", "ext3", "xfs"] and \
not "/mnt" == mount_item["dest"] and \
not "/" == mount_item["dest"] and \
not "/oldroot/mnt/resource" == mount_item["dest"] and \
not "/oldroot/boot" == mount_item["dest"] and \
not "/oldroot" == mount_item["dest"] and \
not "/mnt/resource" == mount_item["dest"] and \
not "/boot" == mount_item["dest"]:
data_drives_found = True
if not "/dev/mapper" in mount_item["src"]:
self.logger.log("Data volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
data_drives_encrypted = False
if mount_item["dest"] == "/" and \
"/dev/mapper" in mount_item["src"] or \
"/dev/dm" in mount_item["src"]:
self.logger.log("OS volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
os_drive_encrypted = True
if not data_drives_found:
encryption_status["data"] = "NotMounted"
elif data_drives_encrypted:
encryption_status["data"] = "Encrypted"
if os_drive_encrypted:
encryption_status["os"] = "Encrypted"
encryption_marker = EncryptionMarkConfig(self.logger, self.encryption_environment)
decryption_marker = DecryptionMarkConfig(self.logger, self.encryption_environment)
if decryption_marker.config_file_exists():
encryption_status["data"] = "DecryptionInProgress"
elif encryption_marker.config_file_exists():
encryption_config = EncryptionConfig(self.encryption_environment, self.logger)
volume_type = encryption_config.get_volume_type().lower()
if volume_type == CommonVariables.VolumeTypeData.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["data"] = "EncryptionInProgress"
if volume_type == CommonVariables.VolumeTypeOS.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["os"] = "EncryptionInProgress"
elif os.path.exists('/dev/mapper/osencrypt') and not os_drive_encrypted:
encryption_status["os"] = "VMRestartPending"
return json.dumps(encryption_status)
def get_encryption_status(self):
encryption_status = {
"data": "NotEncrypted",
"os": "NotEncrypted"
}
mount_items = self.get_mount_items()
os_drive_encrypted = False
data_drives_found = False
data_drives_encrypted = True
for mount_item in mount_items:
if mount_item["fs"] == "ext4" and \
not "/mnt" == mount_item["dest"] and \
not "/" == mount_item["dest"] and \
not "/oldroot/mnt/resource" == mount_item["dest"] and \
not "/oldroot/boot" == mount_item["dest"] and \
not "/mnt/resource" == mount_item["dest"] and \
not "/boot" == mount_item["dest"]:
data_drives_found = True
if not "/dev/mapper" in mount_item["src"]:
self.logger.log("Data volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
data_drives_encrypted = False
if mount_item["dest"] == "/" and \
"/dev/mapper" in mount_item["src"]:
self.logger.log("OS volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
os_drive_encrypted = True
if not data_drives_found:
encryption_status["data"] = "NotMounted"
elif data_drives_encrypted:
encryption_status["data"] = "Encrypted"
if os_drive_encrypted:
encryption_status["os"] = "Encrypted"
encryption_marker = EncryptionMarkConfig(self.logger, self.encryption_environment)
decryption_marker = DecryptionMarkConfig(self.logger, self.encryption_environment)
if decryption_marker.config_file_exists():
encryption_status["data"] = "DecryptionInProgress"
elif encryption_marker.config_file_exists():
encryption_config = EncryptionConfig(self.encryption_environment, self.logger)
volume_type = encryption_config.get_volume_type().lower()
if volume_type == CommonVariables.VolumeTypeData.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["data"] = "EncryptionInProgress"
if volume_type == CommonVariables.VolumeTypeOS.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["os"] = "EncryptionInProgress"
elif os.path.exists('/dev/mapper/osencrypt') and not os_drive_encrypted:
encryption_status["os"] = "VMRestartPending"
return json.dumps(encryption_status)
def mark_encryption(command,volume_type,disk_format_query):
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
encryption_marker.command = command
encryption_marker.volume_type = volume_type
encryption_marker.diskFormatQuery = disk_format_query
encryption_marker.commit()
return encryption_marker
def get_encryption_status(self):
encryption_status = {
"data": "NotEncrypted",
"os": "NotEncrypted"
}
mount_items = self.get_mount_items()
os_drive_encrypted = False
data_drives_found = False
data_drives_encrypted = True
osmapper_path = os.path.join(CommonVariables.dev_mapper_root, CommonVariables.osmapper_name)
for mount_item in mount_items:
if mount_item["fs"] in ["ext2", "ext4", "ext3", "xfs"] and \
not "/mnt" == mount_item["dest"] and \
not "/" == mount_item["dest"] and \
not "/oldroot/mnt/resource" == mount_item["dest"] and \
not "/oldroot/boot" == mount_item["dest"] and \
not "/oldroot" == mount_item["dest"] and \
not "/mnt/resource" == mount_item["dest"] and \
not "/boot" == mount_item["dest"]:
data_drives_found = True
if not CommonVariables.dev_mapper_root in mount_item["src"]:
self.logger.log("Data volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
data_drives_encrypted = False
if self.is_os_disk_lvm():
grep_result = self.command_executor.ExecuteInBash('pvdisplay | grep {0}'.format(osmapper_path), suppress_logging=True)
if grep_result == 0 and not os.path.exists('/volumes.lvm'):
self.logger.log("OS PV is encrypted")
os_drive_encrypted = True
elif mount_item["dest"] == "/" and \
CommonVariables.dev_mapper_root in mount_item["src"] or \
"/dev/dm" in mount_item["src"]:
self.logger.log("OS volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
os_drive_encrypted = True
if not data_drives_found:
encryption_status["data"] = "NotMounted"
elif data_drives_encrypted:
encryption_status["data"] = "Encrypted"
if os_drive_encrypted:
encryption_status["os"] = "Encrypted"
encryption_marker = EncryptionMarkConfig(self.logger, self.encryption_environment)
decryption_marker = DecryptionMarkConfig(self.logger, self.encryption_environment)
if decryption_marker.config_file_exists():
encryption_status["data"] = "DecryptionInProgress"
elif encryption_marker.config_file_exists():
encryption_config = EncryptionConfig(self.encryption_environment, self.logger)
volume_type = encryption_config.get_volume_type().lower()
if volume_type == CommonVariables.VolumeTypeData.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["data"] = "EncryptionInProgress"
if volume_type == CommonVariables.VolumeTypeOS.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["os"] = "EncryptionInProgress"
elif os.path.exists(osmapper_path) and not os_drive_encrypted:
encryption_status["os"] = "VMRestartPending"
return json.dumps(encryption_status)
def get_encryption_status(self):
encryption_status = {
"data": "NotEncrypted",
"os": "NotEncrypted"
}
mount_items = self.get_mount_items()
os_drive_encrypted = False
data_drives_found = False
data_drives_encrypted = True
for mount_item in mount_items:
if mount_item["fs"] in ["ext2", "ext4", "ext3", "xfs"] and \
not "/mnt" == mount_item["dest"] and \
not "/" == mount_item["dest"] and \
not "/oldroot/mnt/resource" == mount_item["dest"] and \
not "/oldroot/boot" == mount_item["dest"] and \
not "/oldroot" == mount_item["dest"] and \
not "/mnt/resource" == mount_item["dest"] and \
not "/boot" == mount_item["dest"]:
data_drives_found = True
if not "/dev/mapper" in mount_item["src"]:
self.logger.log("Data volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
data_drives_encrypted = False
if self.is_os_disk_lvm():
grep_result = self.command_executor.ExecuteInBash('pvdisplay | grep /dev/mapper/osencrypt', suppress_logging=True)
if grep_result == 0 and not os.path.exists('/volumes.lvm'):
self.logger.log("OS PV is encrypted")
os_drive_encrypted = True
elif mount_item["dest"] == "/" and \
"/dev/mapper" in mount_item["src"] or \
"/dev/dm" in mount_item["src"]:
self.logger.log("OS volume {0} is mounted from {1}".format(mount_item["dest"], mount_item["src"]))
os_drive_encrypted = True
if not data_drives_found:
encryption_status["data"] = "NotMounted"
elif data_drives_encrypted:
encryption_status["data"] = "Encrypted"
if os_drive_encrypted:
encryption_status["os"] = "Encrypted"
encryption_marker = EncryptionMarkConfig(self.logger, self.encryption_environment)
decryption_marker = DecryptionMarkConfig(self.logger, self.encryption_environment)
if decryption_marker.config_file_exists():
encryption_status["data"] = "DecryptionInProgress"
elif encryption_marker.config_file_exists():
encryption_config = EncryptionConfig(self.encryption_environment, self.logger)
volume_type = encryption_config.get_volume_type().lower()
if volume_type == CommonVariables.VolumeTypeData.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["data"] = "EncryptionInProgress"
if volume_type == CommonVariables.VolumeTypeOS.lower() or \
volume_type == CommonVariables.VolumeTypeAll.lower():
encryption_status["os"] = "EncryptionInProgress"
elif os.path.exists('/dev/mapper/osencrypt') and not os_drive_encrypted:
encryption_status["os"] = "VMRestartPending"
return json.dumps(encryption_status)
def daemon():
hutil.do_parse_context('Executing')
try:
# Ensure the same configuration is executed only once
# If the previous enable failed, we do not have retry logic here.
# TODO Remount all
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
if(encryption_marker.config_file_exists()):
logger.log("encryption is marked.")
"""
search for the bek volume, then mount it:)
"""
disk_util = DiskUtil(hutil, MyPatching, logger, encryption_environment)
encryption_config = EncryptionConfig(encryption_environment,logger)
bek_passphrase_file = None
"""
try to find the attached bek volume, and use the file to mount the crypted volumes,
and if the passphrase file is found, then we will re-use it for the future.
"""
bek_util = BekUtil(disk_util, logger)
if(encryption_config.config_file_exists()):
bek_passphrase_file = bek_util.get_bek_passphrase_file(encryption_config)
if(bek_passphrase_file is None):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status, CommonVariables.passphrase_file_not_found, 'Passphrase file not found.')
else:
"""
check whether there's a scheduled encryption task
"""
logger.log("trying to install the extras")
MyPatching.install_extras()
mount_all_result = disk_util.mount_all()
if(mount_all_result != CommonVariables.process_success):
logger.log(msg=("mount all failed with code " + str(mount_all_result)), level=CommonVariables.ErrorLevel)
"""
TODO: resuming the encryption for rebooting suddenly scenario
we need the special handling is because the half done device can be a error state: say, the file system header missing.so it could be
identified.
"""
ongoing_item_config = OnGoingItemConfig(encryption_environment=encryption_environment, logger=logger)
if(ongoing_item_config.config_file_exists()):
header_file_path = ongoing_item_config.get_header_file_path()
mount_point = ongoing_item_config.get_mount_point()
if(not none_or_empty(mount_point)):
logger.log("mount point is not empty, trying to unmount it first." + str(mount_point))
umount_status_code = disk_util.umount(mount_point)
logger.log("unmount return code is " + str(umount_status_code))
if(none_or_empty(header_file_path)):
encryption_result_phase = encrypt_inplace_without_seperate_header_file(passphrase_file = bek_passphrase_file, device_item = None,\
disk_util = disk_util, bek_util = bek_util, ongoing_item_config = ongoing_item_config)
else:
encryption_result_phase = encrypt_inplace_with_seperate_header_file(passphrase_file = bek_passphrase_file, device_item = None,\
disk_util = disk_util, bek_util = bek_util, ongoing_item_config = ongoing_item_config)
"""
if the resuming failed, we should fail.
"""
if(encryption_result_phase != CommonVariables.EncryptionPhaseDone):
hutil.do_exit(exit_code = 0, operation = 'Enable', status = CommonVariables.extension_error_status, code = CommonVariables.encryption_failed,\
message = 'resuming encryption for ' + str(ongoing_item_config.original_dev_path) + ' failed.')
else:
ongoing_item_config.clear_config()
else:
failed_item = None
if(encryption_marker.get_current_command() == CommonVariables.EnableEncryption):
failed_item = enable_encryption_all_in_place(passphrase_file= bek_passphrase_file, encryption_marker = encryption_marker, disk_util = disk_util, bek_util = bek_util)
elif(encryption_marker.get_current_command() == CommonVariables.EnableEncryptionFormat):
failed_item = enable_encryption_format(passphrase = bek_passphrase_file, encryption_marker = encryption_marker, disk_util = disk_util)
else:
logger.log(msg = ("command " + str(encryption_marker.get_current_command()) + " not supported"), level = CommonVariables.ErrorLevel)
#TODO do exit here
if(failed_item != None):
hutil.do_exit(exit_code = 0, operation = 'Enable', status = CommonVariables.extension_error_status, code = CommonVariables.encryption_failed,\
message = 'encryption failed for ' + str(failed_item))
else:
hutil.do_exit(exit_code = 0, operation = 'Enable', status = CommonVariables.extension_success_status, code = str(CommonVariables.success), message = encryption_config.get_secret_id())
except Exception as e:
# mount the file systems back.
error_msg = ("Failed to enable the extension with error: %s, stack trace: %s" % (str(e), traceback.format_exc()))
logger.log(msg = error_msg, level = CommonVariables.ErrorLevel)
hutil.do_exit(exit_code = 0, operation = 'Enable', status = CommonVariables.extension_error_status, code = str(CommonVariables.encryption_failed), \
message = error_msg)
finally:
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
#TODO not remove it, backed it up.
logger.log("clearing the encryption mark.")
encryption_marker.clear_config()
bek_util.umount_azure_passhprase(encryption_config)
logger.log("finally in daemon")
def enable():
hutil.do_parse_context('Enable')
# we need to start another subprocess to do it, because the initial process
# would be killed by the wala in 5 minutes.
logger.log('enabling...')
"""
trying to mount the crypted items.
"""
disk_util = DiskUtil(hutil = hutil, patching = MyPatching, logger = logger, encryption_environment = encryption_environment)
bek_util = BekUtil(disk_util, logger)
existed_passphrase_file = None
encryption_config = EncryptionConfig(encryption_environment=encryption_environment, logger = logger)
config_path_result = disk_util.make_sure_path_exists(encryption_environment.encryption_config_path)
if(config_path_result != CommonVariables.process_success):
logger.log(msg="azure encryption path creation failed.",level=CommonVariables.ErrorLevel)
if(encryption_config.config_file_exists()):
existed_passphrase_file = bek_util.get_bek_passphrase_file(encryption_config)
if(existed_passphrase_file is not None):
mount_encrypted_disks(disk_util=disk_util,bek_util=bek_util,encryption_config=encryption_config,passphrase_file=existed_passphrase_file)
else:
logger.log(msg="the config is there, but we could not get the bek file.",level=CommonVariables.WarningLevel)
exit_without_status_report()
# handle the re-call scenario. the re-call would resume?
# if there's one tag for the next reboot.
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
if (not encryption_marker.config_file_exists()):
machine_identity = MachineIdentity()
stored_identity = machine_identity.stored_identity()
if(stored_identity is None):
machine_identity.save_identity()
else:
current_identity = machine_identity.current_identity()
if(current_identity != stored_identity):
current_seq_no = -1
backup_logger.log("machine identity not same, set current_seq_no to " + str(current_seq_no) + " " + str(stored_identity) + " " + str(current_identity), True)
hutil.set_last_seq(current_seq_no)
machine_identity.save_identity()
# we should be careful about proceed for this case, we just
# failed this time to wait for customers' retry.
exit_without_status_report()
hutil.exit_if_same_seq()
hutil.save_seq()
try:
protected_settings_str = hutil._context._config['runtimeSettings'][0]['handlerSettings'].get('protectedSettings')
public_settings_str = hutil._context._config['runtimeSettings'][0]['handlerSettings'].get('publicSettings')
if(isinstance(public_settings_str,basestring)):
public_settings = json.loads(public_settings_str)
else:
public_settings = public_settings_str;
if(isinstance(protected_settings_str,basestring)):
protected_settings = json.loads(protected_settings_str)
else:
protected_settings = protected_settings_str
extension_parameter = ExtensionParameter(hutil, protected_settings, public_settings)
kek_secret_id_created = None
encryption_marker = EncryptionMarkConfig(logger, encryption_environment)
if encryption_marker.config_file_exists():
# verify the encryption mark
logger.log(msg="encryption mark is there, starting daemon.",level=CommonVariables.InfoLevel)
start_daemon()
else:
if(encryption_config.config_file_exists() and existed_passphrase_file is not None):
logger.log(msg="config file exists and passphrase file exists.", level=CommonVariables.WarningLevel)
encryption_marker = mark_encryption(command=extension_parameter.command, \
volume_type=extension_parameter.VolumeType, \
disk_format_query=extension_parameter.DiskFormatQuery)
start_daemon()
else:
"""
creating the secret, the secret would be transferred to a bek volume after the updatevm called in powershell.
"""
#store the luks passphrase in the secret.
keyVaultUtil = KeyVaultUtil(logger)
"""
validate the parameters
"""
if(extension_parameter.VolumeType != 'Data'):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status,str(CommonVariables.volue_type_not_support), 'VolumeType ' + str(extension_parameter.VolumeType) + ' is not supported.')
if(extension_parameter.command not in [CommonVariables.EnableEncryption, CommonVariables.EnableEncryptionFormat]):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status,str(CommonVariables.command_not_support), 'Command ' + str(extension_parameter.command) + ' is not supported.')
"""
this is the fresh call case
"""
#handle the passphrase related
if(existed_passphrase_file is None):
if(extension_parameter.passphrase is None or extension_parameter.passphrase == ""):
extension_parameter.passphrase = bek_util.generate_passphrase(extension_parameter.KeyEncryptionAlgorithm)
else:
logger.log(msg="the extension_parameter.passphrase is none")
kek_secret_id_created = keyVaultUtil.create_kek_secret(Passphrase = extension_parameter.passphrase,\
KeyVaultURL = extension_parameter.KeyVaultURL,\
KeyEncryptionKeyURL = extension_parameter.KeyEncryptionKeyURL,\
AADClientID = extension_parameter.AADClientID,\
KeyEncryptionAlgorithm = extension_parameter.KeyEncryptionAlgorithm,\
AADClientSecret = extension_parameter.AADClientSecret,\
DiskEncryptionKeyFileName = extension_parameter.DiskEncryptionKeyFileName)
if(kek_secret_id_created is None):
hutil.do_exit(0, 'Enable', CommonVariables.extension_error_status, str(CommonVariables.create_encryption_secret_failed), 'Enable failed.')
else:
encryption_config.passphrase_file_name = extension_parameter.DiskEncryptionKeyFileName
encryption_config.bek_filesystem = CommonVariables.BekVolumeFileSystem
encryption_config.secret_id = kek_secret_id_created
encryption_config.commit()
encryption_marker = mark_encryption(command=extension_parameter.command, \
volume_type=extension_parameter.VolumeType, \
disk_format_query=extension_parameter.DiskFormatQuery)
if(kek_secret_id_created != None):
hutil.do_exit(0, 'Enable', CommonVariables.extension_success_status, str(CommonVariables.success), str(kek_secret_id_created))
else:
"""
the enabling called again. the passphrase would be re-used.
"""
hutil.do_exit(0, 'Enable', CommonVariables.extension_success_status, str(CommonVariables.encrypttion_already_enabled), str(kek_secret_id_created))
except Exception as e:
logger.log(msg="Failed to enable the extension with error: %s, stack trace: %s" % (str(e), traceback.format_exc()),level=CommonVariables.ErrorLevel)
hutil.do_exit(0, 'Enable',CommonVariables.extension_error_status,str(CommonVariables.unknown_error), 'Enable failed.')