Package org.gridgain.internal.encryption.raftlog

Class SegstoreRaftLogEntryEncryptor

java.lang.Object
org.gridgain.internal.encryption.raftlog.SegstoreRaftLogEntryEncryptor
All Implemented Interfaces:
org.apache.ignite.internal.lang.Debuggable, org.apache.ignite.internal.manager.IgniteComponent, org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor
public class SegstoreRaftLogEntryEncryptor extends Object implements org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor, org.apache.ignite.internal.manager.IgniteComponent
LogEntryEncryptor implementation for the "Segstore" Raft log.

Each Raft group gets its own data encryption key chain, keyed by the group id and stored in the Vault under a raft-specific prefix. Keys are created lazily when a group's log storage is created and dropped when it is destroyed.

An encrypted entry is laid out as [magic(1)][keyId(4, LE)][plaintextLength(4, LE)][IV][ciphertext], where the ciphertext is the AES-encrypted output of the base codec. The key id lets the right key be selected across key rotations; the plaintext length lets the decoder strip block-cipher padding. The magic byte distinguishes encrypted entries from plaintext ones, so both can coexist in a segment file.

  • Field Summary

    Fields inherited from interface org.apache.ignite.internal.lang.Debuggable

    INDENTATION

  • Constructor Summary

    Constructors
    Constructor
    Description
    SegstoreRaftLogEntryEncryptor(org.apache.ignite.internal.vault.VaultManager vaultManager, Supplier<org.gridgain.internal.encryption.EncryptionManager> encryptionManagerSupplier, org.apache.ignite.internal.failure.FailureProcessor failureProcessor)
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    beforeNodeStop()
     
    org.gridgain.internal.encryption.DataEncryptionKeyManager
    dataEncryptionKeyManager()
     
    boolean
    enabled()
     
    void
    ensureGroupKey(long groupId)
     
    void
    onGroupDestroyed(long groupId)
     
    CompletableFuture<Void>
    startAsync(org.apache.ignite.internal.manager.ComponentContext componentContext)
     
    CompletableFuture<Void>
    stopAsync(org.apache.ignite.internal.manager.ComponentContext componentContext)
     
    org.apache.ignite.raft.jraft.entity.codec.LogEntryDecoder
    wrapDecoder(org.apache.ignite.raft.jraft.entity.codec.LogEntryDecoder decoder, long groupId)
     
    org.apache.ignite.raft.jraft.entity.codec.LogEntryEncoder
    wrapEncoder(org.apache.ignite.raft.jraft.entity.codec.LogEntryEncoder encoder, long groupId)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.apache.ignite.internal.lang.Debuggable

    dumpState

    Methods inherited from interface org.apache.ignite.internal.manager.IgniteComponent

    stopAsync

  • Constructor Details

    • SegstoreRaftLogEntryEncryptor

      public SegstoreRaftLogEntryEncryptor(org.apache.ignite.internal.vault.VaultManager vaultManager, Supplier<org.gridgain.internal.encryption.EncryptionManager> encryptionManagerSupplier, org.apache.ignite.internal.failure.FailureProcessor failureProcessor)
      Constructor.
      Parameters:
      vaultManager - Vault manager used to persist the (KEK-wrapped) data encryption key chains.
      encryptionManagerSupplier - Supplier of the encryption manager (resolved on start).
      failureProcessor - Failure processor used to handle critical errors.

  • Method Details

    • startAsync

      public CompletableFuture<Void> startAsync(org.apache.ignite.internal.manager.ComponentContext componentContext)
      Specified by:
      startAsync in interface org.apache.ignite.internal.manager.IgniteComponent

    • beforeNodeStop

      public void beforeNodeStop()
      Specified by:
      beforeNodeStop in interface org.apache.ignite.internal.manager.IgniteComponent

    • stopAsync

      public CompletableFuture<Void> stopAsync(org.apache.ignite.internal.manager.ComponentContext componentContext)
      Specified by:
      stopAsync in interface org.apache.ignite.internal.manager.IgniteComponent

    • enabled

      public boolean enabled()
      Specified by:
      enabled in interface org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor

    • wrapEncoder

      public org.apache.ignite.raft.jraft.entity.codec.LogEntryEncoder wrapEncoder(org.apache.ignite.raft.jraft.entity.codec.LogEntryEncoder encoder, long groupId)
      Specified by:
      wrapEncoder in interface org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor

    • wrapDecoder

      public org.apache.ignite.raft.jraft.entity.codec.LogEntryDecoder wrapDecoder(org.apache.ignite.raft.jraft.entity.codec.LogEntryDecoder decoder, long groupId)
      Specified by:
      wrapDecoder in interface org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor

    • ensureGroupKey

      public void ensureGroupKey(long groupId)
      Specified by:
      ensureGroupKey in interface org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor

    • onGroupDestroyed

      public void onGroupDestroyed(long groupId)
      Specified by:
      onGroupDestroyed in interface org.apache.ignite.internal.raft.storage.segstore.LogEntryEncryptor

    • dataEncryptionKeyManager

      @TestOnly public org.gridgain.internal.encryption.DataEncryptionKeyManager dataEncryptionKeyManager()