• E
    Encryption at rest support · 51778612
    Ewout Prangsma 提交于
    Summary:
    This PR adds support for encrypting data stored by RocksDB when written to disk.
    
    It adds an `EncryptedEnv` override of the `Env` class with matching overrides for sequential&random access files.
    The encryption itself is done through a configurable `EncryptionProvider`. This class creates is asked to create `BlockAccessCipherStream` for a file. This is where the actual encryption/decryption is being done.
    Currently there is a Counter mode implementation of `BlockAccessCipherStream` with a `ROT13` block cipher (NOTE the `ROT13` is for demo purposes only!!).
    
    The Counter operation mode uses an initial counter & random initialization vector (IV).
    Both are created randomly for each file and stored in a 4K (default size) block that is prefixed to that file. The `EncryptedEnv` implementation is such that clients of the `Env` class do not see this prefix (nor data, nor in filesize).
    The largest part of the prefix block is also encrypted, and there is room left for implementation specific settings/values/keys in there.
    
    To test the encryption, the `DBTestBase` class has been extended to consider a new environment variable called `ENCRYPTED_ENV`. If set, the test will setup a encrypted instance of the `Env` class to use for all tests.
    Typically you would run it like this:
    
    ```
    ENCRYPTED_ENV=1 make check_some
    ```
    
    There is also an added test that checks that some data inserted into the database is or is not "visible" on disk. With `ENCRYPTED_ENV` active it must not find plain text strings, with `ENCRYPTED_ENV` unset, it must find the plain text strings.
    Closes https://github.com/facebook/rocksdb/pull/2424
    
    Differential Revision: D5322178
    
    Pulled By: sdwilsh
    
    fbshipit-source-id: 253b0a9c2c498cc98f580df7f2623cbf7678a27f
    51778612
CMakeLists.txt 28.5 KB