From ac8a7e91e33abe4089cafb2ffa0509b5ce02039c Mon Sep 17 00:00:00 2001 From: Matt Riedemann Date: Sat, 20 Jun 2015 13:33:06 -0700 Subject: [PATCH] Handle KeyError when volume encryption is not supported When attaching a volume, after the connection is initialized to the volume in Cinder, the nova.volume.encryptors.get_encryption_metadata method is called to get encryption metadata for the volume. That call is based on the 'encrypted' key in connection_info['data'] returned from the os-initialize_connection Cinder API. However, just because the volume has an encryption key in Cinder does not mean that the corresponding volume driver in Nova supports encrypting the volume, like in the case of RBD volumes. Tempest has tests for encrypted volumes which succeed today in the Ceph job but they are actually false positives since without Cinder change I03f8cae05cc117e14f7482115de685fc9f3fa54a, the 'encrypted' key is not set in the connection_info dict and Nova doesn't attempt encryption of the volume during attach. The Ceph job fails when encrypted=True is in connection_info because cryptsetup (and luks which extends cryptsetup) requires the 'device_path' key in the connection_info dict, which is set when connecting the volume during attach via the corresponding Nova volume driver. In the case of RBD and libvirt, the LibvirtNetVolumeDriver is used and the 'device_path' key isn't set, so a KeyError is raised when trying to construct the CryptsetupEncryptor or LuksEncryptor objects. This change adds a check in CryptsetupEncryptor such that if the device_path is not in connection_info, a VolumeEcnryptionNotSupported error is raised rather than KeyError. Note that this doesn't fix the encrypted volume tests in Tempest. Those tests fail due to a timeout waiting for the volume status to be 'in-use' which doesn't happen since the compute manager rolls back the reservation on the volume when the error occurs. The Tempest tests will have to be skipped in the Ceph job until volume encryption is supported for RBD in Nova, which will be a separate set of changes. Related-Bug: #1463525 Change-Id: I8efc2628b09d4e9e59831353daa080b20e17ccde --- nova/exception.py | 5 +++++ .../tests/unit/volume/encryptors/test_cryptsetup.py | 13 +++++++++++++ nova/volume/encryptors/cryptsetup.py | 10 ++++++++++ 3 files changed, 28 insertions(+) diff --git a/nova/exception.py b/nova/exception.py index 7b0533435630..67f63a91b470 100644 --- a/nova/exception.py +++ b/nova/exception.py @@ -279,6 +279,11 @@ class VolumeNotCreated(NovaException): " attempts. And its status is %(volume_status)s.") +class VolumeEncryptionNotSupported(Invalid): + msg_fmt = _("Volume encryption is not supported for %(volume_type)s " + "volume %(volume_id)s") + + class InvalidKeypair(Invalid): ec2_code = 'InvalidKeyPair.Format' msg_fmt = _("Keypair data is invalid: %(reason)s") diff --git a/nova/tests/unit/volume/encryptors/test_cryptsetup.py b/nova/tests/unit/volume/encryptors/test_cryptsetup.py index ec9beadd1afb..5e523068cd7f 100644 --- a/nova/tests/unit/volume/encryptors/test_cryptsetup.py +++ b/nova/tests/unit/volume/encryptors/test_cryptsetup.py @@ -17,7 +17,9 @@ import array import mock +import six +from nova import exception from nova.keymgr import key from nova.tests.unit.volume.encryptors import test_base from nova.volume.encryptors import cryptsetup @@ -89,3 +91,14 @@ class CryptsetupEncryptorTestCase(test_base.VolumeEncryptorTestCase): run_as_root=True, check_exit_code=True), ]) self.assertEqual(1, mock_execute.call_count) + + def test_init_volume_encryption_not_supported(self): + # Tests that creating a CryptsetupEncryptor fails if there is no + # device_path key. + type = 'unencryptable' + data = dict(volume_id='a194699b-aa07-4433-a945-a5d23802043e') + connection_info = dict(driver_volume_type=type, data=data) + exc = self.assertRaises(exception.VolumeEncryptionNotSupported, + cryptsetup.CryptsetupEncryptor, + connection_info) + self.assertIn(type, six.text_type(exc)) diff --git a/nova/volume/encryptors/cryptsetup.py b/nova/volume/encryptors/cryptsetup.py index a4343a1cbfaa..3b5bcadd5a6c 100644 --- a/nova/volume/encryptors/cryptsetup.py +++ b/nova/volume/encryptors/cryptsetup.py @@ -18,6 +18,7 @@ import os from oslo_log import log as logging +from nova import exception from nova import utils from nova.volume.encryptors import base @@ -34,6 +35,15 @@ class CryptsetupEncryptor(base.VolumeEncryptor): def __init__(self, connection_info, **kwargs): super(CryptsetupEncryptor, self).__init__(connection_info, **kwargs) + # Fail if no device_path was set when connecting the volume, e.g. in + # the case of libvirt network volume drivers. + data = connection_info['data'] + if not data.get('device_path'): + volume_id = data.get('volume_id') or connection_info.get('serial') + raise exception.VolumeEncryptionNotSupported( + volume_id=volume_id, + volume_type=connection_info['driver_volume_type']) + # the device's path as given to libvirt -- e.g., /dev/disk/by-path/... self.symlink_path = connection_info['data']['device_path']