zfs crypto discuss - Mar 2008 - [Bug 879] New: zfs create hangs creating an unencrypted dataset under and encrypted one

http://defect.opensolaris.org/bz/show_bug.cgi?id=879

           Summary: zfs create hangs creating an unencrypted dataset under
                    and encrypted one
    Classification: Development
           Product: zfs-crypto
           Version: unspecified
          Platform: Other
        OS/Version: Solaris
            Status: NEW
          Severity: major
          Priority: P3
         Component: other
        AssignedTo: ajscarp at yahoo.com
        ReportedBy: ajscarp at yahoo.com
         QAContact: hua.tang at sun.com
                CC: zfs-crypto-discuss at opensolaris.org
   Estimated Hours: 0.0


zfs create hangs when creating an unencrypted dataset under and encrypted one

tank/             <- pool - keysource set
tank/test/        <- encrypted - keyscope=pool
tank/test/clear   <- unencrypted


# zfs create tank/test/clear
Mar 27 14:44:06 cag-v240b zfs: WARNING: zio_crypt_unwrap_key failed 10
^C
^Z
.. dead..


My guess is the dataset is inheriting the encrypted properties..

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879


ajscarp at yahoo.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |INCOMPLETE




--- Comment #1 from ajscarp at yahoo.com  2008-03-31 23:06:45 ---
cannot reproduce.. leaving it for right now in case it emerges again.. perhaps
a random problem..

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #2 from ajscarp at yahoo.com  2008-04-01 15:32:28 ---
Created an attachment (id=137)
 --> (http://defect.opensolaris.org/bz/attachment.cgi?id=137)
dtrace log of the hang..

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879


ajscarp at yahoo.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|INCOMPLETE                  |NEW




--- Comment #3 from ajscarp at yahoo.com  2008-04-01 15:32:51 ---
found it again, or at least the error now shows up in a different place....
previous incarnations were via keyscope=pool... but now found it with
keyscope=dataset.


bash-3.2# zpool create -f -o keysource=passphrase,prompt tank c0t0d0s6
as
Enter passphrase for ''tank'': 
Enter again: 
bash-3.2# zfs create -o encryption=on -o keyscope=dataset -o keysource=passphra
se,prompt tank/enc-d
Enter passphrase for ''tank/enc-d'': 
Enter again: 
bash-3.2# zfs create -o encryption=off tank/enc-d/clear
<hang>

Looking at dtrace results, the hang occurs somewhere inside of

dsl_sync_task_do()
in dmu_objset_create()
in zfs_ioc_create() @ line 2143

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879


ajscarp at yahoo.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|ajscarp at yahoo.com           |darrenm at opensolaris.org




-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879


Darren J Moffat <darrenm at opensolaris.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ACCEPTED




--- Comment #4 from Darren J Moffat <darrenm at opensolaris.org> 
2008-04-02 09:48:25 ---
  1  -> dsl_crypto_key_gen                    
  1  <- dsl_crypto_key_gen                    return(0)
  2  -> zio_encrypt_data                      crypt=4
  2    -> zio_crypt_key_lookup                
  2      -> spa_keystore_find                 40
  2        -> spa_keystore_compare            
  2        <- spa_keystore_compare            
  2      <- spa_keystore_find                 
  2      -> dsl_prop_get_ds_locked            keyscope -1098976359992
  2      <- dsl_prop_get_ds_locked            
  2    <- zio_crypt_key_lookup                return(0x0)
  2  <- zio_encrypt_data                      return(13)


The above dtrace fragment shows that we looked up the key for dataset 40 (the
one we are creating) because crypt=4  However the command we ran was:

# zfs create -o encryption=off tank/pp/a

Need to find out why we ended up in zio_encrypt_data() with crypt=4 when at the
CLI we specified encryption=off explicitly.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #5 from ajscarp at yahoo.com  2008-04-02 09:57:40 ---
Could this be causing 939 (checksum being set to sha256+mac for unencrypted
datasets)?

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #6 from Darren J Moffat <darrenm at opensolaris.org> 
2008-04-02 13:46:51 ---
Could well be related yes.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #7 from Darren J Moffat <darrenm at opensolaris.org> 
2008-04-03 11:30:50 ---
I only seem to be able to reproduce this problem with keyscope=dataset not
keyscope=pool on the parent encrypted dataset.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #8 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-07 08:51:04 ---
  1  -> dmu_objset_create_check               
  1   | dmu_objset_create_check:entry         
  1   | dmu_objset_create_check:return        return(0)
  1  <- dmu_objset_create_check               return(0)
  1  -> dsl_crypto_key_gen                    
  1  <- dsl_crypto_key_gen                    return(0)
  1  -> zio_encrypt_data                      crypt=4
  1    -> zio_crypt_key_lookup                
  1      -> spa_keystore_find                 42
  1        -> spa_keystore_compare            
  1        <- spa_keystore_compare            
  1        -> spa_keystore_compare            
  1        <- spa_keystore_compare            
  1      <- spa_keystore_find                 
  1    <- zio_crypt_key_lookup                return(0x0)
  1  <- zio_encrypt_data                      return(2)

This seems wrong because objset 42 is supposed to have encryption=off.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #9 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-07 08:52:34 ---
*** Bug 939 has been marked as a duplicate of this bug. ***

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #10 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-07 08:54:38 ---
braveheart# zfs create -o checksum=sha256 -o encryption=off t/pp/tryagain  
cannot create ''t/pp/tryagain'': encryption requires that
checksum not be set.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #11 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-08 09:42:19 ---
Some more data...

Creating an encrypted dataset with keyscope=pool below a keyscope=dataset one
with encryption turned on works.

There is also a problem creating keyscope=dataset with encryption=on when
keyscope, keysource and encryption are inherited for example:


t/pp  encryption       on                     local
t/pp  keysource        passphrase,prompt      local
t/pp  keyscope         dataset                local
t/pp  keystatus        available              -

braveheart# zfs create t/pp/1
DEBUG: need inherit crypt
DEBUG: need inherit keyscope
DEBUG: inheriting crypt
DEBUG: crypt = 1
DEBUG: inheriting keyscope
DEBUG: keyscope = 2
DEBUG: inherit keysource
DEBUG: keysource="passphrase,prompt"
Enter passphrase for ''t/pp/1'': 
Enter again: 
salt==0
salt==15921639920224398131
outkey
(135135128)=e8c0efec7cb12441cd85d9166a287bafaff7f6b56bacf88716341961dee59a9
zic_key (135135128)
cannot create ''t/pp/1'': parent ''t/pp'' is not
a filesystem

This case is failing because zio_crypt_key_from_ioc() returns EINVAL.

Turns out that we don''t know the value of the encryption property
unless it is
explicitly set.  However that doesn''t properly explain the case were we
do set
it to encryption=off.

Continuing debugging.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879





--- Comment #12 from ajscarp at yahoo.com  2008-05-09 00:51:20 ---
some of the 939 aspects of this bug have been integrated.. sha256+mac and
encryption properties should be set property when going down to the kernel..

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://defect.opensolaris.org/bz/show_bug.cgi?id=879


Darren J Moffat <darrenm at opensolaris.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ACCEPTED                    |CLOSED
         Resolution|                            |WONTFIX




--- Comment #13 from Darren J Moffat <darrenm at opensolaris.org> 
2008-05-19 12:48:30 ---
I''m marking this as will not fix since Tony has integrated code to stop
this
situation occurring.  We aren''t going to support encryption=off
datasets below
datasets that have encryption enabled.

-- 
Configure bugmail: http://defect.opensolaris.org/bz/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.