Skip to content

debug: add encryption-status command.#28582

Merged
craig[bot] merged 1 commit intocockroachdb:masterfrom
mberhault:marc/debug_crypto
Aug 14, 2018
Merged

debug: add encryption-status command.#28582
craig[bot] merged 1 commit intocockroachdb:masterfrom
mberhault:marc/debug_crypto

Conversation

@mberhault
Copy link
Copy Markdown
Contributor

When encryption is enabled, this outputs full key details and associated
files.

Shows the hierarchy of store keys, data keys, and files.

We do not currently show encryption progress as it requires opening
rocksdb in read/write mode. This will eventually be added.

For example, this is the output on a store that has had two different
store keys and multiple data keys:

$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data,key=keys/aes-192.key,old-key=keys/aes-128.key cockroach-data
[
  {
    "ID": "222430e9b9e6bdb54b66dcb4124778da6c284a9d47e6a1637e0b26d059e61a80",
    "Type": "AES128_CTR",
    "Created": "2018-06-19 09:59:38 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-128.key",
    "DataKeys": [
      {
        "ID": "1cfd71ab16fdc332aea838ae70b7952f28bfd247fd9da8ebef03d9576f8b7d30",
        "Created": "2018-06-19 09:59:38 -0400 EDT",
        "Files": [
          "IDENTITY"
        ]
      }
    ]
  },
  {
    "ID": "dc8a5767b73746f69c9245fe01688c0f9b934adb2b592d2d199c4a85f6d72d93",
    "Active": true,
    "Type": "AES192_CTR",
    "Created": "2018-06-19 14:04:04 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-192.key",
    "Files": [
      "COCKROACHDB_DATA_KEYS"
    ],
    "DataKeys": [
      {
        "ID": "72b1a1162dbcc934f3d6c275ca845c1bfb74e81c24d9779132017ad5defcb7de",
        "Created": "2018-06-19 14:04:04 -0400 EDT"
      },
      {
        "ID": "99f26acfaf9004ebcfc8f7fad8d06e54ab101d5b3c77a0b7f912f5b270884564",
        "Created": "2018-07-09 11:59:11 -0400 EDT"
      },
      {
        "ID": "123df81c7ad822168bf2e84502691c68a07bba5af52e66b7b33751306c4ac9a8",
        "Active": true,
        "Created": "2018-08-08 07:16:27 -0400 EDT",
        "Files": [
          "000166.log",
          "000169.sst",
          "CURRENT",
          "MANIFEST-000165",
          "OPTIONS-000165",
          "OPTIONS-000168"
        ]
      }
    ]
  }
]

And on a store running with just plaintext (still with encryption flag
passed):

$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data2,key=plain,old-key=plain cockroach-data2
[
  {
    "ID": "plain",
    "Active": true,
    "Type": "Plaintext",
    "Created": "2018-06-19 14:24:31 -0400 EDT",
    "Source": "plain",
    "Files": [
      "000109.log",
      "000112.sst",
      "CURRENT",
      "MANIFEST-000108",
      "OPTIONS-000108",
      "OPTIONS-000111"
    ],
    "DataKeys": [
      {
        "ID": "plain",
        "Active": true,
        "Exposed": true,
        "Created": "2018-06-19 14:24:31 -0400 EDT"
      }
    ]
  }
]

A store that does not even use the file registry will not output
anything (eg: a store without the --enterprise-encryption flag).

Release note (enterprise change): add encryption-status debug command to
display encryption key information.

@mberhault mberhault requested a review from bdarnell August 14, 2018 17:23
@mberhault mberhault requested a review from a team as a code owner August 14, 2018 17:23
@mberhault mberhault requested review from a team August 14, 2018 17:23
@cockroach-teamcity
Copy link
Copy Markdown
Member

This change is Reviewable

return "plain";
}
return fmt::StringPrintf("ID: %s, Type: %s, Source: %s", info.key_id().substr(0, 8).c_str(),
return fmt::StringPrintf("ID: %s, Type: %s, Source: %s", info.key_id().c_str(),
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switch to displaying the key ID in full in the logs. This was the only place it was done, the Admin UI shows full key IDs.

@mberhault mberhault mentioned this pull request Aug 14, 2018
29 tasks
Copy link
Copy Markdown
Contributor

@bdarnell bdarnell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 19 of 19 files at r1.
Reviewable status: :shipit: complete! 0 of 0 LGTMs obtained


pkg/cli/debug.go, line 100 at r1 (raw file):

}

// OpenExistinStore opens the rocksdb engine rooted at 'dir'.

s/Existin/Existing/

When encryption is enabled, this outputs full key details and associated
files.

Shows the hierarchy of store keys, data keys, and files.

We do not currently show encryption progress as it requires opening
rocksdb in read/write mode. This will eventually be added.

For example, this is the output on a store that has had two different
store keys and multiple data keys:

```
$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data,key=keys/aes-192.key,old-key=keys/aes-128.key cockroach-data
[
  {
    "ID": "222430e9b9e6bdb54b66dcb4124778da6c284a9d47e6a1637e0b26d059e61a80",
    "Type": "AES128_CTR",
    "Created": "2018-06-19 09:59:38 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-128.key",
    "DataKeys": [
      {
        "ID": "1cfd71ab16fdc332aea838ae70b7952f28bfd247fd9da8ebef03d9576f8b7d30",
        "Created": "2018-06-19 09:59:38 -0400 EDT",
        "Files": [
          "IDENTITY"
        ]
      }
    ]
  },
  {
    "ID": "dc8a5767b73746f69c9245fe01688c0f9b934adb2b592d2d199c4a85f6d72d93",
    "Active": true,
    "Type": "AES192_CTR",
    "Created": "2018-06-19 14:04:04 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-192.key",
    "Files": [
      "COCKROACHDB_DATA_KEYS"
    ],
    "DataKeys": [
      {
        "ID": "72b1a1162dbcc934f3d6c275ca845c1bfb74e81c24d9779132017ad5defcb7de",
        "Created": "2018-06-19 14:04:04 -0400 EDT"
      },
      {
        "ID": "99f26acfaf9004ebcfc8f7fad8d06e54ab101d5b3c77a0b7f912f5b270884564",
        "Created": "2018-07-09 11:59:11 -0400 EDT"
      },
      {
        "ID": "123df81c7ad822168bf2e84502691c68a07bba5af52e66b7b33751306c4ac9a8",
        "Active": true,
        "Created": "2018-08-08 07:16:27 -0400 EDT",
        "Files": [
          "000166.log",
          "000169.sst",
          "CURRENT",
          "MANIFEST-000165",
          "OPTIONS-000165",
          "OPTIONS-000168"
        ]
      }
    ]
  }
]
```

And on a store running with just plaintext (still with encryption flag
passed):
```
$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data2,key=plain,old-key=plain cockroach-data2
[
  {
    "ID": "plain",
    "Active": true,
    "Type": "Plaintext",
    "Created": "2018-06-19 14:24:31 -0400 EDT",
    "Source": "plain",
    "Files": [
      "000109.log",
      "000112.sst",
      "CURRENT",
      "MANIFEST-000108",
      "OPTIONS-000108",
      "OPTIONS-000111"
    ],
    "DataKeys": [
      {
        "ID": "plain",
        "Active": true,
        "Exposed": true,
        "Created": "2018-06-19 14:24:31 -0400 EDT"
      }
    ]
  }
]
```

A store that does not even use the file registry will not output
anything (eg: a store without the `--enterprise-encryption` flag).

Release note (enterprise change): add encryption-status debug command to
display encryption key information.
Copy link
Copy Markdown
Contributor Author

@mberhault mberhault left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: :shipit: complete! 0 of 0 LGTMs obtained


pkg/cli/debug.go, line 100 at r1 (raw file):

Previously, bdarnell (Ben Darnell) wrote…

s/Existin/Existing/

Done, as well as other lint errors.

@mberhault
Copy link
Copy Markdown
Contributor Author

bors r+

craig bot pushed a commit that referenced this pull request Aug 14, 2018
28582: debug: add encryption-status command. r=mberhault a=mberhault

When encryption is enabled, this outputs full key details and associated
files.

Shows the hierarchy of store keys, data keys, and files.

We do not currently show encryption progress as it requires opening
rocksdb in read/write mode. This will eventually be added.

For example, this is the output on a store that has had two different
store keys and multiple data keys:

```
$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data,key=keys/aes-192.key,old-key=keys/aes-128.key cockroach-data
[
  {
    "ID": "222430e9b9e6bdb54b66dcb4124778da6c284a9d47e6a1637e0b26d059e61a80",
    "Type": "AES128_CTR",
    "Created": "2018-06-19 09:59:38 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-128.key",
    "DataKeys": [
      {
        "ID": "1cfd71ab16fdc332aea838ae70b7952f28bfd247fd9da8ebef03d9576f8b7d30",
        "Created": "2018-06-19 09:59:38 -0400 EDT",
        "Files": [
          "IDENTITY"
        ]
      }
    ]
  },
  {
    "ID": "dc8a5767b73746f69c9245fe01688c0f9b934adb2b592d2d199c4a85f6d72d93",
    "Active": true,
    "Type": "AES192_CTR",
    "Created": "2018-06-19 14:04:04 -0400 EDT",
    "Source": "/store/cockroach/src/github.com/cockroachdb/cockroach/keys/aes-192.key",
    "Files": [
      "COCKROACHDB_DATA_KEYS"
    ],
    "DataKeys": [
      {
        "ID": "72b1a1162dbcc934f3d6c275ca845c1bfb74e81c24d9779132017ad5defcb7de",
        "Created": "2018-06-19 14:04:04 -0400 EDT"
      },
      {
        "ID": "99f26acfaf9004ebcfc8f7fad8d06e54ab101d5b3c77a0b7f912f5b270884564",
        "Created": "2018-07-09 11:59:11 -0400 EDT"
      },
      {
        "ID": "123df81c7ad822168bf2e84502691c68a07bba5af52e66b7b33751306c4ac9a8",
        "Active": true,
        "Created": "2018-08-08 07:16:27 -0400 EDT",
        "Files": [
          "000166.log",
          "000169.sst",
          "CURRENT",
          "MANIFEST-000165",
          "OPTIONS-000165",
          "OPTIONS-000168"
        ]
      }
    ]
  }
]
```

And on a store running with just plaintext (still with encryption flag
passed):
```
$ ./cockroach debug encryption-status --enterprise-encryption=path=cockroach-data2,key=plain,old-key=plain cockroach-data2
[
  {
    "ID": "plain",
    "Active": true,
    "Type": "Plaintext",
    "Created": "2018-06-19 14:24:31 -0400 EDT",
    "Source": "plain",
    "Files": [
      "000109.log",
      "000112.sst",
      "CURRENT",
      "MANIFEST-000108",
      "OPTIONS-000108",
      "OPTIONS-000111"
    ],
    "DataKeys": [
      {
        "ID": "plain",
        "Active": true,
        "Exposed": true,
        "Created": "2018-06-19 14:24:31 -0400 EDT"
      }
    ]
  }
]
```

A store that does not even use the file registry will not output
anything (eg: a store without the `--enterprise-encryption` flag).

Release note (enterprise change): add encryption-status debug command to
display encryption key information.

Co-authored-by: marc <marc@cockroachlabs.com>
@craig
Copy link
Copy Markdown
Contributor

craig bot commented Aug 14, 2018

Build succeeded

@craig craig bot merged commit d44e68e into cockroachdb:master Aug 14, 2018
@mberhault mberhault deleted the marc/debug_crypto branch August 14, 2018 19:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants