openstack/octavia
Code Issues Proposed changes

Fix cryptsetup --pbkdf-memory failures

Browse Source 
A recent patch[1] added --pbkdf-memory to the cryptsetup command line
to limit the memory cryptsetup is using. However, some distros use
an older version of cryptsetup that does not need this setting.
This patch adds logic to detect this and run the commands without
--pbkdf-memory.

[1] https://review.opendev.org/663784

Change-Id: I9e0debcbfe6ceeff0012c827d70d80d938b5a2fb
Story: 2006066
Task: 34782
This commit is contained in:
Michael Johnson 2019-06-28 10:18:10 -07:00
parent 58a4490bbf
commit 2bb2f918ee
5 changed files with 23 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
elements/certs-ramfs/element-deps
View File

@ -1,2 +1,3 @@
dib-init-system dib-init-system
package-installs package-installs
install-static

2
elements/certs-ramfs/init-scripts/systemd/certs-ramfs.service
View File

@ -4,7 +4,7 @@ After=cloud-config.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=/bin/sh -c 'modprobe brd; passphrase=$$(head /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 32 | head -n 1); certs_path=$$(awk "/base_cert_dir / {printf \\$$3}" /etc/octavia/amphora-agent.conf); mkdir -p "$${certs_path}"; echo -n "$${passphrase}" | cryptsetup --pbkdf-memory=262144 luksFormat /dev/ram0 -; echo -n "$${passphrase}" | cryptsetup --pbkdf-memory=262144 luksOpen /dev/ram0 certfs-ramfs -; mkfs.ext2 /dev/mapper/certfs-ramfs; mount /dev/mapper/certfs-ramfs "$${certs_path}"' ExecStart=/usr/local/bin/certfs-ramfs
ExecStop=/bin/sh -c 'certs_path=$$(awk "/base_cert_dir / {printf \\$$3}" /etc/octavia/amphora-agent.conf); umount "$${certs_path}"; cryptsetup luksClose /dev/mapper/certfs-ramfs;' ExecStop=/bin/sh -c 'certs_path=$$(awk "/base_cert_dir / {printf \\$$3}" /etc/octavia/amphora-agent.conf); umount "$${certs_path}"; cryptsetup luksClose /dev/mapper/certfs-ramfs;'
RemainAfterExit=yes RemainAfterExit=yes
TimeoutSec=0 TimeoutSec=0

9
elements/certs-ramfs/init-scripts/sysv/certs-ramfs
View File

@ -17,14 +17,7 @@ NAME=certs-ramfs
case $1 in case $1 in
start) start)
log_daemon_msg "Starting the process" "$NAME" log_daemon_msg "Starting the process" "$NAME"
modprobe brd /usr/local/bin/certfs-ramfs
passphrase=$(head /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 32 | head -n 1)
certs_path=$(awk "/base_cert_dir / {printf \$3}" /etc/octavia/amphora-agent.conf)
mkdir -p "${certs_path}"
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksFormat /dev/ram0 -
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksOpen /dev/ram0 certfs-ramfs -
mkfs.ext2 /dev/mapper/certfs-ramfs
mount /dev/mapper/certfs-ramfs "${certs_path}"
log_end_msg 0 log_end_msg 0
;; ;;
stop) stop)

9
elements/certs-ramfs/init-scripts/upstart/certs-ramfs.conf
View File

@ -4,14 +4,7 @@ start on started cloud-config
stop on runlevel [!2345] stop on runlevel [!2345]
pre-start script pre-start script
modprobe brd /usr/local/bin/certfs-ramfs
passphrase=$(head /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 32 | head -n 1)
certs_path=$(awk "/base_cert_dir / {printf \$3}" /etc/octavia/amphora-agent.conf)
mkdir -p "${certs_path}"
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksFormat /dev/ram0 -
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksOpen /dev/ram0 certfs-ramfs -
mkfs.ext2 /dev/mapper/certfs-ramfs
mount /dev/mapper/certfs-ramfs "${certs_path}"
end script end script
post-stop script post-stop script

19
elements/certs-ramfs/static/usr/local/bin/certfs-ramfs Executable file
View File

@ -0,0 +1,19 @@
#!/bin/bash
modprobe brd
passphrase=$(head /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 32 | head -n 1)
certs_path=$(awk "/base_cert_dir / {printf \$3}" /etc/octavia/amphora-agent.conf)
mkdir -p "${certs_path}"
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksFormat /dev/ram0 -
# Some distrobutions have an old cryptsetup, try without --pbkdf-memory
if [ $? -eq 0 ]
then
echo -n "${passphrase}" | cryptsetup --pbkdf-memory=262144 luksOpen /dev/ram0 certfs-ramfs -
else
echo -n "${passphrase}" | cryptsetup luksFormat /dev/ram0 -
echo -n "${passphrase}" | cryptsetup luksOpen /dev/ram0 certfs-ramfs -
fi
mkfs.ext2 /dev/mapper/certfs-ramfs
mount /dev/mapper/certfs-ramfs "${certs_path}"