Add ability to encrypt backup stream
The primary purpose of this functionality is to allow a parallel, streamed backup to be encrypted where the encryption may also be executed in parallel.
Encryption will be done through the libgcrypt library which can be found documented here: http://
Addition of libgcrypt requires now that libgcrypt and libgpgerror packages be installed.
Many package repositories still contain older versions of libgcrypt. The current stable version of 1.5.0 is reccomended and will take advantage of the AES-NI instruction set if available.
Similar to compression, encryption is not supported on streamed tar backups.
New options:
--encrypt=
--encrypt_
--encrypt_
--encrypt_
--encrypt_
--compress_
encrypt_key and encrypt_key_file are mutually exclusive. If --encrypt is specified, one of these MUST be specified else an error will occur.
The coding task was fairly straight forward with some restructure/
- Update/set copyright notice in new and touched files to Copyright (c) 2011 Percona Ireland Ltd.
- Implemented new ds_stdout data sink.
- Split the ds_stream data sink into two new, more specific data sinks, ds_archive and ds_xbstream.
- Implement write callback model for ds_xbstream similar to libarchive.
- Change ds_archive and ds_xbstream over to using callback write models.
- Add new option to compression --compress_
- Implement xbcrypt format reader/writer. Format encapsulated as follows:
8 bytes - magic string "XBCRYP01"
8 bytes - reserved
8 bytes - original size
8 bytes - encrypted size
4 bytes - checksum
'encrypted size' bytes - encrypted data
- Implement a new ds_encrypt datasync modeled after the existing compression datasync which will use libgcrypt for actual encryption task and write callbacks.
- Add new options, options validations and pass through innobackupex.
- Implement new utility xbcrypt modeled after xbstream to perform encryption outside of xtrabackup for metadata and to offer a means of decrypting an encrypted backup.
- Implement new tests and refactor test script structure a little to make adding new, similar test cases a little easier.
Blueprint information
- Status:
- Complete
- Approver:
- Alexey Kopytov
- Priority:
- Essential
- Drafter:
- George Ormond Lorch III
- Direction:
- Approved
- Assignee:
- George Ormond Lorch III
- Definition:
- Approved
- Series goal:
- Accepted for 2.1
- Implementation:
- Implemented
- Milestone target:
- 2.1.0-alpha1
- Started by
- Alexey Kopytov
- Completed by
- Alexey Kopytov