feat: nydus support encrypted images #1333

taoohong · 2023-06-20T06:04:41Z

Extend native nydus v6 to support handling encrypted containers images:

An encrypted nydus image is composed of encrypted bootstrap and chunk-level encrypted data blobs. The bootstrap is encrypted by the Ocicrypt and the data blobs are encrypted by aes-128-xts with randomly generated key and iv at chunk-level.
The chunk encryption key and iv are stored in the blob info reusing some items of the structure to save reserved space.
For every data blob, all the chunk data, conpression context. table and compression context table header are encrypted.
Encrypted chunk data will be decrypted first, and then be decompressed while bing fetched by the storage backend.

Related issue

anolis-bot · 2023-06-20T06:04:51Z

@taoohong , a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/79505

codecov · 2023-06-20T06:09:15Z

Codecov Report

Merging #1333 (0314971) into master (c1247fd) will increase coverage by 0.00%.
The diff coverage is 38.61%.

@@           Coverage Diff            @@
##           master    #1333    +/-   ##
========================================
  Coverage   45.70%   45.71%            
========================================
  Files         123      122     -1     
  Lines       37287    37681   +394     
  Branches    37287    37681   +394     
========================================
+ Hits        17043    17224   +181     
- Misses      19347    19546   +199     
- Partials      897      911    +14

Impacted Files	Coverage Δ
builder/src/compact.rs	`0.00% <0.00%> (ø)`
builder/src/core/blob.rs	`13.63% <0.00%> (-0.45%)`	⬇️
builder/src/core/v6.rs	`32.33% <0.00%> (-0.12%)`	⬇️
builder/src/merge.rs	`0.00% <0.00%> (ø)`
builder/src/stargz.rs	`0.00% <0.00%> (ø)`
rafs/src/metadata/mod.rs	`52.28% <0.00%> (-1.54%)`	⬇️
src/bin/nydus-image/inspect.rs	`13.18% <0.00%> (-0.05%)`	⬇️
storage/src/cache/dummycache.rs	`21.23% <0.00%> (-0.45%)`	⬇️
storage/src/cache/filecache/mod.rs	`66.54% <0.00%> (-1.22%)`	⬇️
storage/src/lib.rs	`28.57% <ø> (ø)`
... and 14 more

... and 4 files with indirect coverage changes

anolis-bot · 2023-06-20T06:10:07Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		❌ FAIL

Sorry, your test job failed. Please get the details in the link.

anolis-bot · 2023-06-20T06:12:35Z

@taoohong , the title has been updated, so a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/79511

anolis-bot · 2023-06-20T06:17:50Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		❌ FAIL

Sorry, your test job failed. Please get the details in the link.

utils/src/crypt.rs

builder/src/core/blob.rs

anolis-bot · 2023-06-20T08:25:46Z

@taoohong , the code has been updated, so a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/79673

anolis-bot · 2023-06-20T08:43:32Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		✅ SUCCESS
compile ctr remote		✅ SUCCESS
compile nydus snapshotter		✅ SUCCESS
run container with rafs		✅ SUCCESS
run container with zran		✅ SUCCESS
run container with rafs and compile linux		✅ SUCCESS

Congratulations, your test job passed!

anolis-bot · 2023-06-24T08:43:30Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		✅ SUCCESS
compile ctr remote		✅ SUCCESS
compile nydus snapshotter		✅ SUCCESS
run container with rafs		✅ SUCCESS
run container with zran		✅ SUCCESS
run container with rafs and compile linux		❌ FAIL

Sorry, your test job failed. Please get the details in the link.

bergwolf · 2023-07-03T08:47:33Z

The bootstrap is encrypted by the Ocicrypt and the data blobs are encrypted by aes-128-xts with randomly generated key and iv at chunk-level.

What is iv? And I thought we agreed on using convergent encryption for shared chunk data encryption. Any reason why it got dropped?

taoohong · 2023-07-03T08:59:59Z

The bootstrap is encrypted by the Ocicrypt and the data blobs are encrypted by aes-128-xts with randomly generated key and iv at chunk-level.

The IV is used to ensure that the same plaintext block encrypted with the same data encryption key produces a different ciphertext block each time.

The bootstrap is encrypted by the Ocicrypt and the data blobs are encrypted by aes-128-xts with randomly generated key and iv at chunk-level.

What is iv? And I thought we agreed on using convergent encryption for shared chunk data encryption. Any reason why it got dropped?

The IV is used to ensure that the same plaintext block encrypted with the same data encryption key produces a different ciphertext block each time. It's usually suggested to be provided when using AES in xts mode.
About Convergent encryption you mean CipherContext with convergent_encryption set true? It's not really dropped, the related codes are moved to utils/crypt.rs to make them capable of being more commonly and easily used by storage or rafs subsystems.

rafs/src/metadata/layout/v6.rs

utils/src/crypt.rs

anolis-bot · 2023-07-04T01:57:46Z

@taoohong , the code has been updated, so a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/82310

anolis-bot · 2023-07-04T02:55:01Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		✅ SUCCESS
compile ctr remote		✅ SUCCESS
compile nydus snapshotter		✅ SUCCESS
run container with rafs		✅ SUCCESS
run container with zran		✅ SUCCESS
run container with rafs and compile linux		❌ FAIL

Sorry, your test job failed. Please get the details in the link.

bergwolf

Thanks!

just found out that there's no tests for this.

bergwolf · 2023-07-04T03:19:38Z

@taoohong The implementation looks good. Could you add some integration tests (in the smoke/tests/ directory) so that it is actually tested?

taoohong · 2023-07-04T03:20:54Z

Thanks!

@taoohong The implementation looks good. Could you add some integration tests (in the smoke/tests/ directory) so that it is actually tested?

I'd like to. THX for your review 👍

Extend native nydus v6 to support handling encrypted containers images: * An encrypted nydus image is composed of encrypted bootstrap and chunk-level encrypted data blobs. The bootstrap is encrypted by the Ocicrypt and the data blobs are encrypted by aes-128-xts with randomly generated key and iv at chunk-level. * For every data blob, all the chunk data, conpression context. table and compression context table header are encrypted. * The chunk encryption key and iv are stored in the blob info reusing some items of the structure to save reserved space. * Encrypted chunk data will be decrypted and then be decompressed while be fetched by the storage backend. * Encrypted or unencrypted blobs can be merged together. Signed-off-by: taohong <[email protected]>

anolis-bot · 2023-07-04T07:53:15Z

@taoohong , the code has been updated, so a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/82345

Add image encryption test integration case to Smoke test. Signed-off-by: taohong <[email protected]>

anolis-bot · 2023-07-04T07:55:46Z

@taoohong , the code has been updated, so a new test job has been submitted. Please wait in patience. The test job url: https://tone.openanolis.cn/ws/nrh4nnio/test_result/82346

anolis-bot · 2023-07-04T08:48:16Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		✅ SUCCESS
compile ctr remote		✅ SUCCESS
compile nydus snapshotter		✅ SUCCESS
run container with rafs		✅ SUCCESS
run container with zran		✅ SUCCESS
run container with rafs and compile linux		✅ SUCCESS

Congratulations, your test job passed!

anolis-bot · 2023-07-04T11:10:36Z

@taoohong , The CI test is completed, please check result:

Test Case		Test Result
build rust golang image		✅ SUCCESS
compile nydusd		✅ SUCCESS
compile ctr remote		✅ SUCCESS
compile nydus snapshotter		✅ SUCCESS
run container with rafs		✅ SUCCESS
run container with zran		✅ SUCCESS
run container with rafs and compile linux		✅ SUCCESS

Congratulations, your test job passed!

taoohong requested a review from a team as a code owner June 20, 2023 06:04

taoohong requested review from jiangliu, changweige and adamqqqplay and removed request for a team June 20, 2023 06:04

anolis-bot added the anolis_testing label Jun 20, 2023

taoohong mentioned this pull request Jun 20, 2023

Nydus Supports Encyrpted Images #1334

Closed

5 tasks

anolis-bot added anolis_test_fail and removed anolis_testing labels Jun 20, 2023

anolis-bot added anolis_testing and removed anolis_test_fail labels Jun 20, 2023

anolis-bot added anolis_test_fail and removed anolis_testing labels Jun 20, 2023

jiangliu reviewed Jun 20, 2023

View reviewed changes

utils/src/crypt.rs Outdated Show resolved Hide resolved

jiangliu reviewed Jun 20, 2023

View reviewed changes

builder/src/core/blob.rs Outdated Show resolved Hide resolved

jiangliu reviewed Jun 20, 2023

View reviewed changes

builder/src/core/blob.rs Show resolved Hide resolved

taoohong force-pushed the encryption-nydus branch from 833cbe9 to c74b4a0 Compare June 20, 2023 08:23

anolis-bot added anolis_testing and removed anolis_test_fail labels Jun 20, 2023

anolis-bot added anolis_test_pass and removed anolis_testing labels Jun 20, 2023

taoohong force-pushed the encryption-nydus branch from c74b4a0 to bfbdbda Compare June 20, 2023 09:00

anolis-bot removed the anolis_test_pass label Jun 20, 2023

bergwolf reviewed Jul 3, 2023

View reviewed changes

rafs/src/metadata/layout/v6.rs Show resolved Hide resolved

bergwolf reviewed Jul 3, 2023

View reviewed changes

utils/src/crypt.rs Outdated Show resolved Hide resolved

utils/src/crypt.rs Outdated Show resolved Hide resolved

taoohong force-pushed the encryption-nydus branch from ad64e56 to 22ad0e2 Compare July 4, 2023 01:55

anolis-bot added anolis_testing and removed anolis_test_fail labels Jul 4, 2023

anolis-bot added anolis_test_fail and removed anolis_testing labels Jul 4, 2023

bergwolf previously approved these changes Jul 4, 2023

View reviewed changes

taoohong force-pushed the encryption-nydus branch from 22ad0e2 to 220542d Compare July 4, 2023 07:51

anolis-bot added anolis_testing and removed anolis_test_fail labels Jul 4, 2023

tests: add encrypt integration test

0314971

Add image encryption test integration case to Smoke test. Signed-off-by: taohong <[email protected]>

taoohong force-pushed the encryption-nydus branch from 220542d to 0314971 Compare July 4, 2023 07:55

anolis-bot added anolis_test_pass and removed anolis_testing labels Jul 4, 2023

jiangliu approved these changes Jul 6, 2023

View reviewed changes

jiangliu merged commit 98834dd into dragonflyoss:master Jul 6, 2023
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: nydus support encrypted images #1333

feat: nydus support encrypted images #1333

taoohong commented Jun 20, 2023 •

edited

Loading

anolis-bot commented Jun 20, 2023

codecov bot commented Jun 20, 2023 •

edited

Loading

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 24, 2023

bergwolf commented Jul 3, 2023

taoohong commented Jul 3, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

bergwolf left a comment

bergwolf commented Jul 4, 2023

taoohong commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

feat: nydus support encrypted images #1333

feat: nydus support encrypted images #1333

Conversation

taoohong commented Jun 20, 2023 • edited Loading

anolis-bot commented Jun 20, 2023

codecov bot commented Jun 20, 2023 • edited Loading

Codecov Report

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 20, 2023

anolis-bot commented Jun 24, 2023

bergwolf commented Jul 3, 2023

taoohong commented Jul 3, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

bergwolf left a comment

Choose a reason for hiding this comment

bergwolf commented Jul 4, 2023

taoohong commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

anolis-bot commented Jul 4, 2023

taoohong commented Jun 20, 2023 •

edited

Loading

codecov bot commented Jun 20, 2023 •

edited

Loading