xxhash3 bench

Include xxhash3 x86dispatch
Implement protocol-level checksums (xxhash3)
2026-04-04 13:47:40 +03:00 · 2026-04-04 13:42:05 +03:00 · 2026-04-03 21:26:25 +03:00 · 2026-04-03 21:22:42 +03:00 · 2026-04-03 21:22:42 +03:00 · 2026-04-03 21:22:42 +03:00
166 changed files with 17488 additions and 1590 deletions
@@ -63,7 +63,7 @@ jobs:
    container: ${{env.TEST_IMAGE}}:${{github.sha}}
    steps:
    # leak sanitizer sometimes crashes
-    - run: cd /root/vitastor/build && ASAN_OPTIONS=detect_leaks=0 make -j16 test
+    - run: cd /root/vitastor/build && ASAN_OPTIONS=detect_leaks=0 make -j16 build_tests test

  npm_lint:
    runs-on: ubuntu-latest
@@ -234,6 +234,60 @@ jobs:
          echo ""
        done

+  test_etcd_fail_https:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 10
+      run: ETCD_SCHEME=https /root/vitastor/tests/test_etcd_fail.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
+  test_etcd_fail_https_antietcd:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 10
+      run: ETCD_SCHEME=https ANTIETCD=1 /root/vitastor/tests/test_etcd_fail.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
+  test_snapshot_https:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 3
+      run: ETCD_SCHEME=https /root/vitastor/tests/test_snapshot.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
  test_interrupted_rebalance:
    runs-on: ubuntu-latest
    needs: build
@@ -648,6 +702,24 @@ jobs:
          echo ""
        done

+  test_snapshot_chain_encrypted:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 3
+      run: ENCRYPTED=1 /root/vitastor/tests/test_snapshot_chain.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
  test_old_snapshot_chain:
    runs-on: ubuntu-latest
    needs: build
@@ -1224,6 +1296,24 @@ jobs:
          echo ""
        done

+  test_checksum_xxhash:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 3
+      run: TEST_NAME=xxhash OSD_ARGS="--data_csum_type xxh3_32" /root/vitastor/tests/test_checksum.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
  test_old_checksum:
    runs-on: ubuntu-latest
    needs: build
@@ -2052,3 +2142,39 @@ jobs:
          echo ""
        done

+  test_write_encrypted:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 3
+      run: /root/vitastor/tests/test_write_encrypted.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
+  test_write_encrypted_ec:
+    runs-on: ubuntu-latest
+    needs: build
+    container: ${{env.TEST_IMAGE}}:${{github.sha}}
+    steps:
+    - name: Run test
+      id: test
+      timeout-minutes: 3
+      run: SCHEME=ec /root/vitastor/tests/test_write_encrypted.sh
+    - name: Print logs
+      if: always() && steps.test.outcome == 'failure'
+      run: |
+        for i in /root/vitastor/testdata/*.log /root/vitastor/testdata/*.txt; do
+          echo "-------- $i --------"
+          cat $i
+          echo ""
+        done
+
@@ -38,6 +38,14 @@ for my $line (<>)
            {
                $test_name .= '_antietcd';
            }
+            elsif ($1 eq 'ETCD_SCHEME' && $2 eq 'https')
+            {
+                $test_name .= '_https';
+            }
+            elsif ($1 eq 'ENCRYPTED')
+            {
+                $test_name .= '_encrypted';
+            }
            elsif ($1 eq 'OLD')
            {
                $test_name =~ s/^test_/test_old_/s;
@@ -3,3 +3,4 @@
 package-lock.json
 fio
 qemu
+node_modules
@@ -1,20 +1,20 @@
-cmake_minimum_required(VERSION 2.8.12)
+cmake_minimum_required(VERSION 2.8...3.30)

 project(vitastor)

-set(VITASTOR_VERSION "3.0.5")
+set(VITASTOR_VERSION "3.0.8")

 include(CTest)

 add_custom_target(build_tests)
-add_custom_target(test
-	COMMAND
-	echo leak:tcmalloc > ${CMAKE_CURRENT_BINARY_DIR}/lsan-suppress.txt &&
-	env LSAN_OPTIONS=suppressions=${CMAKE_CURRENT_BINARY_DIR}/lsan-suppress.txt ${CMAKE_CTEST_COMMAND}
+set_property(TEST PROPERTY ENVIRONMENT LSAN_OPTIONS=suppressions=${CMAKE_CURRENT_BINARY_DIR}/lsan-suppress.txt)
+add_test(gen_lsan_suppress
+    ${CMAKE_COMMAND} -E echo leak:tcmalloc > "${CMAKE_CURRENT_BINARY_DIR}/lsan-suppress.txt"
 )
+set_tests_properties(gen_lsan_suppress PROPERTIES FIXTURES_SETUP f_lsan_suppress)
+set_property(TEST PROPERTY FIXTURES_REQUIRED f_lsan_suppress)
 # make -j16 -C ../../build test_heap && ../../build/src/test/test_heap
 # make -j16 -C ../../build test_heap && rm -f $(find ../../build -name '*.gcda') && ctest -V -T test -T coverage -R heap --test-dir ../../build && (cd ../../build; gcovr -f ../src --html --html-nested -o coverage/index.html; cd ../src/test)
 # make -j16 -C ../../build test_blockstore && rm -f $(find ../../build -name '*.gcda') && ctest -V -T test -T coverage -R blockstore --test-dir ../../build && (cd ../../build; gcovr -f ../src --html --html-nested -o coverage/index.html; cd ../src/test)
 # kcov --include-path=../../../src ../../kcov ./test_blockstore
-add_dependencies(test build_tests)
 add_subdirectory(src)
@@ -62,6 +62,7 @@ Vitastor поддерживает QEMU-драйвер, протоколы UBLK,
    - [Дисковые параметры OSD](docs/config/layout-osd.ru.md)
    - [Прочие параметры OSD](docs/config/osd.ru.md)
    - [Параметры мониторов](docs/config/monitor.ru.md)
+    - [Безопасность](docs/config/security.ru.md)
  - [Настройки пулов](docs/config/pool.ru.md)
  - [Метаданные образов в etcd](docs/config/inode.ru.md)
 - Использование
@@ -62,6 +62,7 @@ Read more details in the documentation. You can start from here: [Quick Start](d
    - [OSD Disk Layout](docs/config/layout-osd.en.md)
    - [OSD Runtime Parameters](docs/config/osd.en.md)
    - [Monitor](docs/config/monitor.en.md)
+    - [Security](docs/config/security.en.md)
  - [Pool configuration](docs/config/pool.en.md)
  - [Image metadata in etcd](docs/config/inode.en.md)
 - Usage
@@ -1,4 +1,4 @@
-VITASTOR_VERSION ?= v3.0.5
+VITASTOR_VERSION ?= v3.0.8

 all: build push

@@ -49,7 +49,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: vitalif/vitastor-csi:v3.0.5
+          image: vitalif/vitastor-csi:v3.0.8
          args:
            - "--node=$(NODE_ID)"
            - "--endpoint=$(CSI_ENDPOINT)"
@@ -121,7 +121,7 @@ spec:
            privileged: true
            capabilities:
              add: ["SYS_ADMIN"]
-          image: vitalif/vitastor-csi:v3.0.5
+          image: vitalif/vitastor-csi:v3.0.8
          args:
            - "--node=$(NODE_ID)"
            - "--endpoint=$(CSI_ENDPOINT)"
@@ -5,7 +5,7 @@ package vitastor

 const (
    vitastorCSIDriverName    = "csi.vitastor.io"
-    vitastorCSIDriverVersion = "3.0.5"
+    vitastorCSIDriverVersion = "3.0.8"
 )

 // Config struct fills the parameters of request or user input
@@ -1,4 +1,4 @@
-vitastor (3.0.5-1) unstable; urgency=medium
+vitastor (3.0.8-1) unstable; urgency=medium

  * Bugfixes

@@ -3,7 +3,7 @@ Section: admin
 Priority: optional
 Maintainer: Vitaliy Filippov <vitalif@yourcmc.ru>
 Build-Depends: debhelper, g++ (>= 8), libstdc++6 (>= 8),
-  linux-libc-dev, libgoogle-perftools-dev, libjerasure-dev, libgf-complete-dev,
+  linux-libc-dev, libgoogle-perftools-dev, libjerasure-dev, libgf-complete-dev, libc-ares-dev,
  libibverbs-dev, librdmacm-dev, libisal-dev, cmake, pkg-config, libnl-3-dev, libnl-genl-3-dev,
  node-bindings <!nocheck>, node-gyp, node-nan
 Standards-Version: 4.5.0
@@ -44,7 +44,7 @@ curl -s https://git.yourcmc.ru/vitalif/antietcd/archive/master.tar.gz | tar -zx
 curl -s https://git.yourcmc.ru/vitalif/tinyraft/archive/master.tar.gz | tar -zx

 cd /root/vitastor/packages/vitastor-$REL
-if [[ "$REL" = "trixie" && -e ../vitastor-bookworm/vitastor_$VER.orig.tar.xz ]]; then
+if [[ ( "$REL" = "trixie" || "$REL" = "resolute" ) && -e ../vitastor-bookworm/vitastor_$VER.orig.tar.xz ]]; then
    # Fucking shit, archives differ between bookworm (xz 5.4.1) and trixie (xz 5.8.1)
    cp ../vitastor-bookworm/vitastor_$VER.orig.tar.xz .
 else
@@ -25,7 +25,7 @@ RUN set -e -x; \
    echo 'APT::Install-Suggests false;' >> /etc/apt/apt.conf

 RUN apt-get update && \
-    apt-get -y install fio libgoogle-perftools-dev devscripts libjerasure-dev cmake \
+    apt-get -y install fio libgoogle-perftools-dev devscripts libjerasure-dev cmake libc-ares-dev \
        libibverbs-dev librdmacm-dev libisal-dev libnl-3-dev libnl-genl-3-dev curl nodejs npm node-nan node-bindings && \
    apt-get -y build-dep fio && \
    apt-get --download-only source fio
@@ -1,4 +1,4 @@
-VITASTOR_VERSION ?= v3.0.5
+VITASTOR_VERSION ?= v3.0.8

 all: build push

@@ -4,7 +4,7 @@
 #

 # Desired Vitastor version
-VITASTOR_VERSION=v3.0.5
+VITASTOR_VERSION=v3.0.8

 # Additional arguments for all containers
 # For example, you may want to specify a custom logging driver here
@@ -38,3 +38,4 @@ In the future, additional configuration methods may be added:
 - [OSD Disk Layout](config/layout-osd.en.md)
 - [OSD Runtime Parameters](config/osd.en.md)
 - [Monitor](config/monitor.en.md)
+- [Security Parameters](config/security.en.md)
@@ -41,3 +41,4 @@
 - [Дисковые параметры OSD](config/layout-osd.ru.md)
 - [Прочие параметры OSD](config/osd.ru.md)
 - [Параметры мониторов](config/monitor.ru.md)
+- [Параметры безопасности](config/security.ru.md)
@@ -198,8 +198,14 @@ put a modified value into etcd key /vitastor/config/global.
 - Type: string
 - Default: none

-Data checksum type to use. May be "crc32c" or "none". Set to "crc32c" to
-enable data checksums.
+Data and metadata checksum type to use. May be "crc32c", "xxh3_32" or "none".
+Select crc32c or xxh3_32 and set csum_block_size to enable data checksums.
+
+Both crc32c and xxh3_32 are almost equally fast, xxh3_32 is safer. xxh3_32 is
+the xxhash3 algorithm truncated from 64 to 32 bits (which is still a good hash).
+
+Note that enabled data checksums either increase memory usage or reduce
+performance. Check details in [csum_block_size](#csum_block_size) description.

 ## csum_block_size

@@ -209,8 +209,12 @@ journal_block_size и meta_block_size. Однако на данный момен
 - Тип: строка
 - Значение по умолчанию: none

-Тип используемых OSD контрольных сумм данных. Может быть "crc32c" или "none".
-Установите в "crc32c", чтобы включить расчёт и проверку контрольных сумм данных.
+Тип используемых OSD контрольных сумм данных и метаданных. Может быть "crc32c",
+"xxh3_32" или "none". Выберите crc32c или xxh3_32 и установите csum_block_size,
+чтобы включить контрольные суммы данных.
+
+И crc32c, и xxh3_32 примерно одинаково быстры, xxh3_32 надёжней. xxh3_32 - это
+алгоритм xxhash3, обрезанный с 64 до 32 бит (это всё равно хороший хеш).

 Следует понимать, что контрольные суммы в зависимости от размера блока их
 расчёта либо увеличивают потребление памяти, либо снижают производительность.
@@ -0,0 +1,150 @@
+[Documentation](../../README.md#documentation) → [Configuration](../config.en.md) → Security Parameters
+
+-----
+
+[Читать на русском](security.ru.md)
+
+# Security Parameters
+
+These parameters affect your Vitastor installation security and apply to OSDs, monitors and clients.
+
+Most of them can be set in /etc/vitastor/vitastor.conf and in etcd, but don't support online modification.
+
+- [etcd_client_cert](#etcd_client_cert)
+- [etcd_client_key](#etcd_client_key)
+- [etcd_ca](#etcd_ca)
+- [osd_etcd_client_cert](#osd_etcd_client_cert)
+- [osd_etcd_client_key](#osd_etcd_client_key)
+- [mon_etcd_client_cert](#mon_etcd_client_cert)
+- [mon_etcd_client_key](#mon_etcd_client_key)
+- [vault_url](#vault_url)
+- [vault_secret_api_path](#vault_secret_api_path)
+- [vault_client_cert](#vault_client_cert)
+- [vault_client_key](#vault_client_key)
+- [vault_ca](#vault_ca)
+- [vault_timeout_ms](#vault_timeout_ms)
+- [vault_error_timeout_sec](#vault_error_timeout_sec)
+- [vault_refresh_leeway_sec](#vault_refresh_leeway_sec)
+- [max_aes_xts_pool_size](#max_aes_xts_pool_size)
+
+## etcd_client_cert
+
+- Type: string
+
+Client TLS certificate to use for Vitastor client (not OSD and not monitor)
+etcd https connections. May be path to a file or just a PEM string with certificate.
+In the latter case, string must begin with "-----BEGIN CERTIFICATE-----".
+
+## etcd_client_key
+
+- Type: string
+
+Private key for etcd_client_cert (also a file or a PEM string).
+
+## etcd_ca
+
+- Type: string
+
+Trusted TLS CA to verify etcd server certificate. May be path to a file,
+directory or just a PEM string with certificate.
+
+## osd_etcd_client_cert
+
+- Type: string
+
+Same as [etcd_client_cert](#etcd_client_cert), but only for OSDs.
+OSDs, clients and monitors should have different permissions, so they should
+use different certificates.
+
+## osd_etcd_client_key
+
+- Type: string
+
+Same as [etcd_client_key](#etcd_client_key), but only for OSDs.
+
+## mon_etcd_client_cert
+
+- Type: string
+
+Same as [etcd_client_cert](#etcd_client_cert), but only for Vitastor monitors.
+
+## mon_etcd_client_key
+
+- Type: string
+
+Same as [etcd_client_key](#etcd_client_key), but only for Vitastor monitors.
+
+## vault_url
+
+- Type: string
+
+Vault base URL.
+
+Vitastor clients support AES-256-XTS image data encryption with different per-image keys.
+Encryption is performed by the client, OSDs don't have access to decrypted data.
+
+Encryption keys may be stored in etcd or, for the increased security level, in an external
+[HashiCorp Vault](https://developer.hashicorp.com/vault/) or [OpenBao](https://openbao.org/)
+instance.
+
+Vitastor clients use [v1 k/v secrets engine](https://openbao.org/api-docs/secret/kv/kv-v1/)
+and [TLS authentication engine](https://openbao.org/api-docs/auth/cert/) in Vault.
+
+In that case, only key IDs are stored in etcd.
+
+## vault_secret_api_path
+
+- Type: string
+- Default: /v1/secret/
+
+Vault v1 secret API mount path to use.
+
+## vault_client_cert
+
+- Type: string
+
+Client TLS certificate to use for Vault connections. Just like [etcd_client_cert](#etcd_client_cert),
+may be path to a file or just a certificate in PEM string.
+
+## vault_client_key
+
+- Type: string
+
+Private key for vault_client_cert (also a file or a PEM string).
+
+## vault_ca
+
+- Type: string
+
+Trusted TLS CA to verify Vault server certificate. May be path to a file,
+directory or just a PEM string with certificate.
+
+## vault_timeout_ms
+
+- Type: integer
+- Default: 5000
+
+Timeout for Vault requests in milliseconds.
+
+## vault_error_timeout_sec
+
+- Type: integer
+- Default: 60
+
+Time (in seconds) to wait before retrying after receiving an error from Vault.
+
+## vault_refresh_leeway_sec
+
+- Type: integer
+- Default: 60
+
+Extra time (in seconds) before real Vault token lease_timeout to refresh it, just
+in case of system clock drift.
+
+## max_aes_xts_pool_size
+
+- Type: integer
+- Default: 256
+
+Maximum number of OpenSSL encryption contexts cached in OSD memory. Probably
+doesn't require modification.
@@ -0,0 +1,154 @@
+[Документация](../../README-ru.md#документация) → [Конфигурация](../config.ru.md) → Параметры безопасности
+
+-----
+
+[Read in English](security.en.md)
+
+# Параметры безопасности
+
+Данные параметры затрагивают безопасность инсталляций Vitastor и используются
+OSD, мониторами и клиентами.
+
+Большая их часть может задаваться в /etc/vitastor/vitastor.conf и в etcd, но не
+поддерживает онлайн-изменение.
+
+- [etcd_client_cert](#etcd_client_cert)
+- [etcd_client_key](#etcd_client_key)
+- [etcd_ca](#etcd_ca)
+- [osd_etcd_client_cert](#osd_etcd_client_cert)
+- [osd_etcd_client_key](#osd_etcd_client_key)
+- [mon_etcd_client_cert](#mon_etcd_client_cert)
+- [mon_etcd_client_key](#mon_etcd_client_key)
+- [vault_url](#vault_url)
+- [vault_secret_api_path](#vault_secret_api_path)
+- [vault_client_cert](#vault_client_cert)
+- [vault_client_key](#vault_client_key)
+- [vault_ca](#vault_ca)
+- [vault_timeout_ms](#vault_timeout_ms)
+- [vault_error_timeout_sec](#vault_error_timeout_sec)
+- [vault_refresh_leeway_sec](#vault_refresh_leeway_sec)
+- [max_aes_xts_pool_size](#max_aes_xts_pool_size)
+
+## etcd_client_cert
+
+- Тип: строка
+
+Клиентский TLS сертификат для https-подключений к etcd для клиентов Vitastor
+(не OSD и не мониторов). Может быть путём к файлу или просто строкой с
+сертификатом в формате PEM. В последнем случае строка должна начинаться с
+"-----BEGIN CERTIFICATE-----".
+
+## etcd_client_key
+
+- Тип: строка
+
+Закрытый ключ для сертификата etcd_client_cert (также путь к файлу или PEM строка).
+
+## etcd_ca
+
+- Тип: строка
+
+Доверенный корневой TLS-сертификат для проверки сертификата сервера etcd.
+Может быть путём к файлу, директории или просто строкой с сертификатом в
+формате PEM.
+
+## osd_etcd_client_cert
+
+- Тип: строка
+
+Аналогично [etcd_client_cert](#etcd_client_cert), но только для OSD.
+OSD, клиенты и мониторы должны иметь разные привилегии, поэтому они должны
+использовать разные сертификаты.
+
+## osd_etcd_client_key
+
+- Тип: строка
+
+Аналогично [etcd_client_key](#etcd_client_key), но только для OSD.
+
+## mon_etcd_client_cert
+
+- Тип: строка
+
+Аналогично [etcd_client_cert](#etcd_client_cert), но только для мониторов Vitastor.
+
+## mon_etcd_client_key
+
+- Тип: строка
+
+Аналогично [etcd_client_key](#etcd_client_key), но только для мониторов Vitastor.
+
+## vault_url
+
+- Тип: строка
+
+Базовый адрес Vault.
+
+Клиенты Vitastor поддерживают AES-256-XTS шифрование данных образов с отдельными ключами на
+каждый образ. Данные шифруются клиентами, OSD не имеют доступа к незашифрованным данным.
+
+Ключи шифрования могут храниться в etcd или, для повышенного уровня безопасности, во внешнем
+[HashiCorp Vault](https://developer.hashicorp.com/vault/) или [OpenBao](https://openbao.org/).
+
+Клиенты Vitastor используют [движок секретов v1](https://openbao.org/api-docs/secret/kv/kv-v1/)
+и [TLS-аутентификацию](https://openbao.org/api-docs/auth/cert/) в Vault.
+
+В этом случае, только ID ключей хранятся в etcd.
+
+## vault_secret_api_path
+
+- Тип: строка
+- Значение по умолчанию: /v1/secret/
+
+Путь к API секретов v1 для использования клиентами.
+
+## vault_client_cert
+
+- Тип: строка
+
+Клиентский TLS сертификат для подключений к Vault. Как и [etcd_client_cert](#etcd_client_cert),
+может быть путём к файлу или просто PEM-строкой с сертификатом.
+
+## vault_client_key
+
+- Тип: строка
+
+Закрытый ключ для сертификата vault_client_cert (также путь к файлу или PEM строка).
+
+## vault_ca
+
+- Тип: строка
+
+Доверенный корневой TLS-сертификат для проверки сертификата сервера Vault.
+Может быть путём к файлу, директории или просто строкой с сертификатом в
+формате PEM.
+
+## vault_timeout_ms
+
+- Тип: целое число
+- Значение по умолчанию: 5000
+
+Максимально время выполнения Vault-запросов в миллисекундах.
+
+## vault_error_timeout_sec
+
+- Тип: целое число
+- Значение по умолчанию: 60
+
+Время (в секундах) для ожидания перед повторной попыткой при получении ошибки от Vault.
+
+## vault_refresh_leeway_sec
+
+- Тип: целое число
+- Значение по умолчанию: 60
+
+Зазор времени (в секундах), чтобы обновлять токены Vault чуть раньше их реального
+lease_timeout, на случай "ухода" системных часов.
+
+## max_aes_xts_pool_size
+
+- Тип: целое число
+- Значение по умолчанию: 256
+
+Максимальное количество кэшируемых в памяти OSD контекстов шифрования OpenSSL.
+Вряд ли требует изменения.
@@ -44,6 +44,8 @@

 {{../../config/monitor.en.md|indent=2}}

+{{../../config/security.en.md|indent=2}}
+
 {{../../config/pool.en.md|indent=2}}

 {{../../config/inode.en.md|indent=2}}
@@ -44,6 +44,8 @@

 {{../../config/monitor.ru.md|indent=2}}

+{{../../config/security.ru.md|indent=2}}
+
 {{../../config/pool.ru.md|indent=2}}

 {{../../config/inode.ru.md|indent=2}}
@@ -233,11 +233,21 @@
  type: string
  default: none
  info: |
-    Data checksum type to use. May be "crc32c" or "none". Set to "crc32c" to
-    enable data checksums.
+    Data and metadata checksum type to use. May be "crc32c", "xxh3_32" or "none".
+    Select crc32c or xxh3_32 and set csum_block_size to enable data checksums.
+
+    Both crc32c and xxh3_32 are almost equally fast, xxh3_32 is safer. xxh3_32 is
+    the xxhash3 algorithm truncated from 64 to 32 bits (which is still a good hash).
+
+    Note that enabled data checksums either increase memory usage or reduce
+    performance. Check details in [csum_block_size](#csum_block_size) description.
  info_ru: |
-    Тип используемых OSD контрольных сумм данных. Может быть "crc32c" или "none".
-    Установите в "crc32c", чтобы включить расчёт и проверку контрольных сумм данных.
+    Тип используемых OSD контрольных сумм данных и метаданных. Может быть "crc32c",
+    "xxh3_32" или "none". Выберите crc32c или xxh3_32 и установите csum_block_size,
+    чтобы включить контрольные суммы данных.
+
+    И crc32c, и xxh3_32 примерно одинаково быстры, xxh3_32 надёжней. xxh3_32 - это
+    алгоритм xxhash3, обрезанный с 64 до 32 бит (это всё равно хороший хеш).

    Следует понимать, что контрольные суммы в зависимости от размера блока их
    расчёта либо увеличивают потребление памяти, либо снижают производительность.
@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "yaml": "^2.8.2"
+  }
+}
@@ -0,0 +1,5 @@
+# Security Parameters
+
+These parameters affect your Vitastor installation security and apply to OSDs, monitors and clients.
+
+Most of them can be set in /etc/vitastor/vitastor.conf and in etcd, but don't support online modification.
@@ -0,0 +1,7 @@
+# Параметры безопасности
+
+Данные параметры затрагивают безопасность инсталляций Vitastor и используются
+OSD, мониторами и клиентами.
+
+Большая их часть может задаваться в /etc/vitastor/vitastor.conf и в etcd, но не
+поддерживает онлайн-изменение.
@@ -0,0 +1,131 @@
+- name: etcd_client_cert
+  type: string
+  info: |
+    Client TLS certificate to use for Vitastor client (not OSD and not monitor)
+    etcd https connections. May be path to a file or just a PEM string with certificate.
+    In the latter case, string must begin with "-----BEGIN CERTIFICATE-----".
+  info_ru: |
+    Клиентский TLS сертификат для https-подключений к etcd для клиентов Vitastor
+    (не OSD и не мониторов). Может быть путём к файлу или просто строкой с
+    сертификатом в формате PEM. В последнем случае строка должна начинаться с
+    "-----BEGIN CERTIFICATE-----".
+- name: etcd_client_key
+  type: string
+  info: Private key for etcd_client_cert (also a file or a PEM string).
+  info_ru: Закрытый ключ для сертификата etcd_client_cert (также путь к файлу или PEM строка).
+- name: etcd_ca
+  type: string
+  info: |
+    Trusted TLS CA to verify etcd server certificate. May be path to a file,
+    directory or just a PEM string with certificate.
+  info_ru: |
+    Доверенный корневой TLS-сертификат для проверки сертификата сервера etcd.
+    Может быть путём к файлу, директории или просто строкой с сертификатом в
+    формате PEM.
+- name: osd_etcd_client_cert
+  type: string
+  info: |
+    Same as [etcd_client_cert](#etcd_client_cert), but only for OSDs.
+    OSDs, clients and monitors should have different permissions, so they should
+    use different certificates.
+  info_ru: |
+    Аналогично [etcd_client_cert](#etcd_client_cert), но только для OSD.
+    OSD, клиенты и мониторы должны иметь разные привилегии, поэтому они должны
+    использовать разные сертификаты.
+- name: osd_etcd_client_key
+  type: string
+  info: Same as [etcd_client_key](#etcd_client_key), but only for OSDs.
+  info_ru: Аналогично [etcd_client_key](#etcd_client_key), но только для OSD.
+- name: mon_etcd_client_cert
+  type: string
+  info: Same as [etcd_client_cert](#etcd_client_cert), but only for Vitastor monitors.
+  info_ru: Аналогично [etcd_client_cert](#etcd_client_cert), но только для мониторов Vitastor.
+- name: mon_etcd_client_key
+  type: string
+  info: Same as [etcd_client_key](#etcd_client_key), but only for Vitastor monitors.
+  info_ru: Аналогично [etcd_client_key](#etcd_client_key), но только для мониторов Vitastor.
+- name: vault_url
+  type: string
+  info: |
+    Vault base URL.
+
+    Vitastor clients support AES-256-XTS image data encryption with different per-image keys.
+    Encryption is performed by the client, OSDs don't have access to decrypted data.
+
+    Encryption keys may be stored in etcd or, for the increased security level, in an external
+    [HashiCorp Vault](https://developer.hashicorp.com/vault/) or [OpenBao](https://openbao.org/)
+    instance.
+
+    Vitastor clients use [v1 k/v secrets engine](https://openbao.org/api-docs/secret/kv/kv-v1/)
+    and [TLS authentication engine](https://openbao.org/api-docs/auth/cert/) in Vault.
+
+    In that case, only key IDs are stored in etcd.
+  info_ru: |
+    Базовый адрес Vault.
+
+    Клиенты Vitastor поддерживают AES-256-XTS шифрование данных образов с отдельными ключами на
+    каждый образ. Данные шифруются клиентами, OSD не имеют доступа к незашифрованным данным.
+
+    Ключи шифрования могут храниться в etcd или, для повышенного уровня безопасности, во внешнем
+    [HashiCorp Vault](https://developer.hashicorp.com/vault/) или [OpenBao](https://openbao.org/).
+
+    Клиенты Vitastor используют [движок секретов v1](https://openbao.org/api-docs/secret/kv/kv-v1/)
+    и [TLS-аутентификацию](https://openbao.org/api-docs/auth/cert/) в Vault.
+
+    В этом случае, только ID ключей хранятся в etcd.
+- name: vault_secret_api_path
+  type: string
+  default: /v1/secret/
+  info: Vault v1 secret API mount path to use.
+  info_ru: Путь к API секретов v1 для использования клиентами.
+- name: vault_client_cert
+  type: string
+  info: |
+    Client TLS certificate to use for Vault connections. Just like [etcd_client_cert](#etcd_client_cert),
+    may be path to a file or just a certificate in PEM string.
+  info_ru: |
+    Клиентский TLS сертификат для подключений к Vault. Как и [etcd_client_cert](#etcd_client_cert),
+    может быть путём к файлу или просто PEM-строкой с сертификатом.
+- name: vault_client_key
+  type: string
+  info: Private key for vault_client_cert (also a file or a PEM string).
+  info_ru: Закрытый ключ для сертификата vault_client_cert (также путь к файлу или PEM строка).
+- name: vault_ca
+  type: string
+  info: |
+    Trusted TLS CA to verify Vault server certificate. May be path to a file,
+    directory or just a PEM string with certificate.
+  info_ru: |
+    Доверенный корневой TLS-сертификат для проверки сертификата сервера Vault.
+    Может быть путём к файлу, директории или просто строкой с сертификатом в
+    формате PEM.
+- name: vault_timeout_ms
+  type: int
+  default: 5000
+  info: Timeout for Vault requests in milliseconds.
+  info_ru: Максимально время выполнения Vault-запросов в миллисекундах.
+- name: vault_error_timeout_sec
+  type: int
+  default: 60
+  info: |
+    Time (in seconds) to wait before retrying after receiving an error from Vault.
+  info_ru: |
+    Время (в секундах) для ожидания перед повторной попыткой при получении ошибки от Vault.
+- name: vault_refresh_leeway_sec
+  type: int
+  default: 60
+  info: |
+    Extra time (in seconds) before real Vault token lease_timeout to refresh it, just
+    in case of system clock drift.
+  info_ru: |
+    Зазор времени (в секундах), чтобы обновлять токены Vault чуть раньше их реального
+    lease_timeout, на случай "ухода" системных часов.
+- name: max_aes_xts_pool_size
+  type: int
+  default: 256
+  info: |
+    Maximum number of OpenSSL encryption contexts cached in OSD memory. Probably
+    doesn't require modification.
+  info_ru: |
+    Максимальное количество кэшируемых в памяти OSD контекстов шифрования OpenSSL.
+    Вряд ли требует изменения.
@@ -26,9 +26,9 @@ at Vitastor Kubernetes operator: https://github.com/Antilles7227/vitastor-operat
 The instruction is very simple.

 1. Download a Docker image of the desired version: \
-   `docker pull vitalif/vitastor:v3.0.5`
+   `docker pull vitalif/vitastor:v3.0.8`
 2. Install scripts to the host system: \
-   `docker run --rm -it -v /etc:/host-etc -v /usr/bin:/host-bin vitalif/vitastor:v3.0.5 install.sh`
+   `docker run --rm -it -v /etc:/host-etc -v /usr/bin:/host-bin vitalif/vitastor:v3.0.8 install.sh`
 3. Reload udev rules: \
   `udevadm control --reload-rules`
 4. Enable the vitastor-host service: \
@@ -25,9 +25,9 @@ Vitastor можно установить в Docker/Podman. При этом etcd,
 Инструкция по установке максимально простая.

 1. Скачайте Docker-образ желаемой версии: \
-   `docker pull vitalif/vitastor:v3.0.5`
+   `docker pull vitalif/vitastor:v3.0.8`
 2. Установите скрипты в хост-систему командой: \
-   `docker run --rm -it -v /etc:/host-etc -v /usr/bin:/host-bin vitalif/vitastor:v3.0.5 install.sh`
+   `docker run --rm -it -v /etc:/host-etc -v /usr/bin:/host-bin vitalif/vitastor:v3.0.8 install.sh`
 3. Перезагрузите правила udev: \
   `udevadm control --reload-rules`
 4. Включите сервис vitastor-host: \
@@ -17,6 +17,7 @@
  - Debian 10 (Buster): `deb https://vitastor.io/debian buster main`
  - Ubuntu 22.04 (Jammy): `deb https://vitastor.io/debian jammy main`
  - Ubuntu 24.04 (Noble): `deb https://vitastor.io/debian noble main`
+  - Ubuntu 26.04 (Resolute): `deb https://vitastor.io/debian resolute main`
  - Add `-oldstable` to bookworm/bullseye/buster in this line to install the last
    stable version from 0.9.x branch instead of 1.x
 - To always prefer vitastor-patched QEMU and Libvirt versions, add the following to `/etc/apt/preferences`:
@@ -17,6 +17,7 @@
  - Debian 10 (Buster): `deb https://vitastor.io/debian buster main`
  - Ubuntu 22.04 (Jammy): `deb https://vitastor.io/debian jammy main`
  - Ubuntu 24.04 (Noble): `deb https://vitastor.io/debian noble main`
+  - Ubuntu 26.04 (Resolute): `deb https://vitastor.io/debian resolute main`
  - Добавьте `-oldstable` к слову bookworm/bullseye/buster в этой строке, чтобы
    установить последнюю стабильную версию из ветки 0.9.x вместо 1.x
 - Чтобы всегда предпочитались версии пакетов QEMU и Libvirt с патчами Vitastor, добавьте в `/etc/apt/preferences`:
@@ -15,8 +15,8 @@
 - gcc and g++ 8 or newer, clang 10 or newer, or other compiler with C++11 plus
  designated initializers support from C++20
 - CMake
- jerasure headers and libraries
- ISA-L, libibverbs and librdmacm headers and libraries (optional)
+- jerasure, c-ares headers and libraries
+- ISA-L, libibverbs, librdmacm, libnl3 headers and libraries (optional)
 - tcmalloc (google-perftools-dev)

 ## Basic instructions
@@ -15,8 +15,8 @@
 - gcc и g++ >= 8, либо clang >= 10, либо другой компилятор с поддержкой C++11 плюс
  назначенных инициализаторов (designated initializers) из C++20
 - CMake
- Заголовки и библиотеки jerasure
- Опционально - заголовки и библиотеки ISA-L, libibverbs, librdmacm
+- Заголовки и библиотеки jerasure, c-ares
+- Опционально - заголовки и библиотеки ISA-L, libibverbs, librdmacm, libnl3
 - tcmalloc (google-perftools-dev)

 ## Базовая инструкция
@@ -41,6 +41,8 @@
 - [Built-in Prometheus metric exporter](../config/monitor.en.md#enable_prometheus)
 - [NFS RDMA support](../usage/nfs.en.md#rdma) (probably also usable for GPUDirect)
 - [S3](../installation/s3.en.md)
+- [TLS support for etcd connections](../config/security.en.md)
+- [AES-256-XTS image encryption](../usage/cli.en.md#create) and [Vault support](../config/security.en.md#vault_url) for key storage

 ## Plugins and tools

@@ -43,6 +43,8 @@
 - [Встроенный Prometheus-экспортер метрик](../config/monitor.ru.md#enable_prometheus)
 - [Поддержка NFS RDMA](../usage/nfs.ru.md#rdma) (вероятно, также подходящая для GPUDirect)
 - [S3](../installation/s3.ru.md)
+- [Поддержка TLS-соединений с etcd](../config/security.ru.md)
+- [AES-256-XTS шифрование данных](../usage/cli.ru.md#create) и [поддержка Vault](../config/security.ru.md#vault_url) для хранения ключей

 ## Драйверы и инструменты

@@ -125,18 +125,31 @@ bench-kaveri         kaveri    10 G  10 G    0 B/s  0     0      0 us  0 B/s  0

 ## create

-`vitastor-cli create -s|--size <size> [-p|--pool <id|name>] [--parent <parent_name>[@<snapshot>]] <name>`
+`vitastor-cli create -s|--size SIZE [OPTIONS] <name>`

-Create an image. You may use K/M/G/T suffixes for `<size>`. If `--parent` is specified,
-a copy-on-write image clone is created. Parent must be a snapshot (readonly image).
-Pool must be specified if there is more than one pool.
+Create an image. Options:
+
+* `-s|--size SIZE` - New image size in bytes or with a K/M/G/T unit suffix.
+* `-p|--pool POOL` - Specify pool for the new image (may be omitted if there is only 1 pool).
+* `--parent PARENT` - Create a copy-on-write image clone based on PARENT (or PARENT@SNAPSHOT).
+  If parent is not a snapshot, it must be a read-only image.
+* `--enc-key random` - Generate a new random AES-256-XTS encryption key for the new image.
+* `--enc-key HEX` - Set a specified AES-256-XTS key (64 bytes in hex) for the new image.
+* `--enc-key vault:ID` - Use an encryption key from an external Vault secret with specified ID.

 ```
-vitastor-cli create --snapshot <snapshot> [-p|--pool <id|name>] <image>
-vitastor-cli snap-create [-p|--pool <id|name>] <image>@<snapshot>
+vitastor-cli create --snapshot <snapshot> [OPTIONS] <image>
+vitastor-cli snap-create [OPTIONS] <image>@<snapshot>
 ```

-Create a snapshot of image `<name>` (either form can be used). May be used live if only a single writer is active.
+Create a snapshot of image `<image>`. May be used live if only a single writer is active.
+
+Options:
+
+* `-p|--pool POOL` - Move image to pool POOL, leaving the snapshot in the old pool.
+* `--enc-key random` - Change image encryption key to a new random AES-256-XTS key.
+* `--enc-key KEY` - Change image encryption key to a specified key, Vault key or to an empty key.
+  By default, the image retains its old encryption key when taking a snapshot.

 See also about [how to export snapshots](qemu.en.md#exporting-snapshots).

@@ -151,6 +164,7 @@ You should resize file system in the image, if present, before shrinking it.
 * `--deleted 1|0` - Set/clear 'deleted image' flag (set automatically during unfinished deletes).
 * `-f|--force` - Proceed with shrinking or setting readwrite flag even if the image has children.
 * `--down-ok` - Proceed with shrinking even if some data will be left on unavailable OSDs.
+* `--enc-key HEX` - Change image encryption key (allowed only with `--force`).

 ## dd

@@ -127,19 +127,32 @@ bench-kaveri         kaveri    10 G  10 G    0 B/s  0     0      0 us  0 B/s  0

 ## create

-`vitastor-cli create -s|--size <size> [-p|--pool <id|name>] [--parent <parent_name>[@<snapshot>]] <name>`
+`vitastor-cli create -s|--size SIZE [ОПЦИИ] <name>`

-Создать образ. Для размера `<size>` можно использовать суффиксы K/M/G/T (килобайт-мегабайт-гигабайт-терабайт).
-Если указана опция `--parent`, создаётся клон образа. Родитель `<parent_name>[@<snapshot>]` должен быть
-снимком (или просто немодифицируемым образом). Пул обязательно указывать, если в кластере больше одного пула.
+Создать образ. Опции:
+
+* `-s|--size SIZE` - Размер нового образа в байтах или с суффиксом K/M/G/T (кило/мега/гига/терабайт).
+* `-p|--pool POOL` - Создать образ в заданном пуле (можно не указывать, если пул всего один).
+* `--parent PARENT` - Создать легковесный клон на основе образа `PARENT` или снимка `PARENT@SNAP`.
+  Если `PARENT` - не снимок, он должен быть помечен как образ только для чтения.
+* `--enc-key random` - Сгенерировать случайный ключ шифрования AES-256-XTS для нового образа.
+* `--enc-key HEX` - Установить заданный ключ AES-256-XTS (64 байта в hex) для нового образа.
+* `--enc-key vault:ID` - Использовать ключ из внешнего секрета с заданным ID из Vault.

 ```
-vitastor-cli create --snapshot <snapshot> [-p|--pool <id|name>] <image>
-vitastor-cli snap-create [-p|--pool <id|name>] <image>@<snapshot>
+vitastor-cli create --snapshot <snapshot> [ОПЦИИ] <image>
+vitastor-cli snap-create [ОПЦИИ] <image>@<snapshot>
 ```

-Создать снимок образа `<name>` (можно использовать любую форму команды). Снимок можно создавать без остановки
-клиентов, если пишущий клиент максимум 1.
+Создать снимок образа `<image>` (можно использовать любую форму команды).
+Снимок можно создавать без остановки клиентов, если пишущих клиентов не больше одного.
+
+Опции:
+
+* `-p|--pool POOL` - Переместить образ в пул POOL, оставив снимок в старом пуле.
+* `--enc-key random` - Изменить ключ шифрования образа на новый случайный ключ AES-256-XTS.
+* `--enc-key KEY` - Изменить ключ шифрования образа на заданный ключ, ключ из Vault или пустой ключ.
+  По умолчанию шифрованные образы сохраняют старый ключ при снятии снимка.

 Смотрите также информацию о том, [как экспортировать снимки](qemu.ru.md#экспорт-снимков).

@@ -156,6 +169,7 @@ vitastor-cli snap-create [-p|--pool <id|name>] <image>@<snapshot>
 * `--deleted 1|0` - Установить/снять флаг "образ удалён" (устанавливается при незавершённом удалении).
 * `-f|--force` - Разрешить уменьшение или перевод в чтение-запись образа, у которого есть клоны.
 * `--down-ok` - Разрешить уменьшение, даже если часть данных останется неудалённой на недоступных OSD.
+* `--enc-key HEX` - Изменить ключ шифрования образа (разрешено только с `--force`).

 ## dd

@@ -18,7 +18,7 @@ class AntiEtcdAdapter
                cluster = cluster ? (''+(cluster||'')).split(/,+/) : [];
            cluster = Object.keys(cluster.reduce((a, url) =>
            {
-                a[url.toLowerCase().replace(/^(https?:\/\/)/, '').replace(/\/.*$/, '')] = true;
+                a[url.toLowerCase().replace(/^(https?:\/\/)?(.*?)(\/.*)?$/, (m, m1, m2) => (m1||'http://')+m2)] = true;
                return a;
            }, {}));
            const cfg_port = config.antietcd_port;
@@ -26,7 +26,8 @@ class AntiEtcdAdapter
            is_local['0.0.0.0'] = true;
            is_local['::'] = true;
            is_local[''] = true;
-            const selected = cluster.map(s => s.split(':', 2)).filter(ip => is_local[ip[0]] && (!cfg_port || ip[1] == cfg_port));
+            // split :, 3 -> <schema>:<//ip>:<port>
+            const selected = cluster.map(s => s.split(':', 3)).filter(ip => is_local[ip[1].substr(2)] && (!cfg_port || ip[2] == cfg_port));
            if (selected.length > 1)
            {
                console.error('More than 1 etcd_address matches local IPs, please specify port');
@@ -35,16 +36,30 @@ class AntiEtcdAdapter
            else if (selected.length == 1)
            {
                const antietcd_config = {
-                    ip: selected[0][0],
-                    port: selected[0][1],
-                    data: config.antietcd_data_file || ((config.antietcd_data_dir || '/var/lib/vitastor') + '/mon_'+selected[0][1]+'.json.gz'),
+                    ip: selected[0][1].substr(2),
+                    port: selected[0][2],
+                    cert: config.antietcd_cert,
+                    key: config.antietcd_key,
+                    ca: config.etcd_ca,
+                    data: config.antietcd_data_file || ((config.antietcd_data_dir || '/var/lib/vitastor') + '/mon_'+selected[0][2]+'.json.gz'),
                    persist_filter: vitastor_persist_filter({ vitastor_prefix: config.etcd_prefix || '/vitastor' }),
-                    node_id: selected[0][0]+':'+selected[0][1], // node_id = ip:port
-                    cluster: (cluster.length == 1 ? null : cluster.reduce((a, c) => { a[c] = "http://"+c; return a; }, {})),
+                    node_id: selected[0][1].substr(2)+':'+selected[0][2], // node_id = ip:port
+                    cluster: (cluster.length == 1 ? null : cluster.reduce((a, c) => { a[c.replace(/^(https?:\/\/)/, '')] = c; return a; }, {})),
                    cluster_key: (config.etcd_prefix || '/vitastor'),
                    stale_read: 1,
                    log_level: 1,
                };
+                if (config.use_auth)
+                {
+                    antietcd_config.client_cert_auth = true;
+                    antietcd_config.auth_filter = require('./vitastor_auth_filter.js');
+                    antietcd_config.peer_ca = config.antietcd_server_ca;
+                    if (!config.antietcd_server_ca || config.antietcd_server_ca == config.etcd_ca)
+                    {
+                        console.error('Secure setup requires separate antietcd_server_ca (for signing antietcd server certificates) and etcd_ca (for signing client certificates)');
+                        process.exit(1);
+                    }
+                }
                for (const key in config)
                {
                    if (key.substr(0, 9) === 'antietcd_')
@@ -169,7 +184,7 @@ class AntiEtcdAdapter
                    await new Promise(ok => setTimeout(ok, timeout-(Date.now()-prev)));
                }
                prev = Date.now();
-                const res = await this.antietcd.api(path.replace(/^\/+/, '').replace(/\/+$/, '').replace(/\/+/g, '_'), body);
+                const res = await this.antietcd.api(path.replace(/^\/+/, '').replace(/\/+$/, '').replace(/\/+/g, '_'), body, { username: 'root' });
                if (res.error)
                {
                    console.error('Failed to query antietcd '+path+' (retry '+retry+'/'+retries+'): '+res.error);
@@ -1,7 +1,9 @@
 // Copyright (c) Vitaliy Filippov, 2019+
 // License: VNPL-1.1 (see README.md for details)

+const fs = require('fs');
 const http = require('http');
+const https = require('https');
 const WebSocket = require('ws');
 const { b64, local_ips } = require('./utils.js');

@@ -15,11 +17,30 @@ class EtcdAdapter
        this.ws = null;
        this.ws_alive = false;
        this.ws_keepalive_timer = null;
+        this.opts = {};
    }

    parse_config(config)
    {
        this.parse_etcd_addresses(config.etcd_address||config.etcd_url);
+        if (config.mon_etcd_client_cert || config.etcd_client_cert)
+        {
+            this.opts.cert = config.mon_etcd_client_cert || config.etcd_client_cert;
+            if (this.opts.cert.substr(0, 5) != '-----')
+                this.opts.cert = fs.readFileSync(this.opts.cert, { encoding: 'utf-8' });
+        }
+        if (config.mon_etcd_client_key || config.etcd_client_key)
+        {
+            this.opts.key = config.mon_etcd_client_key || config.etcd_client_key;
+            if (this.opts.key.substr(0, 5) != '-----')
+                this.opts.key = fs.readFileSync(this.opts.key, { encoding: 'utf-8' });
+        }
+        if (config.etcd_ca)
+        {
+            this.opts.ca = config.etcd_ca;
+            if (this.opts.ca.substr(0, 5) != '-----')
+                this.opts.ca = fs.readFileSync(this.opts.ca, { encoding: 'utf-8' });
+        }
    }

    parse_etcd_addresses(addrs)
@@ -39,7 +60,7 @@ class EtcdAdapter
        for (let url of addrs)
        {
            let scheme = 'http';
-            url = url.trim().replace(/^(https?):\/\//, (m, m1) => { scheme = m1; return ''; });
+            url = url.trim().replace(/^(https?):\/\//i, (m, m1) => { scheme = m1.toLowerCase(); return ''; });
            const slash = url.indexOf('/');
            const colon = url.indexOf(':');
            const is_local = is_local_ip[colon >= 0 ? url.substr(0, colon) : (slash >= 0 ? url.substr(0, slash) : url)];
@@ -130,7 +151,7 @@ class EtcdAdapter
                    }
                    ok(false);
                }, this.mon.config.etcd_mon_timeout);
-                this.ws = new WebSocket(base+'/watch');
+                this.ws = new WebSocket(base+'/watch', this.opts);
                this.ws_used_url = cur_addr;
                const fail = () =>
                {
@@ -272,7 +293,7 @@ class EtcdAdapter
            {
                throw new Error(MON_STOPPED);
            }
-            const res = await POST(base+path, body, timeout);
+            const res = await POST(base+path, body, timeout, this.opts);
            if (this.mon.stopped)
            {
                throw new Error(MON_STOPPED);
@@ -298,7 +319,7 @@ class EtcdAdapter
    }
 }

-function POST(url, body, timeout)
+function POST(url, body, timeout, opts)
 {
    return new Promise(ok =>
    {
@@ -310,10 +331,10 @@ function POST(url, body, timeout)
            req = null;
            ok({ error: 'timeout' });
        }, timeout) : null;
-        let req = http.request(url, { method: 'POST', headers: {
+        let req = (url.substr(0, 5) == 'https' ? https : http).request(url, { method: 'POST', headers: {
            'Content-Type': 'application/json',
            'Content-Length': body_text.length,
-        } }, (res) =>
+        }, ...(opts||{}) }, (res) =>
        {
            if (!req)
            {
@@ -16,6 +16,7 @@ const etcd_allow = new RegExp('^'+[
    'config/pools',
    'config/osd/[1-9]\\d*',
    'config/pgs', // old name
+    'config/user/.*',
    'pg/config',
    'config/inode/[1-9]\\d*/[1-9]\\d*',
    'osd/state/[1-9]\\d*',
@@ -45,7 +46,14 @@ const etcd_tree = {
            config_path: "/etc/vitastor/vitastor.conf",
            etcd_prefix: "/vitastor",
            // etcd connection - configurable online
-            etcd_address: "10.0.115.10:2379/v3",
+            etcd_address: "http://10.0.115.10:2379/v3",
+            etcd_client_cert: "",
+            etcd_client_key: "",
+            osd_etcd_client_cert: "",
+            osd_etcd_client_key: "",
+            mon_etcd_client_cert: "",
+            mon_etcd_client_key: "",
+            etcd_ca: "",
            // mon
            etcd_mon_ttl: 5, // min: 1
            etcd_mon_timeout: 1000, // ms. min: 0
@@ -201,6 +209,8 @@ const etcd_tree = {
                primary_affinity_tags?: 'nvme' | [ 'nvme', ... ],
                // scrub interval
                scrub_interval?: '30d',
+                // users allowed to create images in this pool
+                creator_group?: '',
            },
            ...
        }, */
@@ -217,10 +227,21 @@ const etcd_tree = {
                    parent_id?: <inode_t>,
                    readonly?: boolean,
                    deleted?: boolean,
+                    enc_key?: string,
+                    owner?: string,
+                    owner_group?: string,
+                    reader_group?: string,
                }
            }
        }, */
        inode: {},
+        /* user: {
+            <username>: {
+                type: 'osd'|'mon'|'admin'|'client',
+                groups: string[],
+            },
+        }, */
+        user: {},
    },
    osd: {
        state: {
@@ -1,6 +1,6 @@
 {
  "name": "vitastor-mon",
-  "version": "3.0.5",
+  "version": "3.0.8",
  "description": "Vitastor SDS monitor service",
  "main": "mon-main.js",
  "scripts": {
@@ -0,0 +1,471 @@
+// AntiEtcd authentication filter for Vitastor
+// (c) Vitaliy Filippov, 2026
+// License: Mozilla Public License 2.0 or Vitastor Network Public License 1.1
+
+// Permissions are based on:
+// 1. Users.
+//    Stored in /vitastor/config/user/<username>.
+//    Has 2 properties:
+//    - type, one of: osd, mon, admin, client.
+//      osd, mon types should be used by OSDs/monitors.
+//      admin should be used for administrative access from vitastor-cli.
+//      client should be used for regular clients.
+//    - groups, a list of group names the user is included in.
+// 2. Images.
+//    Stored in /vitastor/config/inode/<pool>/<inode>. Has the following properties:
+//    - owner (user name)
+//    - owner_group (group name)
+//    - reader_group
+
+const static_perms = {
+    invalid: {
+        keys: {},
+        prefixes: {},
+    },
+    osd: {
+        keys: { '/pg/config': false },
+        prefixes: { '/osd/': true, '/pg/state/': true, '/pg/history/': true, '/pgstats/': true },
+    },
+    mon: {
+        keys: { '/pg/config': true, '/stats': true, '/history/last_clean_pgs': true },
+        prefixes: {
+            '/config/': false, '/osd/': false, '/mon/': true, '/pg/history/': true,
+            '/pgstats/': false, '/inode/stats/': true, '/pool/stats/': true,
+        },
+    },
+    admin: {
+        keys: { '/stats': false },
+        prefixes: {
+            '/config/': true, '/osd/': true, '/index/': true, '/pg/history/': true,
+            '/mon/': false, '/pg/': false, '/pgstats/': false, '/inode/stats/': false, '/pool/stats/': false,
+        },
+    },
+    client: {
+        keys: { '/config/global': false, '/config/node_placement': false, '/config/pools': false, '/pg/config': false },
+        prefixes: { '/osd/stats/': false, '/pg/state/': false, '/index/maxid/': false },
+    },
+};
+
+const api_perms = {
+    osd: { lease_grant: true, lease_revoke: true, lease_keepalive: true },
+    mon: { lease_grant: true, lease_revoke: true, lease_keepalive: true },
+    admin: { maintenance_status: true },
+    client: {},
+};
+
+class VitastorAuthFilter
+{
+    constructor(antietcd)
+    {
+        this.cfg = antietcd.cfg;
+        this.antietcd = antietcd;
+        this.prefix = this.cfg.vitastor_prefix || '/vitastor';
+        this.prefix_parts = this.prefix.split('/');
+    }
+
+    _get(path, decode)
+    {
+        let cur = this.antietcd.etctree.state;
+        path = path instanceof Array ? path : path.split('/');
+        for (const p of path)
+        {
+            if (!cur.children)
+            {
+                return null;
+            }
+            cur = cur.children[p];
+            if (!cur)
+            {
+                return null;
+            }
+        }
+        if (decode)
+        {
+            return this._decode(path, cur.value);
+        }
+        return cur;
+    }
+
+    _decode(path, cur)
+    {
+        if (!cur)
+        {
+            return null;
+        }
+        if (cur)
+        {
+            try
+            {
+                cur = JSON.parse(cur);
+            }
+            catch (e)
+            {
+                console.warn('Invalid JSON in '+(path instanceof Array ? path.join('/') : path)+': '+e);
+            }
+        }
+        return cur;
+    }
+
+    // userInfo: { name: string, type: string, perms: static_perms[type], groups: { [string]: true } }
+    _check_compare(check, userInfo, checked)
+    {
+        let key = String(check.key);
+        if (key.substr(0, this.prefix.length) !== this.prefix)
+        {
+            return false;
+        }
+        key = key.substr(this.prefix.length);
+        if (key in userInfo.perms.keys)
+        {
+            return true;
+        }
+        for (const pfx in userInfo.perms.prefixes)
+        {
+            if (key.substr(0, pfx.length) == pfx)
+            {
+                return true;
+            }
+        }
+        if (userInfo.type == 'client')
+        {
+            // Image permissions
+            if (key.substr(0, 14) == '/config/inode/')
+            {
+                // Allowed to check that a key does not exist
+                if (check.target == 'VERSION' && check.version == 0)
+                {
+                    checked['M'+key] = true;
+                    return true;
+                }
+                else if (check.target == 'MOD')
+                {
+                    const data = this._get(check.key);
+                    if (!data || data.mod_revision != check.mod_revision)
+                    {
+                        // Break check to trigger CAS failure
+                        check.mod_revision = '18446744073709551615'; // UINT64_MAX
+                        return true;
+                    }
+                    const inode = this._decode(check.key, data.value);
+                    if (inode && (inode.owner_group && userInfo.groups[inode.owner_group] ||
+                        inode.owner === userInfo.name))
+                    {
+                        checked['M'+key] = true;
+                        return true;
+                    }
+                }
+                return false;
+            }
+            if (key.substr(0, 13) == '/index/image/')
+            {
+                // Allowed to check that a key does not exist
+                if (check.target == 'VERSION' && check.version == 0)
+                {
+                    checked['M'+key] = true;
+                    return true;
+                }
+                else if (check.target == 'MOD')
+                {
+                    let data = this._get(check.key);
+                    if (!data || data.mod_revision != check.mod_revision)
+                    {
+                        // Break check to trigger CAS failure
+                        check.mod_revision = '18446744073709551615'; // UINT64_MAX
+                        return true;
+                    }
+                    data = this._decode(check.key, data.value);
+                    if (data)
+                    {
+                        const inode = this._get([ ...this.prefix_parts, 'config', 'inode', data.pool_id, data.id ], true);
+                        if (inode && (inode.owner_group && userInfo.groups[inode.owner_group] ||
+                            inode.owner === userInfo.name))
+                        {
+                            checked['M'+key] = true;
+                            return true;
+                        }
+                    }
+                }
+                return false;
+            }
+            if (key.substr(0, 13) == '/index/maxid/')
+            {
+                const pool_id = key.substr(13);
+                const pool_cfg = this._get([ ...this.prefix_parts, 'config', 'pools' ], true);
+                if (!pool_cfg || !pool_cfg[pool_id] || !pool_cfg[pool_id].creator_group || !userInfo.groups[pool_cfg[pool_id].creator_group])
+                {
+                    return false;
+                }
+                if (check.target == 'VERSION' && check.version == 0)
+                {
+                    checked['I'+parseInt(key.substr(13))+'_0'] = true;
+                    return true;
+                }
+                else if (check.target == 'MOD')
+                {
+                    const data = this._get(check.key);
+                    if (!data || data.mod_revision != check.mod_revision)
+                    {
+                        // Break check to trigger CAS failure
+                        check.mod_revision = '18446744073709551615'; // UINT64_MAX
+                        return true;
+                    }
+                    checked['I'+parseInt(key.substr(13))+'_'+data.value] = true;
+                    return true;
+                }
+                return false;
+            }
+        }
+        return false;
+    }
+
+    _check_read(kv, userInfo)
+    {
+        let key = String(kv.key);
+        if (key.substr(0, this.prefix.length) !== this.prefix)
+        {
+            return false;
+        }
+        key = key.substr(this.prefix.length);
+        if (key in userInfo.perms.keys)
+        {
+            return true;
+        }
+        for (const pfx in userInfo.perms.prefixes)
+        {
+            if (key.substr(0, pfx.length) == pfx)
+            {
+                return true;
+            }
+        }
+        if (userInfo.type == 'client')
+        {
+            // Image permissions
+            if (key.substr(0, 14) == '/config/inode/')
+            {
+                const inode = this._decode(kv.key, kv.value);
+                if (inode && (inode.reader_group && userInfo.groups[inode.reader_group] ||
+                    inode.owner_group && userInfo.groups[inode.owner_group] ||
+                    inode.owner === userInfo.name))
+                {
+                    return true;
+                }
+                return false;
+            }
+            if (key.substr(0, 13) == '/index/image/')
+            {
+                const data = this._decode(kv.key, kv.value);
+                const inode = this._get([ ...this.prefix_parts, 'config', 'inode', data.pool_id, data.id ], true);
+                if (inode && (inode.reader_group && userInfo.groups[inode.reader_group] ||
+                    inode.owner_group && userInfo.groups[inode.owner_group] ||
+                    inode.owner === userInfo.name))
+                {
+                    return true;
+                }
+                return false;
+            }
+        }
+        return false;
+    }
+
+    _check_write(put, userInfo, checked)
+    {
+        let key = String(put.key);
+        if (key.substr(0, this.prefix.length) !== this.prefix)
+        {
+            return false;
+        }
+        key = key.substr(this.prefix.length);
+        if (userInfo.perms.keys[key])
+        {
+            return true;
+        }
+        for (const pfx in userInfo.perms.prefixes)
+        {
+            if (userInfo.perms.prefixes[pfx] && key.substr(0, pfx.length) == pfx)
+            {
+                return true;
+            }
+        }
+        if (checked && userInfo.type == 'client')
+        {
+            if (key.substr(0, 13) == '/index/maxid/' &&
+                checked['I'+parseInt(key.substr(13))+'_'+(put.value-1)])
+            {
+                // Allowed to increment maxid
+                return true;
+            }
+            if (checked['M'+key])
+            {
+                // Allowed to modify known images with CAS checks
+                return true;
+            }
+        }
+        return false;
+    }
+
+    _check_req(req, userInfo, checked)
+    {
+        let r;
+        if ((r = (req.request_range || req.requestRange)))
+        {
+            // All range queries are allowed, but responses are filtered - it's simpler
+        }
+        else if ((r = (req.request_put || req.requestPut)))
+        {
+            if (!this._check_write(r, userInfo, checked))
+                return false;
+        }
+        else if ((r = (req.request_delete_range || req.requestDeleteRange)))
+        {
+            if (!r.range_end || r.range_end === r.key)
+            {
+                if (!this._check_write({ key: r.key }, userInfo))
+                    return false;
+            }
+            else
+            {
+                // All keys in range must satisfy prefix
+                r.range_end = String(r.range_end);
+                if (r.key.length != r.range_end.length ||
+                    r.key[r.key.length-1] != '/' ||
+                    r.range_end[r.range_end.length-1] != '0')
+                {
+                    return false;
+                }
+                let key = r.key.substr(this.prefix.length);
+                let found = false;
+                for (const pfx in userInfo.perms.prefixes)
+                {
+                    if (userInfo.perms.prefixes[pfx] && key.substr(0, pfx.length) == pfx)
+                    {
+                        found = true;
+                        break;
+                    }
+                }
+                if (!found)
+                    return false;
+            }
+        }
+        return true;
+    }
+
+    _get_user(username)
+    {
+        if (!username)
+        {
+            return null;
+        }
+        let userInfo = this._get([ ...this.prefix_parts, 'config', 'user', username ], true);
+        if (!userInfo)
+        {
+            userInfo = { type: 'client' };
+        }
+        userInfo.perms = static_perms[userInfo.type] || static_perms['invalid'];
+        userInfo.name = username;
+        if (userInfo.groups instanceof Array)
+        {
+            userInfo.groups = userInfo.groups.reduce((a, c) => { a[c] = true; return a; }, {});
+        }
+        else
+        {
+            userInfo.groups = {};
+        }
+        return userInfo;
+    }
+
+    filter_api(username, api/*, data*/)
+    {
+        if (username === 'root')
+        {
+            return true;
+        }
+        const userInfo = this._get([ ...this.prefix_parts, 'config', 'user', username ], true);
+        return userInfo && api_perms[userInfo.type] && api_perms[userInfo.type][api];
+    }
+
+    filter_txn(username, txn)
+    {
+        if (username === 'root')
+        {
+            return true;
+        }
+        const userInfo = this._get_user(username);
+        if (!userInfo)
+        {
+            return null;
+        }
+        const checked = {};
+        if (txn.compare)
+        {
+            for (const check of txn.compare)
+            {
+                if (!this._check_compare(check, userInfo, checked))
+                    return null;
+            }
+        }
+        // Special transactions:
+        // 1. create image: create config/inode and index/image, increment index/maxid/<pool> (with CAS)
+        // 2. create snapshot: same as create image but also rename previous to @snap
+        if (txn.success)
+        {
+            for (const req of txn.success)
+            {
+                if (!this._check_req(req, userInfo, checked))
+                    return null;
+            }
+        }
+        if (txn.failure)
+        {
+            for (const req of txn.failure)
+            {
+                if (!this._check_req(req, userInfo, null))
+                    return null;
+            }
+        }
+        return txn;
+    }
+
+    filter_txn_response(username, txn, res)
+    {
+        if (!res.responses || username === 'root')
+        {
+            return;
+        }
+        const userInfo = this._get_user(username);
+        if (!userInfo)
+        {
+            for (const resp of res.responses)
+            {
+                if (resp.response_range && resp.response_range.kvs)
+                {
+                    resp.response_range.kvs = [];
+                }
+            }
+            return;
+        }
+        for (const resp of res.responses)
+        {
+            if (resp.response_range && resp.response_range.kvs)
+            {
+                resp.response_range.kvs = resp.response_range.kvs.filter(kv => this._check_read(kv, userInfo));
+            }
+        }
+    }
+
+    filter_watch_message(username, msg)
+    {
+        if (!msg.result || !msg.result.events || username === 'root')
+        {
+            return;
+        }
+        const userInfo = this._get_user(username);
+        if (!userInfo)
+        {
+            msg.result.events = [];
+            return;
+        }
+        msg.result.events = msg.result.events.filter(ev => this._check_read(ev.kv, userInfo));
+    }
+}
+
+module.exports = VitastorAuthFilter;
@@ -1,6 +1,6 @@
 {
  "name": "vitastor",
-  "version": "3.0.5",
+  "version": "3.0.8",
  "description": "Low-level native bindings to Vitastor client library",
  "main": "index.js",
  "keywords": [
@@ -50,7 +50,7 @@ from cinder.volume import configuration
 from cinder.volume import driver
 from cinder.volume import volume_utils

-VITASTOR_VERSION = '3.0.5'
+VITASTOR_VERSION = '3.0.8'

 LOG = logging.getLogger(__name__)

@@ -0,0 +1,637 @@
+diff --git a/include/libvirt/libvirt-storage.h b/include/libvirt/libvirt-storage.h
+index aaad4a3da1..5f5daa8341 100644
+--- a/include/libvirt/libvirt-storage.h
+++ b/include/libvirt/libvirt-storage.h
+@@ -326,6 +326,7 @@ typedef enum {
+     VIR_CONNECT_LIST_STORAGE_POOLS_ZFS           = 1 << 17, /* (Since: 1.2.8) */
+     VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE      = 1 << 18, /* (Since: 3.1.0) */
+     VIR_CONNECT_LIST_STORAGE_POOLS_ISCSI_DIRECT  = 1 << 19, /* (Since: 5.6.0) */
+    VIR_CONNECT_LIST_STORAGE_POOLS_VITASTOR      = 1 << 20, /* (Since: 5.0.0) */
+ } virConnectListAllStoragePoolsFlags;
+ 
+ int                     virConnectListAllStoragePools(virConnectPtr conn,
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 9ca5c2450c..cc52f00c0c 100644
+--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
+@@ -7453,7 +7453,8 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node,
+     src->configFile = virXPathString("string(./config/@file)", ctxt);
+ 
+     if (src->protocol == VIR_STORAGE_NET_PROTOCOL_HTTP ||
+-        src->protocol == VIR_STORAGE_NET_PROTOCOL_HTTPS)
+        src->protocol == VIR_STORAGE_NET_PROTOCOL_HTTPS ||
+        src->protocol == VIR_STORAGE_NET_PROTOCOL_VITASTOR)
+         src->query = virXMLPropString(node, "query");
+ 
+     if (virDomainStorageNetworkParseHosts(node, ctxt, &src->hosts, &src->nhosts) < 0)
+@@ -32187,6 +32188,7 @@ virDomainStorageSourceTranslateSourcePool(virStorageSource *src,
+ 
+     case VIR_STORAGE_POOL_MPATH:
+     case VIR_STORAGE_POOL_RBD:
+    case VIR_STORAGE_POOL_VITASTOR:
+     case VIR_STORAGE_POOL_SHEEPDOG:
+     case VIR_STORAGE_POOL_GLUSTER:
+     case VIR_STORAGE_POOL_LAST:
+diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
+index 7346a61731..83e94d762e 100644
+--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
+@@ -520,6 +520,7 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src)
+         case VIR_STORAGE_NET_PROTOCOL_RBD:
+             break;
+ 
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+         case VIR_STORAGE_NET_PROTOCOL_NBD:
+         case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+         case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+@@ -592,7 +593,7 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src)
+         }
+     }
+ 
+-    /* internal snapshots and config files are currently supported only with rbd: */
+    /* internal snapshots are currently supported only with rbd: */
+     if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK &&
+         src->protocol != VIR_STORAGE_NET_PROTOCOL_RBD) {
+         if (src->snapshot) {
+@@ -600,10 +601,14 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src)
+                            _("<snapshot> element is currently supported only with 'rbd' disks"));
+             return -1;
+         }
+-
+    }
+    /* config files are currently supported only with rbd and vitastor: */
+    if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK &&
+        src->protocol != VIR_STORAGE_NET_PROTOCOL_RBD &&
+        src->protocol != VIR_STORAGE_NET_PROTOCOL_VITASTOR) {
+         if (src->configFile) {
+             virReportError(VIR_ERR_XML_ERROR, "%s",
+-                           _("<config> element is currently supported only with 'rbd' disks"));
+                           _("<config> element is currently supported only with 'rbd' and 'vitastor' disks"));
+             return -1;
+         }
+     }
+diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
+index 114dd3f96f..c71f9a3277 100644
+--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
+@@ -2093,6 +2093,35 @@
+     </element>
+   </define>
+ 
+  <define name="diskSourceNetworkProtocolVitastor">
+    <element name="source">
+      <interleave>
+        <attribute name="protocol">
+          <value>vitastor</value>
+        </attribute>
+        <ref name="diskSourceCommon"/>
+        <optional>
+          <attribute name="name"/>
+        </optional>
+        <optional>
+          <attribute name="query"/>
+        </optional>
+        <zeroOrMore>
+          <ref name="diskSourceNetworkHost"/>
+        </zeroOrMore>
+        <optional>
+          <element name="config">
+            <attribute name="file">
+              <ref name="absFilePath"/>
+            </attribute>
+            <empty/>
+          </element>
+        </optional>
+        <empty/>
+      </interleave>
+    </element>
+  </define>
+
+   <define name="diskSourceNetworkProtocolISCSI">
+     <element name="source">
+       <attribute name="protocol">
+@@ -2443,6 +2472,7 @@
+       <ref name="diskSourceNetworkProtocolSimple"/>
+       <ref name="diskSourceNetworkProtocolVxHS"/>
+       <ref name="diskSourceNetworkProtocolNFS"/>
+      <ref name="diskSourceNetworkProtocolVitastor"/>
+     </choice>
+   </define>
+ 
+diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c
+index 1dc9365bf2..a8a736be81 100644
+--- a/src/conf/storage_conf.c
+++ b/src/conf/storage_conf.c
+@@ -56,7 +56,7 @@ VIR_ENUM_IMPL(virStoragePool,
+               "logical", "disk", "iscsi",
+               "iscsi-direct", "scsi", "mpath",
+               "rbd", "sheepdog", "gluster",
+-              "zfs", "vstorage",
+              "zfs", "vstorage", "vitastor",
+ );
+ 
+ VIR_ENUM_IMPL(virStoragePoolFormatFileSystem,
+@@ -242,6 +242,18 @@ static virStoragePoolTypeInfo poolTypeInfo[] = {
+           .formatToString = virStorageFileFormatTypeToString,
+       }
+     },
+    {.poolType = VIR_STORAGE_POOL_VITASTOR,
+     .poolOptions = {
+         .flags = (VIR_STORAGE_POOL_SOURCE_HOST |
+                   VIR_STORAGE_POOL_SOURCE_NETWORK |
+                   VIR_STORAGE_POOL_SOURCE_NAME),
+      },
+      .volOptions = {
+          .defaultFormat = VIR_STORAGE_FILE_RAW,
+          .formatFromString = virStorageVolumeFormatFromString,
+          .formatToString = virStorageFileFormatTypeToString,
+      }
+    },
+     {.poolType = VIR_STORAGE_POOL_SHEEPDOG,
+      .poolOptions = {
+          .flags = (VIR_STORAGE_POOL_SOURCE_HOST |
+@@ -538,6 +550,11 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt,
+                        _("element 'name' is mandatory for RBD pool"));
+         return -1;
+     }
+    if (pool_type == VIR_STORAGE_POOL_VITASTOR && source->name == NULL) {
+        virReportError(VIR_ERR_XML_ERROR, "%s",
+                       _("element 'name' is mandatory for Vitastor pool"));
+        return -1;
+    }
+ 
+     if (options->formatFromString) {
+         g_autofree char *format = NULL;
+@@ -1127,6 +1144,7 @@ virStoragePoolDefFormatBuf(virBuffer *buf,
+     /* RBD, Sheepdog, Gluster and Iscsi-direct devices are not local block devs nor
+      * files, so they don't have a target */
+     if (def->type != VIR_STORAGE_POOL_RBD &&
+        def->type != VIR_STORAGE_POOL_VITASTOR &&
+         def->type != VIR_STORAGE_POOL_SHEEPDOG &&
+         def->type != VIR_STORAGE_POOL_GLUSTER &&
+         def->type != VIR_STORAGE_POOL_ISCSI_DIRECT) {
+diff --git a/src/conf/storage_conf.h b/src/conf/storage_conf.h
+index fc67957cfe..720c07ef74 100644
+--- a/src/conf/storage_conf.h
+++ b/src/conf/storage_conf.h
+@@ -103,6 +103,7 @@ typedef enum {
+     VIR_STORAGE_POOL_GLUSTER,  /* Gluster device */
+     VIR_STORAGE_POOL_ZFS,      /* ZFS */
+     VIR_STORAGE_POOL_VSTORAGE, /* Virtuozzo Storage */
+    VIR_STORAGE_POOL_VITASTOR, /* Vitastor */
+ 
+     VIR_STORAGE_POOL_LAST,
+ } virStoragePoolType;
+@@ -454,6 +455,7 @@ VIR_ENUM_DECL(virStoragePartedFs);
+                  VIR_CONNECT_LIST_STORAGE_POOLS_SCSI     | \
+                  VIR_CONNECT_LIST_STORAGE_POOLS_MPATH    | \
+                  VIR_CONNECT_LIST_STORAGE_POOLS_RBD      | \
+                 VIR_CONNECT_LIST_STORAGE_POOLS_VITASTOR | \
+                  VIR_CONNECT_LIST_STORAGE_POOLS_SHEEPDOG | \
+                  VIR_CONNECT_LIST_STORAGE_POOLS_GLUSTER  | \
+                  VIR_CONNECT_LIST_STORAGE_POOLS_ZFS      | \
+diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c
+index d7b9bdfecb..38aefd0dd4 100644
+--- a/src/conf/storage_source_conf.c
+++ b/src/conf/storage_source_conf.c
+@@ -90,6 +90,7 @@ VIR_ENUM_IMPL(virStorageNetProtocol,
+               "ssh",
+               "vxhs",
+               "nfs",
+              "vitastor",
+ );
+ 
+ 
+@@ -1317,6 +1318,7 @@ virStorageSourceNetworkDefaultPort(virStorageNetProtocol protocol)
+         case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+             return 24007;
+ 
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+         case VIR_STORAGE_NET_PROTOCOL_RBD:
+             /* we don't provide a default for RBD */
+             return 0;
+diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h
+index 22c35d420d..f1e32ea83d 100644
+--- a/src/conf/storage_source_conf.h
+++ b/src/conf/storage_source_conf.h
+@@ -131,6 +131,7 @@ typedef enum {
+     VIR_STORAGE_NET_PROTOCOL_SSH,
+     VIR_STORAGE_NET_PROTOCOL_VXHS,
+     VIR_STORAGE_NET_PROTOCOL_NFS,
+    VIR_STORAGE_NET_PROTOCOL_VITASTOR,
+ 
+     VIR_STORAGE_NET_PROTOCOL_LAST
+ } virStorageNetProtocol;
+diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c
+index 59fa5da372..4739167f5f 100644
+--- a/src/conf/virstorageobj.c
+++ b/src/conf/virstorageobj.c
+@@ -1438,6 +1438,7 @@ virStoragePoolObjSourceFindDuplicateCb(const void *payload,
+             return 1;
+         break;
+ 
+    case VIR_STORAGE_POOL_VITASTOR:
+     case VIR_STORAGE_POOL_ISCSI_DIRECT:
+     case VIR_STORAGE_POOL_RBD:
+     case VIR_STORAGE_POOL_LAST:
+@@ -1921,6 +1922,8 @@ virStoragePoolObjMatch(virStoragePoolObj *obj,
+                (obj->def->type == VIR_STORAGE_POOL_MPATH))   ||
+               (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_RBD) &&
+                (obj->def->type == VIR_STORAGE_POOL_RBD))     ||
+              (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_VITASTOR) &&
+               (obj->def->type == VIR_STORAGE_POOL_VITASTOR)) ||
+               (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_SHEEPDOG) &&
+                (obj->def->type == VIR_STORAGE_POOL_SHEEPDOG)) ||
+               (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_GLUSTER) &&
+diff --git a/src/libvirt-storage.c b/src/libvirt-storage.c
+index db7660aac4..561df34709 100644
+--- a/src/libvirt-storage.c
+++ b/src/libvirt-storage.c
+@@ -94,6 +94,7 @@ virStoragePoolGetConnect(virStoragePoolPtr pool)
+  * VIR_CONNECT_LIST_STORAGE_POOLS_SCSI
+  * VIR_CONNECT_LIST_STORAGE_POOLS_MPATH
+  * VIR_CONNECT_LIST_STORAGE_POOLS_RBD
+ * VIR_CONNECT_LIST_STORAGE_POOLS_VITASTOR
+  * VIR_CONNECT_LIST_STORAGE_POOLS_SHEEPDOG
+  * VIR_CONNECT_LIST_STORAGE_POOLS_GLUSTER
+  * VIR_CONNECT_LIST_STORAGE_POOLS_ZFS
+diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c
+index 2b988157fa..9d0eb47b25 100644
+--- a/src/libxl/libxl_conf.c
+++ b/src/libxl/libxl_conf.c
+@@ -1069,6 +1069,7 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src,
+     case VIR_STORAGE_NET_PROTOCOL_SSH:
+     case VIR_STORAGE_NET_PROTOCOL_VXHS:
+     case VIR_STORAGE_NET_PROTOCOL_NFS:
+    case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+     case VIR_STORAGE_NET_PROTOCOL_LAST:
+     case VIR_STORAGE_NET_PROTOCOL_NONE:
+         virReportError(VIR_ERR_NO_SUPPORT,
+diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c
+index e72e7d7f44..8482c21805 100644
+--- a/src/libxl/xen_xl.c
+++ b/src/libxl/xen_xl.c
+@@ -1461,6 +1461,7 @@ xenFormatXLDiskSrcNet(virStorageSource *src)
+     case VIR_STORAGE_NET_PROTOCOL_SSH:
+     case VIR_STORAGE_NET_PROTOCOL_VXHS:
+     case VIR_STORAGE_NET_PROTOCOL_NFS:
+    case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+     case VIR_STORAGE_NET_PROTOCOL_LAST:
+     case VIR_STORAGE_NET_PROTOCOL_NONE:
+         virReportError(VIR_ERR_NO_SUPPORT,
+diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
+index 9b43279797..459d8e8a65 100644
+--- a/src/qemu/qemu_block.c
+++ b/src/qemu/qemu_block.c
+@@ -743,6 +743,38 @@ qemuBlockStorageSourceGetRBDProps(virStorageSource *src,
+ }
+ 
+ 
+static virJSONValue *
+qemuBlockStorageSourceGetVitastorProps(virStorageSource *src)
+{
+    virJSONValue *ret = NULL;
+    virStorageNetHostDef *host;
+    size_t i;
+    g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
+    g_autofree char *etcd = NULL;
+
+    for (i = 0; i < src->nhosts; i++) {
+        host = src->hosts + i;
+        if ((virStorageNetHostTransport)host->transport != VIR_STORAGE_NET_HOST_TRANS_TCP) {
+            return NULL;
+        }
+        virBufferAsprintf(&buf, i > 0 ? ",%s:%u" : "%s:%u", host->name, host->port);
+    }
+    if (src->nhosts > 0) {
+        etcd = virBufferContentAndReset(&buf);
+    }
+
+    if (virJSONValueObjectAdd(&ret,
+                              "S:etcd-host", etcd,
+                              "S:etcd-prefix", src->query,
+                              "S:config-path", src->configFile,
+                              "s:image", src->path,
+                              NULL) < 0)
+        return NULL;
+
+    return ret;
+}
+
+
+ static virJSONValue *
+ qemuBlockStorageSourceGetSshProps(virStorageSource *src)
+ {
+@@ -1094,6 +1126,12 @@ qemuBlockStorageSourceGetBackendProps(virStorageSource *src,
+                 return NULL;
+             break;
+ 
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+            driver = "vitastor";
+            if (!(fileprops = qemuBlockStorageSourceGetVitastorProps(src)))
+                return NULL;
+            break;
+
+         case VIR_STORAGE_NET_PROTOCOL_SSH:
+             driver = "ssh";
+             if (!(fileprops = qemuBlockStorageSourceGetSshProps(src)))
+@@ -1997,6 +2035,7 @@ qemuBlockGetBackingStoreString(virStorageSource *src,
+ 
+             case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+             case VIR_STORAGE_NET_PROTOCOL_RBD:
+            case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+             case VIR_STORAGE_NET_PROTOCOL_VXHS:
+             case VIR_STORAGE_NET_PROTOCOL_NFS:
+             case VIR_STORAGE_NET_PROTOCOL_SSH:
+@@ -2377,6 +2416,12 @@ qemuBlockStorageSourceCreateGetStorageProps(virStorageSource *src,
+                 return -1;
+             break;
+ 
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+            driver = "vitastor";
+            if (!(location = qemuBlockStorageSourceGetVitastorProps(src)))
+                return -1;
+            break;
+
+         case VIR_STORAGE_NET_PROTOCOL_SSH:
+             if (srcPriv->nbdkitProcess) {
+                 /* disk creation not yet supported with nbdkit, and even if it
+diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
+index ac56fc7cb4..9e407b4aab 100644
+--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
+@@ -4677,7 +4677,8 @@ qemuDomainValidateStorageSource(virStorageSource *src,
+     if (src->query &&
+         (actualType != VIR_STORAGE_TYPE_NETWORK ||
+          (src->protocol != VIR_STORAGE_NET_PROTOCOL_HTTPS &&
+-          src->protocol != VIR_STORAGE_NET_PROTOCOL_HTTP))) {
+          src->protocol != VIR_STORAGE_NET_PROTOCOL_HTTP &&
+          src->protocol != VIR_STORAGE_NET_PROTOCOL_VITASTOR))) {
+         virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("query is supported only with HTTP(S) protocols"));
+         return -1;
+@@ -9103,6 +9104,7 @@ qemuDomainPrepareStorageSourceTLS(virStorageSource *src,
+         break;
+ 
+     case VIR_STORAGE_NET_PROTOCOL_RBD:
+    case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+     case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+     case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+     case VIR_STORAGE_NET_PROTOCOL_ISCSI:
+diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
+index e738afffc3..37d64f469b 100644
+--- a/src/qemu/qemu_snapshot.c
+++ b/src/qemu/qemu_snapshot.c
+@@ -665,6 +665,7 @@ qemuSnapshotPrepareDiskExternalInactive(virDomainSnapshotDiskDef *snapdisk,
+         case VIR_STORAGE_NET_PROTOCOL_NONE:
+         case VIR_STORAGE_NET_PROTOCOL_NBD:
+         case VIR_STORAGE_NET_PROTOCOL_RBD:
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+         case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+         case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+         case VIR_STORAGE_NET_PROTOCOL_ISCSI:
+@@ -893,6 +894,7 @@ qemuSnapshotPrepareDiskInternal(virDomainDiskDef *disk,
+         case VIR_STORAGE_NET_PROTOCOL_NONE:
+         case VIR_STORAGE_NET_PROTOCOL_NBD:
+         case VIR_STORAGE_NET_PROTOCOL_RBD:
+        case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+         case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+         case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+         case VIR_STORAGE_NET_PROTOCOL_ISCSI:
+diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
+index e19e032427..59f91f4710 100644
+--- a/src/storage/storage_driver.c
+++ b/src/storage/storage_driver.c
+@@ -1626,6 +1626,7 @@ storageVolLookupByPathCallback(virStoragePoolObj *obj,
+ 
+         case VIR_STORAGE_POOL_GLUSTER:
+         case VIR_STORAGE_POOL_RBD:
+        case VIR_STORAGE_POOL_VITASTOR:
+         case VIR_STORAGE_POOL_SHEEPDOG:
+         case VIR_STORAGE_POOL_ZFS:
+         case VIR_STORAGE_POOL_LAST:
+diff --git a/src/storage_file/storage_source_backingstore.c b/src/storage_file/storage_source_backingstore.c
+index 821378883c..2211f6891b 100644
+--- a/src/storage_file/storage_source_backingstore.c
+++ b/src/storage_file/storage_source_backingstore.c
+@@ -264,6 +264,75 @@ virStorageSourceParseRBDColonString(const char *rbdstr,
+ }
+ 
+ 
+static int
+virStorageSourceParseVitastorColonString(const char *colonstr,
+                                         virStorageSource *src)
+{
+    char *p, *e, *next;
+    g_autofree char *options = NULL;
+
+    /* optionally skip the "vitastor:" prefix if provided */
+    if (STRPREFIX(colonstr, "vitastor:"))
+        colonstr += strlen("vitastor:");
+
+    options = g_strdup(colonstr);
+
+    p = options;
+    while (*p) {
+        /* find : delimiter or end of string */
+        for (e = p; *e && *e != ':'; ++e) {
+            if (*e == '\\') {
+                e++;
+                if (*e == '\0')
+                    break;
+            }
+        }
+        if (*e == '\0') {
+            next = e;    /* last kv pair */
+        } else {
+            next = e + 1;
+            *e = '\0';
+        }
+
+        if (STRPREFIX(p, "image=")) {
+            src->path = g_strdup(p + strlen("image="));
+        } else if (STRPREFIX(p, "etcd-prefix=")) {
+            src->query = g_strdup(p + strlen("etcd-prefix="));
+        } else if (STRPREFIX(p, "config-path=")) {
+            src->configFile = g_strdup(p + strlen("config-path="));
+        } else if (STRPREFIX(p, "etcd-host=")) {
+            char *h, *sep;
+
+            h = p + strlen("etcd-host=");
+            while (h < e) {
+                for (sep = h; sep < e; ++sep) {
+                    if (*sep == '\\' && (sep[1] == ',' ||
+                                         sep[1] == ';' ||
+                                         sep[1] == ' ')) {
+                        *sep = '\0';
+                        sep += 2;
+                        break;
+                    }
+                }
+
+                if (virStorageSourceRBDAddHost(src, h) < 0)
+                    return -1;
+
+                h = sep;
+            }
+        }
+
+        p = next;
+    }
+
+    if (!src->path) {
+        return -1;
+    }
+
+    return 0;
+}
+
+
+ static int
+ virStorageSourceParseNBDColonString(const char *nbdstr,
+                                     virStorageSource *src)
+@@ -379,6 +448,11 @@ virStorageSourceParseBackingColon(virStorageSource *src,
+             return -1;
+         break;
+ 
+    case VIR_STORAGE_NET_PROTOCOL_VITASTOR:
+        if (virStorageSourceParseVitastorColonString(path, src) < 0)
+            return -1;
+        break;
+
+     case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+     case VIR_STORAGE_NET_PROTOCOL_LAST:
+     case VIR_STORAGE_NET_PROTOCOL_NONE:
+@@ -953,6 +1027,54 @@ virStorageSourceParseBackingJSONRBD(virStorageSource *src,
+     return 0;
+ }
+ 
+static int
+virStorageSourceParseBackingJSONVitastor(virStorageSource *src,
+                                         virJSONValue *json,
+                                         const char *jsonstr G_GNUC_UNUSED,
+                                         int opaque G_GNUC_UNUSED)
+{
+    const char *filename;
+    const char *image = virJSONValueObjectGetString(json, "image");
+    const char *conf = virJSONValueObjectGetString(json, "config-path");
+    const char *etcd_prefix = virJSONValueObjectGetString(json, "etcd-prefix");
+    virJSONValue *servers = virJSONValueObjectGetArray(json, "server");
+    size_t nservers;
+    size_t i;
+
+    src->type = VIR_STORAGE_TYPE_NETWORK;
+    src->protocol = VIR_STORAGE_NET_PROTOCOL_VITASTOR;
+
+    /* legacy syntax passed via 'filename' option */
+    if ((filename = virJSONValueObjectGetString(json, "filename")))
+        return virStorageSourceParseVitastorColonString(filename, src);
+
+    if (!image) {
+        virReportError(VIR_ERR_INVALID_ARG, "%s",
+                       _("missing image name in Vitastor backing volume "
+                         "JSON specification"));
+        return -1;
+    }
+
+    src->path = g_strdup(image);
+    src->configFile = g_strdup(conf);
+    src->query = g_strdup(etcd_prefix);
+
+    if (servers) {
+        nservers = virJSONValueArraySize(servers);
+
+        src->hosts = g_new0(virStorageNetHostDef, nservers);
+        src->nhosts = nservers;
+
+        for (i = 0; i < nservers; i++) {
+            if (virStorageSourceParseBackingJSONInetSocketAddress(src->hosts + i,
+                                                                  virJSONValueArrayGet(servers, i)) < 0)
+                return -1;
+        }
+    }
+
+    return 0;
+}
+
+ static int
+ virStorageSourceParseBackingJSONRaw(virStorageSource *src,
+                                     virJSONValue *json,
+@@ -1130,6 +1252,7 @@ static const struct virStorageSourceJSONDriverParser jsonParsers[] = {
+     {"sheepdog", false, virStorageSourceParseBackingJSONSheepdog, 0},
+     {"ssh", false, virStorageSourceParseBackingJSONSSH, 0},
+     {"rbd", false, virStorageSourceParseBackingJSONRBD, 0},
+    {"vitastor", false, virStorageSourceParseBackingJSONVitastor, 0},
+     {"raw", true, virStorageSourceParseBackingJSONRaw, 0},
+     {"nfs", false, virStorageSourceParseBackingJSONNFS, 0},
+     {"vxhs", false, virStorageSourceParseBackingJSONVxHS, 0},
+diff --git a/src/test/test_driver.c b/src/test/test_driver.c
+index 1165689de7..bba846351c 100644
+--- a/src/test/test_driver.c
+++ b/src/test/test_driver.c
+@@ -7345,6 +7345,7 @@ testStorageVolumeTypeForPool(int pooltype)
+     case VIR_STORAGE_POOL_ISCSI_DIRECT:
+     case VIR_STORAGE_POOL_GLUSTER:
+     case VIR_STORAGE_POOL_RBD:
+    case VIR_STORAGE_POOL_VITASTOR:
+         return VIR_STORAGE_VOL_NETWORK;
+     case VIR_STORAGE_POOL_LOGICAL:
+     case VIR_STORAGE_POOL_DISK:
+diff --git a/tests/storagepoolcapsschemadata/poolcaps-fs.xml b/tests/storagepoolcapsschemadata/poolcaps-fs.xml
+index eee75af746..8bd0a57bdd 100644
+--- a/tests/storagepoolcapsschemadata/poolcaps-fs.xml
+++ b/tests/storagepoolcapsschemadata/poolcaps-fs.xml
+@@ -204,4 +204,11 @@
+       </enum>
+     </volOptions>
+   </pool>
+  <pool type='vitastor' supported='no'>
+    <volOptions>
+      <defaultFormat type='raw'/>
+      <enum name='targetFormatType'>
+      </enum>
+    </volOptions>
+  </pool>
+ </storagepoolCapabilities>
+diff --git a/tests/storagepoolcapsschemadata/poolcaps-full.xml b/tests/storagepoolcapsschemadata/poolcaps-full.xml
+index 805950a937..852df0de16 100644
+--- a/tests/storagepoolcapsschemadata/poolcaps-full.xml
+++ b/tests/storagepoolcapsschemadata/poolcaps-full.xml
+@@ -204,4 +204,11 @@
+       </enum>
+     </volOptions>
+   </pool>
+  <pool type='vitastor' supported='yes'>
+    <volOptions>
+      <defaultFormat type='raw'/>
+      <enum name='targetFormatType'>
+      </enum>
+    </volOptions>
+  </pool>
+ </storagepoolCapabilities>
+diff --git a/tests/storagepoolxml2argvtest.c b/tests/storagepoolxml2argvtest.c
+index d5c2531ab8..b19308ac38 100644
+--- a/tests/storagepoolxml2argvtest.c
+++ b/tests/storagepoolxml2argvtest.c
+@@ -57,6 +57,7 @@ testCompareXMLToArgvFiles(bool shouldFail,
+     case VIR_STORAGE_POOL_GLUSTER:
+     case VIR_STORAGE_POOL_ZFS:
+     case VIR_STORAGE_POOL_VSTORAGE:
+    case VIR_STORAGE_POOL_VITASTOR:
+     case VIR_STORAGE_POOL_LAST:
+     default:
+         VIR_TEST_DEBUG("pool type '%s' has no xml2argv test", defTypeStr);
+diff --git a/tools/virsh-pool.c b/tools/virsh-pool.c
+index 2010ef1356..072e2ff9e8 100644
+--- a/tools/virsh-pool.c
+++ b/tools/virsh-pool.c
+@@ -1187,6 +1187,9 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd G_GNUC_UNUSED)
+             case VIR_STORAGE_POOL_VSTORAGE:
+                 flags |= VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE;
+                 break;
+            case VIR_STORAGE_POOL_VITASTOR:
+                flags |= VIR_CONNECT_LIST_STORAGE_POOLS_VITASTOR;
+                break;
+             case VIR_STORAGE_POOL_LAST:
+                 break;
+             }
@@ -1,29 +1,172 @@
-diff --git a/src/client/qemu_driver.c b/src/client/qemu_driver.c
-index d8356dab..5f4cd50d 100644
--- a/src/client/qemu_driver.c
-+++ b/src/client/qemu_driver.c
-@@ -974,14 +974,21 @@ static void vitastor_co_read_bitmap_cb(void *opaque, long retval, uint8_t *bitma
- #endif
- }
+diff --git a/block/meson.build b/block/meson.build
+index 34b1b2a306..24ca0f1e52 100644
+--- a/block/meson.build
+++ b/block/meson.build
+@@ -114,6 +114,7 @@ foreach m : [
+   [libnfs, 'nfs', files('nfs.c')],
+   [libssh, 'ssh', files('ssh.c')],
+   [rbd, 'rbd', files('rbd.c')],
+  [vitastor, 'vitastor', files('vitastor.c')],
+ ]
+   if m[0].found()
+     module_ss = ss.source_set()
+diff --git a/meson.build b/meson.build
+index 50c774a195..e5c7a3a4b1 100644
+--- a/meson.build
+++ b/meson.build
+@@ -1652,6 +1652,26 @@ if not get_option('rbd').auto() or have_block
+   endif
+ endif
 
-static int coroutine_fn vitastor_co_block_status(
-    BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
-    int64_t *pnum, int64_t *map, BlockDriverState **file)
-+static int coroutine_fn vitastor_co_block_status(BlockDriverState *bs,
-+#if QEMU_VERSION_MAJOR > 10 || QEMU_VERSION_MAJOR == 10 && QEMU_VERSION_MINOR >= 1
-+    unsigned int mode,
-+#else
-+    bool want_zero,
-+#endif
-+    int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file)
- {
-     // Allocated => return BDRV_BLOCK_DATA|BDRV_BLOCK_OFFSET_VALID
-     // Not allocated => return 0
-     // Error => return -errno
-     // Set pnum to length of the extent, `*map` = `offset`, `*file` = `bs`
-+#if QEMU_VERSION_MAJOR > 10 || QEMU_VERSION_MAJOR == 10 && QEMU_VERSION_MINOR >= 1
-+    int want_zero = (mode == BDRV_WANT_PRECISE);
-+#endif
-     VitastorRPC task;
-     VitastorClient *client = bs->opaque;
-     uint64_t inode = client->watch ? vitastor_c_inode_get_num(client->watch) : client->inode;
+vitastor = not_found
+if not get_option('vitastor').auto() or have_block
+  libvitastor_client = cc.find_library('vitastor_client', has_headers: ['vitastor_c.h'],
+    required: get_option('vitastor'))
+  if libvitastor_client.found()
+    if cc.links('''
+      #include <vitastor_c.h>
+      int main(void) {
+        vitastor_c_create_qemu(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+        return 0;
+      }''', dependencies: libvitastor_client)
+      vitastor = declare_dependency(dependencies: libvitastor_client)
+    elif get_option('vitastor').enabled()
+      error('could not link libvitastor_client')
+    else
+      warning('could not link libvitastor_client, disabling')
+    endif
+  endif
+endif
+
+ glusterfs = not_found
+ glusterfs_ftruncate_has_stat = false
+ glusterfs_iocb_has_stat = false
+@@ -2547,6 +2567,7 @@ endif
+ config_host_data.set('CONFIG_OPENGL', opengl.found())
+ config_host_data.set('CONFIG_PLUGIN', get_option('plugins'))
+ config_host_data.set('CONFIG_RBD', rbd.found())
+config_host_data.set('CONFIG_VITASTOR', vitastor.found())
+ config_host_data.set('CONFIG_RDMA', rdma.found())
+ config_host_data.set('CONFIG_RELOCATABLE', get_option('relocatable'))
+ config_host_data.set('CONFIG_SAFESTACK', get_option('safe_stack'))
+@@ -4972,6 +4993,7 @@ summary_info += {'fdt support':       fdt_opt == 'internal' ? 'internal' : fdt}
+ summary_info += {'libcap-ng support': libcap_ng}
+ summary_info += {'bpf support':       libbpf}
+ summary_info += {'rbd support':       rbd}
+summary_info += {'vitastor support':  vitastor}
+ summary_info += {'smartcard support': cacard}
+ summary_info += {'U2F support':       u2f}
+ summary_info += {'libusb':            libusb}
+diff --git a/meson_options.txt b/meson_options.txt
+index fff1521e58..f0844c0e00 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -202,6 +202,8 @@ option('pvg', type: 'feature', value: 'auto',
+        description: 'macOS paravirtualized graphics support')
+ option('rbd', type : 'feature', value : 'auto',
+        description: 'Ceph block device driver')
+option('vitastor', type : 'feature', value : 'auto',
+       description: 'Vitastor block device driver')
+ option('opengl', type : 'feature', value : 'auto',
+        description: 'OpenGL support')
+ option('rdma', type : 'feature', value : 'auto',
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index dc6eb4ae23..d043f4340e 100644
+--- a/qapi/block-core.json
+++ b/qapi/block-core.json
+@@ -3280,7 +3280,7 @@
+             'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
+             'raw', 'rbd',
+             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
+-            'ssh', 'throttle', 'vdi', 'vhdx',
+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor',
+             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+             { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
+@@ -4363,6 +4363,28 @@
+             '*key-secret': 'str',
+             '*server': ['InetSocketAddressBase'] } }
+ 
+##
+# @BlockdevOptionsVitastor:
+#
+# Driver specific block device options for vitastor
+#
+# @image:       Image name
+# @inode:       Inode number
+# @pool:        Pool ID
+# @size:        Desired image size in bytes
+# @config-path: Path to Vitastor configuration
+# @etcd-host:   etcd connection address(es)
+# @etcd-prefix: etcd key/value prefix
+##
+{ 'struct': 'BlockdevOptionsVitastor',
+  'data': { '*inode': 'uint64',
+            '*pool': 'uint64',
+            '*size': 'uint64',
+            '*image': 'str',
+            '*config-path': 'str',
+            '*etcd-host': 'str',
+            '*etcd-prefix': 'str' } }
+
+ ##
+ # @ReplicationMode:
+ #
+@@ -4831,6 +4853,7 @@
+       'throttle':   'BlockdevOptionsThrottle',
+       'vdi':        'BlockdevOptionsGenericFormat',
+       'vhdx':       'BlockdevOptionsGenericFormat',
+      'vitastor':   'BlockdevOptionsVitastor',
+       'virtio-blk-vfio-pci':
+                     { 'type': 'BlockdevOptionsVirtioBlkVfioPci',
+                       'if': 'CONFIG_BLKIO' },
+@@ -5304,6 +5327,20 @@
+             '*cluster-size' :   'size',
+             '*encrypt' :        'RbdEncryptionCreateOptions' } }
+ 
+##
+# @BlockdevCreateOptionsVitastor:
+#
+# Driver specific image creation options for Vitastor.
+#
+# @location: Where to store the new image file.  This location cannot
+#     point to a snapshot.
+#
+# @size: Size of the virtual disk in bytes
+##
+{ 'struct': 'BlockdevCreateOptionsVitastor',
+  'data': { 'location':         'BlockdevOptionsVitastor',
+            'size':             'size' } }
+
+ ##
+ # @BlockdevVmdkSubformat:
+ #
+@@ -5526,6 +5563,7 @@
+       'ssh':            'BlockdevCreateOptionsSsh',
+       'vdi':            'BlockdevCreateOptionsVdi',
+       'vhdx':           'BlockdevCreateOptionsVhdx',
+      'vitastor':       'BlockdevCreateOptionsVitastor',
+       'vmdk':           'BlockdevCreateOptionsVmdk',
+       'vpc':            'BlockdevCreateOptionsVpc'
+   } }
+diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
+index 0ebe6bc52a..2c37ad3892 100644
+--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
+@@ -175,6 +175,7 @@ meson_options_help() {
+   printf "%s\n" '  qga-vss         build QGA VSS support (broken with MinGW)'
+   printf "%s\n" '  qpl             Query Processing Library support'
+   printf "%s\n" '  rbd             Ceph block device driver'
+  printf "%s\n" '  vitastor        Vitastor block device driver'
+   printf "%s\n" '  rdma            Enable RDMA-based migration'
+   printf "%s\n" '  replication     replication support'
+   printf "%s\n" '  rust            Rust support'
+@@ -459,6 +460,8 @@ _meson_option_parse() {
+     --disable-qpl) printf "%s" -Dqpl=disabled ;;
+     --enable-rbd) printf "%s" -Drbd=enabled ;;
+     --disable-rbd) printf "%s" -Drbd=disabled ;;
+    --enable-vitastor) printf "%s" -Dvitastor=enabled ;;
+    --disable-vitastor) printf "%s" -Dvitastor=disabled ;;
+     --enable-rdma) printf "%s" -Drdma=enabled ;;
+     --disable-rdma) printf "%s" -Drdma=disabled ;;
+     --enable-relocatable) printf "%s" -Drelocatable=true ;;
@@ -0,0 +1,172 @@
+diff --git a/block/meson.build b/block/meson.build
+index 34b1b2a306..24ca0f1e52 100644
+--- a/block/meson.build
+++ b/block/meson.build
+@@ -114,6 +114,7 @@ foreach m : [
+   [libnfs, 'nfs', files('nfs.c')],
+   [libssh, 'ssh', files('ssh.c')],
+   [rbd, 'rbd', files('rbd.c')],
+  [vitastor, 'vitastor', files('vitastor.c')],
+ ]
+   if m[0].found()
+     module_ss = ss.source_set()
+diff --git a/meson.build b/meson.build
+index d9293294d8..776a5becc6 100644
+--- a/meson.build
+++ b/meson.build
+@@ -1665,6 +1665,26 @@ if not get_option('rbd').auto() or have_block
+   endif
+ endif
+ 
+vitastor = not_found
+if not get_option('vitastor').auto() or have_block
+  libvitastor_client = cc.find_library('vitastor_client', has_headers: ['vitastor_c.h'],
+    required: get_option('vitastor'))
+  if libvitastor_client.found()
+    if cc.links('''
+      #include <vitastor_c.h>
+      int main(void) {
+        vitastor_c_create_qemu(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+        return 0;
+      }''', dependencies: libvitastor_client)
+      vitastor = declare_dependency(dependencies: libvitastor_client)
+    elif get_option('vitastor').enabled()
+      error('could not link libvitastor_client')
+    else
+      warning('could not link libvitastor_client, disabling')
+    endif
+  endif
+endif
+
+ glusterfs = not_found
+ glusterfs_ftruncate_has_stat = false
+ glusterfs_iocb_has_stat = false
+@@ -2509,6 +2529,7 @@ endif
+ config_host_data.set('CONFIG_OPENGL', opengl.found())
+ config_host_data.set('CONFIG_PLUGIN', get_option('plugins'))
+ config_host_data.set('CONFIG_RBD', rbd.found())
+config_host_data.set('CONFIG_VITASTOR', vitastor.found())
+ config_host_data.set('CONFIG_RDMA', rdma.found())
+ config_host_data.set('CONFIG_RELOCATABLE', get_option('relocatable'))
+ config_host_data.set('CONFIG_SAFESTACK', get_option('safe_stack'))
+@@ -4948,6 +4969,7 @@ summary_info += {'fdt support':       fdt_opt == 'internal' ? 'internal' : fdt}
+ summary_info += {'libcap-ng support': libcap_ng}
+ summary_info += {'bpf support':       libbpf}
+ summary_info += {'rbd support':       rbd}
+summary_info += {'vitastor support':  vitastor}
+ summary_info += {'smartcard support': cacard}
+ summary_info += {'U2F support':       u2f}
+ summary_info += {'libusb':            libusb}
+diff --git a/meson_options.txt b/meson_options.txt
+index 2836156257..148086cc6f 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -206,6 +206,8 @@ option('pvg', type: 'feature', value: 'auto',
+        description: 'macOS paravirtualized graphics support')
+ option('rbd', type : 'feature', value : 'auto',
+        description: 'Ceph block device driver')
+option('vitastor', type : 'feature', value : 'auto',
+       description: 'Vitastor block device driver')
+ option('opengl', type : 'feature', value : 'auto',
+        description: 'OpenGL support')
+ option('rdma', type : 'feature', value : 'auto',
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index b82af74256..f25a6f5ce8 100644
+--- a/qapi/block-core.json
+++ b/qapi/block-core.json
+@@ -3351,7 +3351,7 @@
+             'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
+             'raw', 'rbd',
+             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
+-            'ssh', 'throttle', 'vdi', 'vhdx',
+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor',
+             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+             { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
+@@ -4434,6 +4434,28 @@
+             '*key-secret': 'str',
+             '*server': ['InetSocketAddressBase'] } }
+ 
+##
+# @BlockdevOptionsVitastor:
+#
+# Driver specific block device options for vitastor
+#
+# @image:       Image name
+# @inode:       Inode number
+# @pool:        Pool ID
+# @size:        Desired image size in bytes
+# @config-path: Path to Vitastor configuration
+# @etcd-host:   etcd connection address(es)
+# @etcd-prefix: etcd key/value prefix
+##
+{ 'struct': 'BlockdevOptionsVitastor',
+  'data': { '*inode': 'uint64',
+            '*pool': 'uint64',
+            '*size': 'uint64',
+            '*image': 'str',
+            '*config-path': 'str',
+            '*etcd-host': 'str',
+            '*etcd-prefix': 'str' } }
+
+ ##
+ # @ReplicationMode:
+ #
+@@ -4902,6 +4924,7 @@
+       'throttle':   'BlockdevOptionsThrottle',
+       'vdi':        'BlockdevOptionsGenericFormat',
+       'vhdx':       'BlockdevOptionsGenericFormat',
+      'vitastor':   'BlockdevOptionsVitastor',
+       'virtio-blk-vfio-pci':
+                     { 'type': 'BlockdevOptionsVirtioBlkVfioPci',
+                       'if': 'CONFIG_BLKIO' },
+@@ -5376,6 +5399,20 @@
+             '*cluster-size' :   'size',
+             '*encrypt' :        'RbdEncryptionCreateOptions' } }
+ 
+##
+# @BlockdevCreateOptionsVitastor:
+#
+# Driver specific image creation options for Vitastor.
+#
+# @location: Where to store the new image file.  This location cannot
+#     point to a snapshot.
+#
+# @size: Size of the virtual disk in bytes
+##
+{ 'struct': 'BlockdevCreateOptionsVitastor',
+  'data': { 'location':         'BlockdevOptionsVitastor',
+            'size':             'size' } }
+
+ ##
+ # @BlockdevVmdkSubformat:
+ #
+@@ -5598,6 +5635,7 @@
+       'ssh':            'BlockdevCreateOptionsSsh',
+       'vdi':            'BlockdevCreateOptionsVdi',
+       'vhdx':           'BlockdevCreateOptionsVhdx',
+      'vitastor':       'BlockdevCreateOptionsVitastor',
+       'vmdk':           'BlockdevCreateOptionsVmdk',
+       'vpc':            'BlockdevCreateOptionsVpc'
+   } }
+diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
+index 3d0d132344..65ee8c855e 100644
+--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
+@@ -177,6 +177,7 @@ meson_options_help() {
+   printf "%s\n" '  qga-vss         build QGA VSS support (broken with MinGW)'
+   printf "%s\n" '  qpl             Query Processing Library support'
+   printf "%s\n" '  rbd             Ceph block device driver'
+  printf "%s\n" '  vitastor        Vitastor block device driver'
+   printf "%s\n" '  rdma            Enable RDMA-based migration'
+   printf "%s\n" '  replication     replication support'
+   printf "%s\n" '  rust            Rust support'
+@@ -464,6 +465,8 @@ _meson_option_parse() {
+     --disable-qpl) printf "%s" -Dqpl=disabled ;;
+     --enable-rbd) printf "%s" -Drbd=enabled ;;
+     --disable-rbd) printf "%s" -Drbd=disabled ;;
+    --enable-vitastor) printf "%s" -Dvitastor=enabled ;;
+    --disable-vitastor) printf "%s" -Dvitastor=disabled ;;
+     --enable-rdma) printf "%s" -Drdma=enabled ;;
+     --disable-rdma) printf "%s" -Drdma=disabled ;;
+     --enable-relocatable) printf "%s" -Drelocatable=true ;;
@@ -11,7 +11,7 @@ WORKDIR /root
 RUN sed -i 's/enabled=0/enabled=1/' /etc/yum.repos.d/*.repo
 RUN dnf -y install epel-release dnf-plugins-core
 RUN dnf -y install https://vitastor.io/rpms/centos/10/vitastor-release-1.0-1.el10.noarch.rpm
-RUN dnf -y install gcc-c++ gperftools-devel fio nodejs rpm-build jerasure-devel isa-l-devel gf-complete-devel rdma-core-devel cmake libnl3-devel
+RUN dnf -y install gcc-c++ gperftools-devel fio nodejs rpm-build jerasure-devel isa-l-devel gf-complete-devel rdma-core-devel cmake libnl3-devel c-ares-devel
 RUN dnf download --source fio
 RUN rpm --nomd5 -i fio*.src.rpm
 RUN cd ~/rpmbuild/SPECS && dnf builddep -y --spec fio.spec
@@ -1,11 +1,11 @@
 Name:           vitastor
-Version:        3.0.5
+Version:        3.0.8
 Release:        1%{?dist}
 Summary:        Vitastor, a fast software-defined clustered block storage

 License:        Vitastor Network Public License 1.1
 URL:            https://vitastor.io/
-Source0:        vitastor-3.0.5.el10.tar.gz
+Source0:        vitastor-3.0.8.el10.tar.gz

 BuildRequires:  gperftools-devel
 BuildRequires:  gcc-c++
@@ -16,6 +16,7 @@ BuildRequires:  gf-complete-devel
 BuildRequires:  rdma-core-devel
 BuildRequires:  cmake
 BuildRequires:  libnl3-devel
+BuildRequires:  c-ares-devel
 Requires:       vitastor-osd = %{version}-%{release}
 Requires:       vitastor-mon = %{version}-%{release}
 Requires:       vitastor-client = %{version}-%{release}
@@ -15,7 +15,7 @@ RUN yum -y --enablerepo=extras install centos-release-scl epel-release yum-utils
 RUN perl -i -pe 's!mirrorlist=!#mirrorlist=!s; s!#\s*baseurl=http://mirror.centos.org!baseurl=http://vault.centos.org!' /etc/yum.repos.d/CentOS-SCLo-scl*.repo
 RUN yum -y install https://vitastor.io/rpms/centos/7/vitastor-release-1.0-1.el7.noarch.rpm
 RUN yum -y install devtoolset-9-gcc-c++ devtoolset-9-libatomic-devel gcc make cmake gperftools-devel \
-    fio rh-nodejs12 jerasure-devel libisa-l-devel gf-complete-devel rdma-core-devel libnl3-devel
+    fio rh-nodejs12 jerasure-devel libisa-l-devel gf-complete-devel rdma-core-devel libnl3-devel c-ares-devel
 RUN yumdownloader --disablerepo=centos-sclo-rh --source fio
 RUN rpm --nomd5 -i fio*.src.rpm
 RUN rm -f /etc/yum.repos.d/CentOS-Media.repo
@@ -1,11 +1,11 @@
 Name:           vitastor
-Version:        3.0.5
+Version:        3.0.8
 Release:        1%{?dist}
 Summary:        Vitastor, a fast software-defined clustered block storage

 License:        Vitastor Network Public License 1.1
 URL:            https://vitastor.io/
-Source0:        vitastor-3.0.5.el7.tar.gz
+Source0:        vitastor-3.0.8.el7.tar.gz

 BuildRequires:  gperftools-devel
 BuildRequires:  devtoolset-9-gcc-c++
@@ -17,6 +17,7 @@ BuildRequires:  gf-complete-devel
 BuildRequires:  rdma-core-devel
 BuildRequires:  cmake3
 BuildRequires:  libnl3-devel
+BuildRequires:  c-ares-devel
 Requires:       vitastor-osd = %{version}-%{release}
 Requires:       vitastor-mon = %{version}-%{release}
 Requires:       vitastor-client = %{version}-%{release}
@@ -13,7 +13,7 @@ RUN dnf -y install centos-release-advanced-virtualization epel-release dnf-plugi
 RUN sed -i 's/^mirrorlist=/#mirrorlist=/; s!#baseurl=.*!baseurl=http://vault.centos.org/centos/8.4.2105/virt/$basearch/$avdir/!; s!^baseurl=.*Source/.*!baseurl=http://vault.centos.org/centos/8.4.2105/virt/Source/advanced-virtualization/!' /etc/yum.repos.d/CentOS-Advanced-Virtualization.repo
 RUN yum -y install https://vitastor.io/rpms/centos/8/vitastor-release-1.0-1.el8.noarch.rpm
 RUN dnf -y install gcc-toolset-9 gcc-toolset-9-gcc-c++ gperftools-devel \
-    fio nodejs rpm-build jerasure-devel libisa-l-devel gf-complete-devel libibverbs-devel libarchive cmake libnl3-devel
+    fio nodejs rpm-build jerasure-devel libisa-l-devel gf-complete-devel libibverbs-devel libarchive cmake libnl3-devel c-ares-devel
 RUN dnf download --source fio
 RUN rpm --nomd5 -i fio*.src.rpm
 RUN cd ~/rpmbuild/SPECS && dnf builddep -y --enablerepo=powertools --spec fio.spec
@@ -1,11 +1,11 @@
 Name:           vitastor
-Version:        3.0.5
+Version:        3.0.8
 Release:        1%{?dist}
 Summary:        Vitastor, a fast software-defined clustered block storage

 License:        Vitastor Network Public License 1.1
 URL:            https://vitastor.io/
-Source0:        vitastor-3.0.5.el8.tar.gz
+Source0:        vitastor-3.0.8.el8.tar.gz

 BuildRequires:  gperftools-devel
 BuildRequires:  gcc-toolset-9-gcc-c++
@@ -16,6 +16,7 @@ BuildRequires:  gf-complete-devel
 BuildRequires:  rdma-core-devel
 BuildRequires:  cmake
 BuildRequires:  libnl3-devel
+BuildRequires:  c-ares-devel
 Requires:       vitastor-osd = %{version}-%{release}
 Requires:       vitastor-mon = %{version}-%{release}
 Requires:       vitastor-client = %{version}-%{release}
@@ -10,7 +10,7 @@ WORKDIR /root
 RUN sed -i 's/enabled=0/enabled=1/' /etc/yum.repos.d/*.repo
 RUN dnf -y install epel-release dnf-plugins-core
 RUN dnf -y install https://vitastor.io/rpms/centos/9/vitastor-release-1.0-1.el9.noarch.rpm
-RUN dnf -y install gcc-c++ gperftools-devel fio nodejs rpm-build jerasure-devel libisa-l-devel gf-complete-devel rdma-core-devel libarchive cmake libnl3-devel
+RUN dnf -y install gcc-c++ gperftools-devel fio nodejs rpm-build jerasure-devel libisa-l-devel gf-complete-devel rdma-core-devel libarchive cmake libnl3-devel c-ares-devel
 RUN dnf download --source fio
 RUN rpm --nomd5 -i fio*.src.rpm
 RUN cd ~/rpmbuild/SPECS && dnf builddep -y --spec fio.spec
@@ -1,11 +1,11 @@
 Name:           vitastor
-Version:        3.0.5
+Version:        3.0.8
 Release:        1%{?dist}
 Summary:        Vitastor, a fast software-defined clustered block storage

 License:        Vitastor Network Public License 1.1
 URL:            https://vitastor.io/
-Source0:        vitastor-3.0.5.el9.tar.gz
+Source0:        vitastor-3.0.8.el9.tar.gz

 BuildRequires:  gperftools-devel
 BuildRequires:  gcc-c++
@@ -16,6 +16,7 @@ BuildRequires:  gf-complete-devel
 BuildRequires:  rdma-core-devel
 BuildRequires:  cmake
 BuildRequires:  libnl3-devel
+BuildRequires:  c-ares-devel
 Requires:       vitastor-osd = %{version}-%{release}
 Requires:       vitastor-mon = %{version}-%{release}
 Requires:       vitastor-client = %{version}-%{release}
@@ -1,9 +1,8 @@
-cmake_minimum_required(VERSION 2.8.12)
+cmake_minimum_required(VERSION 2.8...3.30)

 project(vitastor)

 include(GNUInstallDirs)
-include(CTest)
 include(CheckIncludeFile)

 find_package(PkgConfig)
@@ -21,7 +20,7 @@ if("${CMAKE_INSTALL_PREFIX}" MATCHES "^/usr/local/?$")
 endif()
 set(ENABLE_COVERAGE false CACHE BOOL "Enable code coverage")

-add_definitions(-DVITASTOR_VERSION="3.0.5")
+add_definitions(-DVITASTOR_VERSION="3.0.8")
 add_definitions(-D_GNU_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wno-sign-compare -Wno-comment -Wno-parentheses -Wno-pointer-arith -fdiagnostics-color=always -fno-omit-frame-pointer -fvisibility=hidden -I ${CMAKE_SOURCE_DIR}/src)
 add_link_options(-fno-omit-frame-pointer)
 if (${WITH_ASAN})
@@ -75,6 +74,14 @@ if (RDMACM_LIBRARIES)
 	add_definitions(-DWITH_RDMACM)
 endif (RDMACM_LIBRARIES)

+find_package(OpenSSL REQUIRED)
+if (OPENSSL_FOUND)
+	add_definitions(-DWITH_OPENSSL)
+endif (OPENSSL_FOUND)
+
+pkg_check_modules(CARES REQUIRED libcares)
+include_directories(${CARES_INCLUDE_DIRS})
+
 if (${WITH_SYSTEM_LIBURING})
 	pkg_check_modules(LIBURING REQUIRED liburing>=2.10)
 	include_directories(${LIBURING_INCLUDE_DIRS})
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 2.8.12)
+cmake_minimum_required(VERSION 2.8...3.30)

 project(vitastor)

@@ -228,4 +228,9 @@ public:
    virtual uint64_t get_journal_size() = 0;

    virtual uint32_t get_bitmap_granularity() = 0;
+
+    virtual uint64_t get_live_entries() = 0;
+    virtual uint64_t get_live_memory() = 0;
+    virtual uint64_t get_garbage_entries() = 0;
+    virtual uint64_t get_garbage_memory() = 0;
 };
@@ -83,17 +83,23 @@ void blockstore_disk_t::parse_config(std::map<std::string, std::string> & config
    {
        data_csum_type = BLOCKSTORE_CSUM_CRC32C;
    }
+    else if (config["data_csum_type"] == "xxh3_32")
+    {
+        data_csum_type = BLOCKSTORE_CSUM_XXH3_32;
+    }
    else if (config["data_csum_type"] == "" || config["data_csum_type"] == "none")
    {
        data_csum_type = BLOCKSTORE_CSUM_NONE;
    }
    else
    {
-        throw std::runtime_error("data_csum_type="+config["data_csum_type"]+" is unsupported, only \"crc32c\" and \"none\" are supported");
+        throw std::runtime_error("data_csum_type="+config["data_csum_type"]+" is unsupported, only \"crc32c\", \"xxh3_32\" and \"none\" are supported");
    }
    csum_block_size = parse_size(config["csum_block_size"]);
    discard_on_start = config.find("discard_on_start") != config.end() &&
        (config["discard_on_start"] == "true" || config["discard_on_start"] == "1" || config["discard_on_start"] == "yes");
+    gc_on_start = config.find("gc_on_start") == config.end() ||
+        (config["gc_on_start"] == "true" || config["gc_on_start"] == "1" || config["gc_on_start"] == "yes");
    min_discard_size = parse_size(config["min_discard_size"]);
    if (!min_discard_size)
        min_discard_size = 1024*1024;
@@ -16,6 +16,7 @@
 #define BLOCKSTORE_CSUM_NONE 0
 // Lower byte of checksum type is its length
 #define BLOCKSTORE_CSUM_CRC32C 0x104
+#define BLOCKSTORE_CSUM_XXH3_32 0x204

 #define MOCK_DATA_FD 1000
 #define MOCK_META_FD 1001
@@ -57,6 +58,8 @@ struct blockstore_disk_t
    bool inmemory_journal = true;
    // Data discard granularity and minimum size (for the sake of performance)
    bool discard_on_start = false;
+    // GC on start (new store)
+    bool gc_on_start = true;
    uint64_t min_discard_size = 1024*1024;
    uint64_t discard_granularity = 0;

@@ -12,6 +12,7 @@
 #include "blockstore_heap.h"
 #include "../util/allocator.h"
 #include "../util/crc32c.h"
+#include "../util/xxh_x86dispatch.h"
 #include "../util/malloc_or_die.h"

 #define BS_HEAP_FREE_MVCC 1
@@ -29,6 +30,8 @@
 #define IMAP_MALLOC_LOW_BITS ((size_t)0x0F)
 #define IMAP_MAX_LOW 16

+#define list_item_overhead(a) (((a) + sizeof(heap_list_item_t) - sizeof(heap_entry_t) + sizeof(void*) + 15) & ~15)
+
 void inode_map_put(void* & inode_idx, heap_list_item_t* li);
 void inode_map_get(void *inode_idx, heap_inode_map_t::iterator & li_it, heap_list_item_t* & li, uint64_t stripe);
 void inode_map_free(void* inode_idx);
@@ -62,19 +65,19 @@ uint32_t blockstore_heap_t::get_simple_entry_size()
 uint32_t blockstore_heap_t::get_big_entry_size()
 {
    return sizeof(heap_big_write_t) + dsk->clean_entry_bitmap_size*2 +
-        (!dsk->data_csum_type ? 0 : dsk->data_block_size/dsk->csum_block_size * (dsk->data_csum_type & 0xFF));
+        (!dsk->csum_block_size ? 0 : dsk->data_block_size/dsk->csum_block_size * (dsk->data_csum_type & 0xFF));
 }

 uint32_t blockstore_heap_t::get_big_intent_entry_size()
 {
    return sizeof(heap_big_intent_t) + dsk->clean_entry_bitmap_size*2 +
-        (!dsk->data_csum_type ? 4 : dsk->data_block_size/dsk->csum_block_size * (dsk->data_csum_type & 0xFF));
+        (!dsk->csum_block_size ? 4 : dsk->data_block_size/dsk->csum_block_size * (dsk->data_csum_type & 0xFF));
 }

 uint32_t blockstore_heap_t::get_small_entry_size(uint32_t offset, uint32_t len)
 {
    return sizeof(heap_small_write_t) + dsk->clean_entry_bitmap_size +
-        (!dsk->data_csum_type ? 4 : (dsk->data_csum_type & 0xFF) *
+        (!dsk->csum_block_size ? 4 : (dsk->data_csum_type & 0xFF) *
            ((offset+len+dsk->csum_block_size-1)/dsk->csum_block_size - offset/dsk->csum_block_size));
 }

@@ -89,7 +92,7 @@ uint32_t blockstore_heap_t::get_csum_size(heap_entry_t *wr)

 uint32_t blockstore_heap_t::get_csum_size(uint32_t entry_type, uint32_t offset, uint32_t len)
 {
-    if (!dsk->data_csum_type)
+    if (!dsk->csum_block_size)
    {
        return 0;
    }
@@ -212,15 +215,24 @@ void heap_entry_t::set_big_location(blockstore_heap_t *heap, uint64_t location)
    big().block_num = location / heap->dsk->data_block_size;
 }

-uint32_t heap_entry_t::calc_crc32c()
+uint32_t heap_entry_t::calc_checksum(blockstore_disk_t *dsk)
 {
-    auto old_crc32c = crc32c;
-    crc32c = 0;
-    uint32_t res = ::crc32c(0, (uint8_t*)this, size);
-    crc32c = old_crc32c;
+    auto old_checksum = checksum;
+    checksum = 0;
+    uint32_t res = 0;
+    if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32)
+        res = (uint32_t)XXH3_64bits(this, size);
+    else
+        res = ::crc32c(0, (uint8_t*)this, size);
+    checksum = old_checksum;
    return res;
 }

+uint32_t heap_entry_t::calc_checksum(blockstore_heap_t *heap)
+{
+    return calc_checksum(heap->dsk);
+}
+
 uint64_t blockstore_heap_t::get_pg_id(inode_t inode, uint64_t stripe)
 {
    uint64_t pg_num = 0;
@@ -244,7 +256,7 @@ blockstore_heap_t::blockstore_heap_t(blockstore_disk_t *dsk, uint8_t *buffer_are
    assert(dsk->meta_block_size < 32768);
    assert(dsk->meta_area_size > 0);
    assert(dsk->journal_len > 0);
-    meta_alloc = new multilist_index_t(meta_block_count, META_ALLOC_LEVELS+1, 0);
+    meta_alloc = new multilist_index_t(meta_block_count, META_ALLOC_LEVELS+1, 2);
    block_info.resize(meta_block_count);
    assert(dsk->block_count <= 0xFFFF0000);
    data_alloc = new allocator_t(dsk->block_count);
@@ -385,12 +397,12 @@ corrupted_object:
                goto corrupted_object;
            }
            // Verify crc
-            uint32_t expected_crc32c = wr->calc_crc32c();
-            if (wr->crc32c != expected_crc32c)
+            uint32_t expected_checksum = wr->calc_checksum(this);
+            if (wr->checksum != expected_checksum)
            {
-                fprintf(stderr, "Error: entry %jx:%jx v%ju l%ju in metadata block %u at %u is corrupt (crc32c mismatch: expected %08x, got %08x). ",
+                fprintf(stderr, "Error: entry %jx:%jx v%ju l%ju in metadata block %u at %u is corrupt (checksum mismatch: expected %08x, got %08x). ",
                    wr->inode, wr->stripe, wr->version, wr->lsn,
-                    block_num, block_offset, expected_crc32c, wr->crc32c);
+                    block_num, block_offset, expected_checksum, wr->checksum);
                goto corrupted_object;
            }
            // Verify offset & len
@@ -426,7 +438,10 @@ int blockstore_heap_t::load_blocks(uint64_t disk_offset, uint64_t size, uint8_t
    entries_loaded = 0;
    return read_blocks(disk_offset, size, buf, allow_corrupted, [&](uint32_t block_num, heap_entry_t *wr_orig)
    {
-        heap_list_item_t *li = (heap_list_item_t*)malloc_or_die(wr_orig->size + sizeof(heap_list_item_t) - sizeof(heap_entry_t));
+        auto alloc_size = wr_orig->size + sizeof(heap_list_item_t) - sizeof(heap_entry_t);
+        heap_list_item_t *li = (heap_list_item_t*)malloc_or_die(alloc_size);
+        live_entries++;
+        live_memory += list_item_overhead(wr_orig->size);
        li->block_num = block_num;
        li->prev = li->next = NULL;
        memcpy(&li->entry, wr_orig, wr_orig->size);
@@ -611,10 +626,11 @@ int blockstore_heap_t::mark_used_blocks()
                if (wr->entry_type == (BS_HEAP_DELETE|BS_HEAP_STABLE) && !li->prev)
                {
                    wr->set_garbage();
+                    garbage_entries++;
+                    garbage_memory += list_item_overhead(wr->size);
                    modify_alloc(li->block_num, [&](heap_block_info_t & inf)
                    {
-                        inf.used_space -= wr->size;
-                        inf.has_garbage = true;
+                        inf.garbage_space += wr->size;
                    });
                    li = NULL;
                }
@@ -624,10 +640,11 @@ int blockstore_heap_t::mark_used_blocks()
                    if (overwritten)
                    {
                        wr->set_garbage();
+                        garbage_entries++;
+                        garbage_memory += list_item_overhead(wr->size);
                        modify_alloc(li->block_num, [&](heap_block_info_t & inf)
                        {
-                            inf.used_space -= wr->size;
-                            inf.has_garbage = true;
+                            inf.garbage_space += wr->size;
                        });
                        continue;
                    }
@@ -666,15 +683,66 @@ int blockstore_heap_t::mark_used_blocks()
            });
        }
    }
+    if (dsk->gc_on_start)
+    {
+        recheck_full_gc();
+    }
    return res;
 }

+void blockstore_heap_t::recheck_full_gc()
+{
+    uint32_t block_num = 0;
+    for (auto & inf: block_info)
+    {
+        // Instantly collect all garbage on restart
+        if (inf.garbage_space > 0)
+        {
+            if (log_level > 5)
+            {
+                fprintf(stderr, "Clearing %u out of %u garbage bytes in block %u\n", inf.garbage_space, inf.used_space, block_num);
+            }
+            uint32_t collected_garbage = 0;
+            size_t i = 0, j = 0;
+            for (; i < inf.entries.size(); i++)
+            {
+                if (inf.entries[i]->entry.is_garbage())
+                {
+                    collected_garbage += inf.entries[i]->entry.size;
+                    remove_list_item(inf.entries[i]);
+                }
+                else
+                {
+                    if (j != i)
+                        inf.entries[j] = inf.entries[i];
+                    j++;
+                }
+            }
+            inf.entries.resize(j);
+            modify_alloc(block_num, [&](heap_block_info_t & inf)
+            {
+                inf.used_space -= collected_garbage;
+                inf.garbage_space -= collected_garbage;
+            });
+            recheck_modified_blocks.insert(block_num);
+        }
+        block_num++;
+    }
+}
+
 void blockstore_heap_t::recheck_buffer(heap_entry_t *cwr, uint8_t *buf)
 {
    auto free_entry = [&](heap_list_item_t *li)
    {
        uint32_t block_num = li->block_num;
        auto wr_size = li->entry.size;
+        if (li->entry.is_garbage())
+        {
+            garbage_entries--;
+            garbage_memory -= list_item_overhead(wr_size);
+        }
+        live_entries--;
+        live_memory -= list_item_overhead(wr_size);
        free(li);
        modify_alloc(block_num, [&](heap_block_info_t & inf)
        {
@@ -712,7 +780,12 @@ void blockstore_heap_t::recheck_buffer(heap_entry_t *cwr, uint8_t *buf)
            assert(li->entry.entry_type == cwr->entry_type);
            auto prev = li->prev;
            li->next = li->prev = NULL;
-            li->entry.set_garbage();
+            if (!li->entry.is_garbage())
+            {
+                garbage_entries++;
+                garbage_memory += list_item_overhead(li->entry.size);
+                li->entry.set_garbage();
+            }
            li = prev;
            rolled_back++;
        }
@@ -878,7 +951,11 @@ bool blockstore_heap_t::calc_checksums(heap_entry_t *wr, uint8_t *data, bool set
            len = wr->big_intent().len;
        else
            assert(0);
-        uint32_t real_csum = crc32c(0, data, len);
+        uint32_t real_csum = 0;
+        if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32)
+            real_csum = (uint32_t)XXH3_64bits(data, len);
+        else
+            real_csum = crc32c(0, data, len);
        if (set)
        {
            *wr_csum = real_csum;
@@ -928,11 +1005,26 @@ static uint32_t crc32c_iter(uint32_t prev_crc, const std::function<uint8_t*(uint
    return prev_crc;
 }

+static void xxh3_iter(XXH3_state_t* xxh3_state, const std::function<uint8_t*(uint32_t start, uint32_t & len)> & next, uint32_t pos, uint32_t size)
+{
+    uint32_t cur_len = 0;
+    while (size > 0)
+    {
+        uint8_t *data = next(pos, cur_len);
+        assert(data);
+        cur_len = (cur_len < size ? cur_len : size);
+        XXH3_64bits_update(xxh3_state, data, cur_len);
+        pos += cur_len;
+        size -= cur_len;
+    }
+}
+
 bool blockstore_heap_t::calc_block_checksums(uint32_t *block_csums, uint8_t *bitmap,
    uint32_t start, uint32_t end, std::function<uint8_t*(uint32_t start, uint32_t & len)> next,
    bool set, std::function<void(uint32_t, uint32_t, uint32_t)> bad_block_cb)
 {
    bool res = true;
+    XXH3_state_t* xxh3_state = NULL;
    uint32_t pos = start;
    uint32_t block_end = (start/dsk->csum_block_size + 1)*dsk->csum_block_size;
    uint32_t block_crc = 0;
@@ -949,42 +1041,89 @@ bool blockstore_heap_t::calc_block_checksums(uint32_t *block_csums, uint8_t *bit
                    pos += dsk->bitmap_granularity;
                // zero padding at the beginning or at the end of the block is not counted
                if (pos > prev && prev > 0 && pos < block_end)
-                    block_crc = crc32c_pad(block_crc, NULL, 0, pos-prev, 0);
+                {
+                    if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32)
+                    {
+                        if (!xxh3_state)
+                        {
+                            xxh3_state = XXH3_createState();
+                            XXH3_64bits_reset(xxh3_state);
+                        }
+                        uint32_t zeropad = pos-prev;
+                        while (zeropad > 0)
+                        {
+                            uint32_t zerolen = zeropad > 4096 ? 4096 : zeropad;
+                            XXH3_64bits_update(xxh3_state, zero_page, zerolen);
+                            zeropad -= zerolen;
+                        }
+                    }
+                    else
+                        block_crc = crc32c_pad(block_crc, NULL, 0, pos-prev, 0);
+                }
                prev = pos;
                while (pos < end && pos < block_end && (bitmap[pos/dsk->bitmap_granularity/8] & (1 << ((pos/dsk->bitmap_granularity) % 8))))
                    pos += dsk->bitmap_granularity;
                if (pos > prev)
                {
                    isset = true;
-                    block_crc = crc32c_iter(block_crc, next, prev, pos-prev);
+                    if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32)
+                    {
+                        if (!xxh3_state)
+                        {
+                            xxh3_state = XXH3_createState();
+                            XXH3_64bits_reset(xxh3_state);
+                        }
+                        xxh3_iter(xxh3_state, next, prev, pos-prev);
+                    }
+                    else
+                        block_crc = crc32c_iter(block_crc, next, prev, pos-prev);
                }
                prev = pos;
            }
        }
        else
        {
-            block_crc = crc32c_iter(block_crc, next, pos, (end > block_end ? block_end : end)-pos);
+            if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32)
+            {
+                if (!xxh3_state)
+                {
+                    xxh3_state = XXH3_createState();
+                    XXH3_64bits_reset(xxh3_state);
+                }
+                xxh3_iter(xxh3_state, next, pos, (end > block_end ? block_end : end)-pos);
+            }
+            else
+                block_crc = crc32c_iter(block_crc, next, pos, (end > block_end ? block_end : end)-pos);
            pos = (end > block_end ? block_end : end);
            isset = true;
        }
+        if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32 && xxh3_state)
+        {
+            block_crc = (uint32_t)XXH3_64bits_digest(xxh3_state);
+            XXH3_64bits_reset(xxh3_state);
+        }
        if (set)
        {
            *block_csums = block_crc;
        }
        else if (isset && block_crc != *block_csums)
        {
+            res = false;
            if (bad_block_cb)
-            {
                bad_block_cb(blk_start, *block_csums, block_crc);
-                res = false;
-            }
            else
-                return false;
+                break;
        }
        block_end += dsk->csum_block_size;
        block_crc = 0;
        block_csums++;
    }
+    if (dsk->data_csum_type == BLOCKSTORE_CSUM_XXH3_32 && xxh3_state)
+    {
+        block_crc = (uint32_t)XXH3_64bits_digest(xxh3_state);
+        XXH3_freeState(xxh3_state);
+        xxh3_state = NULL;
+    }
    return res;
 }

@@ -1162,7 +1301,7 @@ heap_entry_t *blockstore_heap_t::read_entry(object_id oid)

 void blockstore_heap_t::gc_block(heap_block_info_t & inf)
 {
-    if (inf.has_garbage)
+    if (inf.garbage_space > 0)
    {
        size_t i = 0, j = 0;
        for (; i < inf.entries.size(); i++)
@@ -1185,7 +1324,8 @@ void blockstore_heap_t::gc_block(heap_block_info_t & inf)
            }
        }
        inf.entries.resize(j);
-        inf.has_garbage = false;
+        inf.used_space -= inf.garbage_space;
+        inf.garbage_space = 0;
    }
 }

@@ -1195,11 +1335,12 @@ int blockstore_heap_t::allocate_entry(uint32_t entry_size, uint32_t *block_num,
    {
        // First try to write into the same block as the previous time
        auto & inf = block_info.at(last_allocated_block);
-        auto free_space = dsk->meta_block_size - inf.used_space;
-        if (inf.is_writing || free_space < entry_size ||
+        if (inf.is_writing ||
+            inf.used_space - inf.garbage_space + entry_size > dsk->meta_block_size ||
            // Do not allow to make the last non-nearfull block nearfull
            !allow_last_free && meta_nearfull_blocks >= meta_block_count-1 &&
-            free_space >= max_entry_size && free_space < max_entry_size+entry_size)
+            inf.used_space - inf.garbage_space <= dsk->meta_block_size-max_entry_size &&
+            inf.used_space - inf.garbage_space + entry_size > dsk->meta_block_size-max_entry_size)
        {
            last_allocated_block = UINT32_MAX;
        }
@@ -1216,8 +1357,8 @@ int blockstore_heap_t::allocate_entry(uint32_t entry_size, uint32_t *block_num,
        {
            // Do not allow to make the last non-nearfull block nearfull
            auto & inf = block_info.at(last_allocated_block);
-            auto free_space = dsk->meta_block_size - inf.used_space;
-            if (free_space >= max_entry_size && free_space < max_entry_size+entry_size)
+            if (inf.used_space - inf.garbage_space <= dsk->meta_block_size-max_entry_size &&
+                inf.used_space - inf.garbage_space + entry_size > dsk->meta_block_size-max_entry_size)
            {
                last_allocated_block = UINT32_MAX;
            }
@@ -1228,8 +1369,7 @@ int blockstore_heap_t::allocate_entry(uint32_t entry_size, uint32_t *block_num,
            for (uint32_t b = meta_alloc->find(META_ALLOC_LEVELS-1); b != UINT32_MAX; b = meta_alloc->next(b))
            {
                auto & inf = block_info.at(b);
-                auto free_space = dsk->meta_block_size - inf.used_space;
-                if (free_space >= entry_size)
+                if (inf.used_space - inf.garbage_space + entry_size <= dsk->meta_block_size)
                {
                    last_allocated_block = b;
                    break;
@@ -1246,20 +1386,27 @@ int blockstore_heap_t::allocate_entry(uint32_t entry_size, uint32_t *block_num,
    {
        // Do not allow to make the last non-nearfull block nearfull
        auto & inf = block_info.at(last_allocated_block);
-        if (dsk->meta_block_size-inf.used_space >= max_entry_size &&
-            dsk->meta_block_size-inf.used_space+entry_size < max_entry_size)
+        if (inf.used_space - inf.garbage_space <= dsk->meta_block_size-max_entry_size &&
+            inf.used_space - inf.garbage_space + entry_size > dsk->meta_block_size-max_entry_size)
        {
            last_allocated_block = UINT32_MAX;
            return ENOSPC;
        }
    }
    // Write into the same block
-    auto & inf = block_info.at(last_allocated_block);
-    gc_block(inf);
    *block_num = last_allocated_block;
    modify_alloc(last_allocated_block, [&](heap_block_info_t & inf)
    {
+        // Write just 1 entry to the block to collect garbage
+        if (inf.garbage_space > (inf.used_space-inf.garbage_space)/2)
+            last_allocated_block = UINT32_MAX;
+        gc_block(inf);
        inf.used_space += entry_size;
+        assert(inf.used_space - inf.garbage_space <= dsk->meta_block_size);
+        assert(!inf.mod_lsn_to || inf.mod_lsn_to == next_lsn);
+        ++next_lsn;
+        inf.mod_lsn = inf.mod_lsn ? inf.mod_lsn : next_lsn;
+        inf.mod_lsn_to = next_lsn;
    });
    return 0;
 }
@@ -1318,16 +1465,15 @@ int blockstore_heap_t::add_entry(uint32_t wr_size, uint32_t *modified_block,
        *modified_block = block_num;
    }
    auto li = (heap_list_item_t*)malloc_or_die(wr_size + sizeof(heap_list_item_t) - sizeof(heap_entry_t));
+    live_entries++;
+    live_memory += list_item_overhead(wr_size);
    auto new_wr = &li->entry;
    auto & inf = block_info.at(block_num);
    if (!inf.entries.size())
        inf.entries.reserve(dsk->meta_block_size / max_entry_size);
    inf.entries.push_back(li);
-    assert(!inf.mod_lsn_to || inf.mod_lsn_to == next_lsn);
-    new_wr->lsn = ++next_lsn;
+    new_wr->lsn = next_lsn;
    fill_entry(new_wr);
-    inf.mod_lsn = inf.mod_lsn ? inf.mod_lsn : next_lsn;
-    inf.mod_lsn_to = next_lsn;
    // Remember the object as dirty and remove older entries when this block is written and fsynced
    push_inflight_lsn(next_lsn, new_wr,
        (explicit_complete ? HEAP_INFLIGHT_EXPLICIT : 0) |
@@ -1336,7 +1482,7 @@ int blockstore_heap_t::add_entry(uint32_t wr_size, uint32_t *modified_block,
    insert_list_item(li);
    li->block_num = block_num;
    new_wr->size = wr_size;
-    new_wr->crc32c = new_wr->calc_crc32c();
+    new_wr->checksum = new_wr->calc_checksum(this);
    return 0;
 }

@@ -1396,7 +1542,7 @@ int blockstore_heap_t::add_big_write(object_id oid, heap_entry_t *old_head, bool
            memset(wr->get_ext_bitmap(this), 0, dsk->clean_entry_bitmap_size);
        memset(wr->get_int_bitmap(this), 0, dsk->clean_entry_bitmap_size);
        bitmap_set(wr->get_int_bitmap(this), offset, len, dsk->bitmap_granularity);
-        if (dsk->data_csum_type)
+        if (dsk->csum_block_size)
        {
            memset(wr->get_checksums(this), 0, get_csum_size(wr));
            calc_checksums(wr, (uint8_t*)data, true, offset, len);
@@ -1425,7 +1571,7 @@ int blockstore_heap_t::add_redirect_intent(object_id oid, heap_entry_t **obj_ptr
            memset(wr->get_ext_bitmap(this), 0, dsk->clean_entry_bitmap_size);
        memset(wr->get_int_bitmap(this), 0, dsk->clean_entry_bitmap_size);
        bitmap_set(wr->get_int_bitmap(this), offset, len, dsk->bitmap_granularity);
-        if (dsk->data_csum_type)
+        if (dsk->csum_block_size)
            memset(wr->get_checksums(this), 0, get_csum_size(wr));
        calc_checksums(wr, (uint8_t*)data, true);
        *obj_ptr = wr;
@@ -1463,7 +1609,7 @@ int blockstore_heap_t::add_big_intent(object_id oid, heap_entry_t **obj_ptr, uin
            memcpy(wr->get_ext_bitmap(this), obj->get_ext_bitmap(this), dsk->clean_entry_bitmap_size);
        memcpy(wr->get_int_bitmap(this), obj->get_int_bitmap(this), dsk->clean_entry_bitmap_size);
        bitmap_set(wr->get_int_bitmap(this), offset, len, dsk->bitmap_granularity);
-        if (dsk->data_csum_type)
+        if (dsk->csum_block_size)
        {
            if (checksums)
                memcpy(wr->get_checksums(this), checksums, get_csum_size(wr));
@@ -1510,7 +1656,7 @@ int blockstore_heap_t::add_compact(heap_entry_t *obj, uint64_t compact_version,
        new_wr->set_big_location(this, compact_location);
        memcpy(new_wr->get_int_bitmap(this), new_int_bitmap, dsk->clean_entry_bitmap_size);
        memcpy(new_wr->get_ext_bitmap(this), new_ext_bitmap, dsk->clean_entry_bitmap_size);
-        if (dsk->data_csum_type && new_csums)
+        if (dsk->csum_block_size && new_csums)
            memcpy(new_wr->get_checksums(this), new_csums, dsk->data_block_size/dsk->csum_block_size*(dsk->data_csum_type & 0xFF));
    });
 }
@@ -1666,28 +1812,38 @@ int blockstore_heap_t::add_delete(heap_entry_t *obj, uint32_t *modified_block)

 uint32_t blockstore_heap_t::meta_alloc_pos(const heap_block_info_t & inf)
 {
-    if (inf.is_writing || inf.used_space > dsk->meta_block_size-sizeof(heap_entry_t))
+    auto real_used = (inf.used_space-inf.garbage_space);
+    if (inf.is_writing || inf.mod_lsn || real_used > dsk->meta_block_size-sizeof(heap_entry_t))
    {
        // 100% full - no entry can be written into this block at all
        return META_ALLOC_LEVELS;
    }
-    if (inf.used_space > dsk->meta_block_size-max_entry_size)
+    if (real_used > dsk->meta_block_size-max_entry_size)
    {
        // nearfull - big_entries won't fit into this block so it can't be used for compaction
        return META_ALLOC_LEVELS-1;
    }
-    // normal block
-    return inf.used_space / ((dsk->meta_block_size-max_entry_size+META_ALLOC_LEVELS-2) / (META_ALLOC_LEVELS-1));
+    // First we want to write to blocks with most garbage:
+    // >= 2*used, >= used/2
+    // (i.e. 66% garbage, 33% garbage)
+    // Then to mostly free blocks:
+    // >= 75% free, >= 50% free, >= 25% free
+    if (inf.garbage_space > real_used*2)
+        return 0;
+    if (inf.garbage_space > real_used/2)
+        return 1;
+    // META_ALLOC_LEVELS-3 levels left
+    return 2 + real_used / ((dsk->meta_block_size-max_entry_size+META_ALLOC_LEVELS-4) / (META_ALLOC_LEVELS-3));
 }

 void blockstore_heap_t::modify_alloc(uint32_t block_num, std::function<void(heap_block_info_t &)> change_cb)
 {
    auto & inf = block_info.at(block_num);
    uint32_t old_pos = meta_alloc_pos(inf);
-    uint32_t old_used = inf.used_space;
+    uint32_t old_used = inf.used_space-inf.garbage_space;
    change_cb(inf);
    uint32_t new_pos = meta_alloc_pos(inf);
-    uint32_t new_used = inf.used_space;
+    uint32_t new_used = inf.used_space-inf.garbage_space;
    meta_alloc->change(block_num, old_pos, new_pos);
    meta_used_space -= old_used;
    meta_used_space += new_used;
@@ -1699,11 +1855,19 @@ void blockstore_heap_t::modify_alloc(uint32_t block_num, std::function<void(heap

 void blockstore_heap_t::start_block_write(uint32_t block_num)
 {
-    modify_alloc(block_num, [&](heap_block_info_t & inf)
+    auto & inf = block_info.at(block_num);
+    assert(!inf.is_writing);
+    if (!inf.mod_lsn)
+    {
+        modify_alloc(block_num, [&](heap_block_info_t & inf)
+        {
+            inf.is_writing = true;
+        });
+    }
+    else
    {
-        assert(!inf.is_writing);
        inf.is_writing = true;
-    });
+    }
 }

 void blockstore_heap_t::complete_block_write(uint32_t block_num)
@@ -1768,6 +1932,8 @@ void blockstore_heap_t::mark_garbage_up_to(heap_entry_t *wr)
 void blockstore_heap_t::mark_garbage(uint32_t block_num, heap_entry_t *prev_wr, uint32_t used_big)
 {
    prev_wr->set_garbage();
+    garbage_entries++;
+    garbage_memory += list_item_overhead(prev_wr->size);
    // And this is the moment when we can free the data reference
    if (prev_wr->type() == BS_HEAP_SMALL_WRITE && prev_wr->small().len > 0)
    {
@@ -1783,8 +1949,7 @@ void blockstore_heap_t::mark_garbage(uint32_t block_num, heap_entry_t *prev_wr,
    }
    modify_alloc(block_num, [&](heap_block_info_t & inf)
    {
-        inf.used_space -= prev_wr->size;
-        inf.has_garbage = true;
+        inf.garbage_space += prev_wr->size;
    });
 }

@@ -2154,7 +2319,7 @@ void blockstore_heap_t::fill_block_empty_space(uint8_t *buffer, uint32_t pos)
 uint32_t blockstore_heap_t::get_meta_block_used_space(uint32_t block_num)
 {
    auto & inf = block_info.at(block_num);
-    return inf.used_space;
+    return inf.used_space - inf.garbage_space;
 }

 uint64_t blockstore_heap_t::get_data_used_space()
@@ -2197,6 +2362,26 @@ uint64_t blockstore_heap_t::get_compacted_count()
    return compacted_count;
 }

+uint64_t blockstore_heap_t::get_live_entries()
+{
+    return live_entries-garbage_entries;
+}
+
+uint64_t blockstore_heap_t::get_live_memory()
+{
+    return live_memory-garbage_memory;
+}
+
+uint64_t blockstore_heap_t::get_garbage_entries()
+{
+    return garbage_entries;
+}
+
+uint64_t blockstore_heap_t::get_garbage_memory()
+{
+    return garbage_memory;
+}
+
 void blockstore_heap_t::push_inflight_lsn(uint64_t lsn, heap_entry_t *wr, uint64_t flags)
 {
    uint64_t next_inf = first_inflight_lsn + inflight_lsn.size();
@@ -2283,37 +2468,50 @@ void blockstore_heap_t::apply_inflight(heap_inflight_lsn_t & inflight)
    {
        // Remove entry
        auto li = list_item(wr);
-        auto prev = li->prev;
-        auto next = li->next;
-        if (prev)
-        {
-            prev->next = next;
-        }
-        if (!next)
-        {
-            // The last freed entry must be a deletion
-            assert(!prev);
-            assert(wr->entry_type == BS_HEAP_DELETE|BS_HEAP_STABLE);
-            auto & pg_idx = block_index[get_pg_id(wr->inode, wr->stripe)];
-            auto & inode_idx = pg_idx[wr->inode];
-            heap_inode_map_t::iterator li_it;
-            heap_list_item_t *old_li = NULL;
-            inode_map_get(inode_idx, li_it, old_li, wr->stripe);
-            inode_map_erase(pg_idx, inode_idx, li_it, old_li);
-        }
-        else
-        {
-            next->prev = prev;
-            if (!prev && next->entry.entry_type == (BS_HEAP_DELETE|BS_HEAP_STABLE))
-            {
-                // free BS_HEAP_DELETEs when all previous entries are also freed
-                mark_garbage(next->block_num, &next->entry, UINT32_MAX);
-            }
-        }
-        free(li);
+        remove_list_item(li);
    }
 }

+void blockstore_heap_t::remove_list_item(heap_list_item_t *li)
+{
+    auto prev = li->prev;
+    auto next = li->next;
+    if (prev)
+    {
+        prev->next = next;
+    }
+    if (!next)
+    {
+        // The last freed entry must be a deletion
+        assert(!prev);
+        auto wr = &li->entry;
+        assert(wr->entry_type == BS_HEAP_DELETE|BS_HEAP_STABLE);
+        auto & pg_idx = block_index[get_pg_id(wr->inode, wr->stripe)];
+        auto & inode_idx = pg_idx[wr->inode];
+        heap_inode_map_t::iterator li_it;
+        heap_list_item_t *old_li = NULL;
+        inode_map_get(inode_idx, li_it, old_li, wr->stripe);
+        inode_map_erase(pg_idx, inode_idx, li_it, old_li);
+    }
+    else
+    {
+        next->prev = prev;
+        if (!prev && next->entry.entry_type == (BS_HEAP_DELETE|BS_HEAP_STABLE))
+        {
+            // free BS_HEAP_DELETEs when all previous entries are also freed
+            mark_garbage(next->block_num, &next->entry, UINT32_MAX);
+        }
+    }
+    if (li->entry.is_garbage())
+    {
+        garbage_entries--;
+        garbage_memory -= list_item_overhead(li->entry.size);
+    }
+    live_entries--;
+    live_memory -= list_item_overhead(li->entry.size);
+    free(li);
+}
+
 bool blockstore_heap_t::is_lsn_completed(uint64_t lsn)
 {
    if (lsn <= completed_lsn)
@@ -43,7 +43,7 @@ struct __attribute__((__packed__)) heap_entry_t
 {
    uint16_t size;
    uint16_t entry_type;
-    uint32_t crc32c;
+    uint32_t checksum;
    uint64_t lsn;
    uint64_t inode;
    uint64_t stripe;
@@ -69,7 +69,8 @@ struct __attribute__((__packed__)) heap_entry_t
    uint32_t *get_checksum(blockstore_heap_t *heap);
    uint64_t big_location(blockstore_heap_t *heap);
    void set_big_location(blockstore_heap_t *heap, uint64_t location);
-    uint32_t calc_crc32c();
+    uint32_t calc_checksum(blockstore_heap_t *heap);
+    uint32_t calc_checksum(blockstore_disk_t *dsk);
 };

 struct __attribute__((__packed__)) heap_small_write_t
@@ -80,7 +81,7 @@ struct __attribute__((__packed__)) heap_small_write_t
    uint32_t offset;
    uint32_t len;

-    // Also includes 1 bitmap and 1 crc32c after the bitmap if checksums are disabled
+    // Also includes 1 bitmap and 1 checksum after the bitmap if block checksums are disabled
 };

 struct __attribute__((__packed__)) heap_big_write_t
@@ -98,7 +99,7 @@ struct __attribute__((__packed__)) heap_big_intent_t
    uint32_t offset;
    uint32_t len;

-    // Also includes 2 bitmaps and 1 crc32c if checksums are disabled
+    // Also includes 2 bitmaps and 1 checksums if block checksums are disabled
 };

 struct __attribute__((__packed__)) heap_list_item_t
@@ -117,10 +118,13 @@ struct heap_object_mvcc_t

 struct heap_block_info_t
 {
-    uint32_t used_space = 0;
+    struct __attribute__((__packed__))
+    {
+        uint32_t used_space = 0;
+        uint32_t garbage_space = 0;
+    };
    uint64_t mod_lsn = 0, mod_lsn_to = 0; // only 1 block write of LSN sequence is allowed at a moment
-    bool is_writing: 1;
-    bool has_garbage: 1;
+    bool is_writing = false;
    std::vector<heap_list_item_t*> entries;
 };

@@ -184,6 +188,11 @@ class blockstore_heap_t
    uint64_t buffer_area_used_space = 0;
    uint64_t data_used_space = 0;

+    uint64_t live_entries = 0;
+    uint64_t live_memory = 0;
+    uint64_t garbage_entries = 0;
+    uint64_t garbage_memory = 0;
+
    uint64_t next_lsn = 0;
    uint32_t last_allocated_block = UINT32_MAX;
    heap_mvcc_map_t object_mvcc;
@@ -212,6 +221,7 @@ class blockstore_heap_t
    bool validate_object(heap_entry_t *obj);
    void fill_recheck_queue();
    int mark_used_blocks();
+    void recheck_full_gc();
    void recheck_buffer(heap_entry_t *cwr, uint8_t *buf);
    void defragment_block(uint32_t block_num);
    void reshard_add(heap_reshard_state_t *st, heap_list_item_t *li);
@@ -219,6 +229,7 @@ class blockstore_heap_t
    void gc_block(heap_block_info_t & inf);
    int allocate_entry(uint32_t entry_size, uint32_t *block_num, bool allow_last_free);
    void insert_list_item(heap_list_item_t *li);
+    void remove_list_item(heap_list_item_t *li);
    int add_entry(uint32_t wr_size, uint32_t *modified_block, bool allow_last_free,
        bool explicit_complete, std::function<void(heap_entry_t *wr)> fill_entry);
    int add_simple(heap_entry_t *obj, uint64_t version, uint32_t *modified_block, uint32_t entry_type);
@@ -345,6 +356,10 @@ public:
    uint32_t get_compact_queue_size();
    uint32_t get_to_compact_count();
    uint64_t get_compacted_count();
+    uint64_t get_live_entries();
+    uint64_t get_live_memory();
+    uint64_t get_garbage_entries();
+    uint64_t get_garbage_memory();

    uint64_t entry_pos(uint32_t block_num, uint32_t offset);
    heap_entry_t *entry_from_pos(uint64_t entry_pos, bool allow_unallocated = false);
@@ -229,4 +229,9 @@ public:
    uint64_t get_free_block_count();
    inline uint32_t get_bitmap_granularity() { return dsk.bitmap_granularity; }
    inline uint64_t get_journal_size() { return dsk.journal_len; }
+
+    inline uint64_t get_live_entries() { return heap->get_live_entries(); }
+    inline uint64_t get_live_memory() { return heap->get_live_memory(); }
+    inline uint64_t get_garbage_entries() { return heap->get_garbage_entries(); }
+    inline uint64_t get_garbage_memory() { return heap->get_garbage_memory(); }
 };
@@ -240,7 +240,7 @@ resume_4:
    }
    // metadata read finished
    bs->heap->finish_load();
-    printf("Metadata entries loaded: %ju, used blocks: %ju / %ju\n", entries_loaded, bs->heap->get_data_used_space() / bs->dsk.data_block_size, bs->dsk.block_count);
+    printf("Metadata entries loaded: %ju, rechecking unfinished writes and garbage entries\n", entries_loaded);
    if (zero_on_init && !bs->dsk.disable_meta_fsync)
    {
        GET_SQE();
@@ -293,6 +293,11 @@ resume_7:
    if (bs->readonly)
    {
        recheck_mod.clear();
+        printf("Actual metadata entries: %ju\n", bs->heap->get_live_entries());
+    }
+    else
+    {
+        printf("Actual metadata entries: %ju, clearing garbage in %zu metadata blocks\n", bs->heap->get_live_entries(), recheck_mod.size());
    }
    for (i = 0; i < recheck_mod.size(); i++)
    {
@@ -332,5 +337,9 @@ resume_9:
    }
    free(metadata_buffer);
    metadata_buffer = NULL;
+    printf("Loading finished. Data used: %ju / %ju bytes (%s / %s)\n",
+        bs->heap->get_data_used_space(), bs->dsk.block_count * bs->dsk.data_block_size,
+        format_size(bs->heap->get_data_used_space()).c_str(),
+        format_size(bs->dsk.block_count * bs->dsk.data_block_size).c_str());
    return 0;
 }
@@ -462,6 +462,10 @@ int blockstore_impl_t::read_bitmap(object_id oid, uint64_t target_version, void
        {
            if (target_version >= wr->version)
            {
+                if (wr->type() == BS_HEAP_DELETE)
+                {
+                    return false;
+                }
                found = true;
                if (result_version)
                {
@@ -855,4 +855,29 @@ std::string blockstore_impl_t::get_op_diag(blockstore_op_t *op)
    return std::string(buf);
 }

+uint64_t blockstore_impl_t::get_live_entries()
+{
+    return used_blocks;
+}
+
+uint64_t blockstore_impl_t::get_live_memory()
+{
+    uint64_t used = 0;
+    for (auto & kv: clean_db_shards)
+    {
+        used += kv.second.size() * sizeof(blockstore_clean_db_t::value_type);
+    }
+    return used;
+}
+
+uint64_t blockstore_impl_t::get_garbage_entries()
+{
+    return dirty_db.size();
+}
+
+uint64_t blockstore_impl_t::get_garbage_memory()
+{
+    return sizeof(blockstore_dirty_db_t::node_type) * dirty_db.size();
+}
+
 } // namespace v1
@@ -332,6 +332,10 @@ public:
    inline uint64_t get_free_block_count() { return dsk.block_count - used_blocks; }
    inline uint32_t get_bitmap_granularity() { return dsk.disk_alignment; }
    inline uint64_t get_journal_size() { return dsk.journal_len; }
+    uint64_t get_live_entries();
+    uint64_t get_live_memory();
+    uint64_t get_garbage_entries();
+    uint64_t get_garbage_memory();
 };

 } // namespace v1
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 2.8.12)
+cmake_minimum_required(VERSION 2.8...3.30)

 project(vitastor)

@@ -12,11 +12,11 @@ if (RDMACM_LIBRARIES)
 	set(MSGR_RDMACM "msgr_rdmacm.cpp")
 endif (RDMACM_LIBRARIES)
 add_library(vitastor_common STATIC
-	../util/epoll_manager.cpp etcd_state_client.cpp messenger.cpp ../util/addr_util.cpp
-	msgr_stop.cpp msgr_op.cpp msgr_send.cpp msgr_receive.cpp ../util/ringloop.cpp ../../json11/json11.cpp
+	../util/epoll_manager.cpp etcd_state_client.cpp messenger.cpp ../util/addr_util.cpp ../util/xxh_x86dispatch.c
+	msgr_encrypt.cpp msgr_stop.cpp msgr_op.cpp msgr_send.cpp msgr_receive.cpp ../util/ringloop.cpp ../../json11/json11.cpp
 	http_client.cpp osd_ops.cpp pg_states.cpp ../util/timerfd_manager.cpp ../util/str_util.cpp ../util/json_util.cpp ${MSGR_RDMA} ${MSGR_RDMACM}
 )
-target_link_libraries(vitastor_common pthread)
+target_link_libraries(vitastor_common pthread ${OPENSSL_LIBRARIES} ${CARES_LIBRARIES})
 target_compile_options(vitastor_common PUBLIC -fPIC)

 # libvitastor_client.so
@@ -24,6 +24,7 @@ add_library(vitastor_client SHARED
 	cluster_client.cpp
 	cluster_client_list.cpp
 	cluster_client_wb.cpp
+	cluster_client_icache.cpp
 	vitastor_c.cpp
 )
 set_target_properties(vitastor_client PROPERTIES PUBLIC_HEADER "client/vitastor_c.h")
@@ -33,6 +34,7 @@ target_link_libraries(vitastor_client
 	${LIBURING_LIBRARIES}
 	${IBVERBS_LIBRARIES}
 	${RDMACM_LIBRARIES}
+	${OPENSSL_LIBRARIES}
 )
 set_target_properties(vitastor_client PROPERTIES VERSION ${VITASTOR_VERSION} SOVERSION 0)
 configure_file(vitastor.pc.in vitastor.pc @ONLY)
@@ -98,9 +100,10 @@ endif (${WITH_QEMU})
 add_executable(test_cluster_client
 	EXCLUDE_FROM_ALL
 	../test/test_cluster_client.cpp
-	pg_states.cpp osd_ops.cpp cluster_client.cpp cluster_client_list.cpp cluster_client_wb.cpp msgr_op.cpp ../test/mock/messenger.cpp msgr_stop.cpp
-	etcd_state_client.cpp ../util/timerfd_manager.cpp ../util/addr_util.cpp ../util/str_util.cpp ../util/json_util.cpp ../../json11/json11.cpp
+	pg_states.cpp osd_ops.cpp cluster_client.cpp cluster_client_list.cpp cluster_client_wb.cpp cluster_client_icache.cpp msgr_op.cpp ../test/mock/messenger.cpp msgr_stop.cpp msgr_encrypt.cpp
+	etcd_state_client.cpp ../util/timerfd_manager.cpp ../util/addr_util.cpp ../util/str_util.cpp ../util/json_util.cpp ../util/xxh_x86dispatch.c ../../json11/json11.cpp
 )
+target_link_libraries(test_cluster_client ${OPENSSL_LIBRARIES})
 target_compile_definitions(test_cluster_client PUBLIC -D__MOCK__)
 target_include_directories(test_cluster_client BEFORE PUBLIC ${CMAKE_SOURCE_DIR}/src/test/mock)
 add_dependencies(build_tests test_cluster_client)
@@ -27,7 +27,7 @@ cluster_client_t::cluster_client_t(ring_loop_t *ringloop, timerfd_manager_t *tfd
    msgr.ringloop = ringloop;
    msgr.repeer_pgs = [this](osd_num_t peer_osd)
    {
-        if (msgr.osd_peer_fds.find(peer_osd) != msgr.osd_peer_fds.end())
+        if (msgr.osd_peers.find(peer_osd) != msgr.osd_peers.end())
        {
            // peer_osd just connected
            continue_ops();
@@ -47,8 +47,8 @@ cluster_client_t::cluster_client_t(ring_loop_t *ringloop, timerfd_manager_t *tfd
    msgr.exec_op = [this](osd_op_t *op)
    {
        // Garbage in
-        fprintf(stderr, "Incoming garbage from peer %d\n", op->peer_fd);
-        msgr.stop_client(op->peer_fd);
+        fprintf(stderr, "Can't handle incoming operation from client %lu\n", op->client_id);
+        msgr.stop_client(op->client_id);
        delete op;
    };
    msgr.parse_config(config);
@@ -62,6 +62,7 @@ cluster_client_t::cluster_client_t(ring_loop_t *ringloop, timerfd_manager_t *tfd
    st_cli.on_change_node_placement_hook = [this]() { on_change_node_placement_hook(); };
    st_cli.on_load_pgs_hook = [this](bool success) { on_load_pgs_hook(success); };
    st_cli.on_reload_hook = [this]() { st_cli.load_global_config(); };
+    st_cli.on_inode_change_hook = [this](uint64_t inode, bool removed) { on_change_inode_hook(inode, removed); };

    st_cli.parse_config(config);
    st_cli.infinite_start = false;
@@ -70,13 +71,11 @@ cluster_client_t::cluster_client_t(ring_loop_t *ringloop, timerfd_manager_t *tfd
        st_cli.infinite_start = config["client_infinite_start"].bool_value();
    }
    st_cli.load_global_config();
-
-    scrap_buffer_size = SCRAP_BUFFER_SIZE;
-    scrap_buffer = malloc_or_die(scrap_buffer_size);
 }

 cluster_client_t::~cluster_client_t()
 {
+    vault_destroy();
    if (retry_timeout_id >= 0)
    {
        tfd->clear_timer(retry_timeout_id);
@@ -94,7 +93,6 @@ cluster_client_t::~cluster_client_t()
    {
        ringloop->unregister_consumer(&consumer);
    }
-    free(scrap_buffer);
    delete wb;
    wb = NULL;
 }
@@ -156,7 +154,7 @@ void cluster_client_t::continue_raw_ops(osd_num_t peer_osd)
    {
        auto op = it->second;
        op->op_type = OSD_OP_OUT;
-        op->peer_fd = msgr.osd_peer_fds.at(peer_osd);
+        op->client_id = msgr.osd_peers.at(peer_osd)->client_id;
        msgr.outbox_push(op);
        raw_ops.erase(it++);
    }
@@ -481,6 +479,8 @@ void cluster_client_t::on_load_config_hook(json11::Json::object & etcd_global_co
        self_tree_metrics.clear();
        client_hostname = new_hostname;
    }
+    // vault
+    vault_parse_config();
    msgr.parse_config(config);
    st_cli.parse_config(config);
    st_cli.load_pgs();
@@ -607,6 +607,9 @@ void cluster_client_t::on_change_pool_config_hook()
            pg_counts[pool_item.first] = pool_item.second.real_pg_count;
        }
    }
+    inode_cache.clear();
+    inode_cache_children.clear();
+    vault_keys.clear();
    continue_ops();
 }

@@ -673,6 +676,10 @@ bool cluster_client_t::flush()
 {
    if (!ringloop)
    {
+        if (vault_loading)
+        {
+            return false;
+        }
        if (wb->writeback_queue.size())
        {
            wb->start_writebacks(this, 0);
@@ -695,7 +702,7 @@ bool cluster_client_t::flush()
        sync_done = true;
    };
    execute(sync);
-    while (!sync_done)
+    while (!sync_done || vault_loading)
    {
        ringloop->loop();
        if (!sync_done)
@@ -871,13 +878,13 @@ void cluster_client_t::execute_cas(cluster_op_t *op)
        if (op->retval != expected && op->retval >= 0)
            op->retval = -EIO;
        op->retval = op->retval == -EPIPE ? -EINTR : op->retval;
-        auto peer_it = msgr.osd_peer_fds.find(op->parts[0].osd_num);
+        auto peer_it = msgr.osd_peers.find(op->parts[0].osd_num);
        if (op->retval != 0 || (op->flags & OP_IMMEDIATE_COMMIT))
        {
            auto cb = std::move(op->callback);
            cb(op);
        }
-        else if (peer_it == msgr.osd_peer_fds.end())
+        else if (peer_it == msgr.osd_peers.end())
        {
            // Care must be taken to make sure that the client doesn't reconnect to the OSD
            // before executing the previously completed operation callback (!)
@@ -888,10 +895,10 @@ void cluster_client_t::execute_cas(cluster_op_t *op)
        else
        {
            // CAS writes have a built-in sync
-            auto peer_fd = peer_it->second;
+            osd_client_t *cl = peer_it->second;
            *part = (osd_op_t){
                .op_type = OSD_OP_OUT,
-                .peer_fd = peer_fd,
+                .client_id = cl->client_id,
                .req = {
                    .hdr = {
                        .magic = SECONDARY_OSD_OP_MAGIC,
@@ -958,10 +965,40 @@ bool cluster_client_t::check_rw(cluster_op_t *op)
    {
        op->flags |= OP_IMMEDIATE_COMMIT;
    }
+    bool searched = false;
+    std::shared_ptr<inode_cache_t> icache;
+    if (op->opcode == OSD_OP_READ || op->opcode == OSD_OP_WRITE)
+    {
+        if (!searched)
+        {
+            icache = inode_cache_get(op->inode);
+            searched = true;
+        }
+        if (icache && icache->has_parent_loop && op->opcode == OSD_OP_READ)
+        {
+            op->retval = -EINVAL;
+            auto cb = std::move(op->callback);
+            cb(op);
+            return false;
+        }
+        if (icache && icache->op_enc)
+        {
+            // Use shared_ptr aliasing to attach op_enc to the inode cache entry
+            op->enc = std::shared_ptr<osd_op_enc_t>(icache, icache->op_enc);
+        }
+        else
+            op->enc.reset();
+    }
+    else
+        op->enc.reset();
    if ((op->opcode == OSD_OP_WRITE || op->opcode == OSD_OP_DELETE) && !(op->flags & OSD_OP_IGNORE_READONLY))
    {
-        auto ino_it = st_cli.inode_config.find(op->inode);
-        if (ino_it != st_cli.inode_config.end() && ino_it->second.readonly)
+        if (!searched)
+        {
+            icache = inode_cache_get(op->inode);
+            searched = true;
+        }
+        if (icache && icache->readonly)
        {
            op->retval = -EROFS;
            auto cb = std::move(op->callback);
@@ -972,43 +1009,49 @@ bool cluster_client_t::check_rw(cluster_op_t *op)
    op->deoptimise_snapshot = false;
    if (enable_writeback && (op->opcode == OSD_OP_READ || op->opcode == OSD_OP_READ_BITMAP || op->opcode == OSD_OP_READ_CHAIN_BITMAP))
    {
-        auto ino_it = st_cli.inode_config.find(op->inode);
-        if (ino_it != st_cli.inode_config.end())
+        if (!searched)
        {
-            int chain_size = 0;
-            while (ino_it != st_cli.inode_config.end() && ino_it->second.parent_id)
+            icache = inode_cache_get(op->inode);
+            searched = true;
+        }
+        if (icache)
+        {
+            for (auto & parent: icache->chain)
            {
-                // Check for loops - FIXME check it in etcd_state_client
-                if (ino_it->second.parent_id == op->inode ||
-                    chain_size > st_cli.inode_config.size())
-                {
-                    op->retval = -EINVAL;
-                    auto cb = std::move(op->callback);
-                    cb(op);
-                    return false;
-                }
-                if (INODE_POOL(ino_it->second.parent_id) == INODE_POOL(ino_it->first) &&
-                    wb->has_inode(ino_it->second.parent_id))
+                if (INODE_POOL(parent) == INODE_POOL(op->inode) && wb->has_inode(parent))
                {
                    // Deoptimise reads - we have dirty data for one of the parent layer(s).
                    op->deoptimise_snapshot = true;
                    break;
                }
-                chain_size++;
-                ino_it = st_cli.inode_config.find(ino_it->second.parent_id);
            }
        }
    }
+    if (icache && icache->err_code)
+    {
+        if (icache->err_code == EPERM)
+        {
+            op->retval = -EPERM;
+            auto cb = std::move(op->callback);
+            cb(op);
+            return false;
+        }
+        else if (icache->err_code == EAGAIN)
+        {
+            key_wait_ops.push_back(op);
+            return false;
+        }
+    }
    return true;
 }

 void cluster_client_t::execute_raw(osd_num_t osd_num, osd_op_t *op)
 {
-    auto fd_it = msgr.osd_peer_fds.find(osd_num);
-    if (fd_it != msgr.osd_peer_fds.end())
+    auto peer_it = msgr.osd_peers.find(osd_num);
+    if (peer_it != msgr.osd_peers.end())
    {
        op->op_type = OSD_OP_OUT;
-        op->peer_fd = fd_it->second;
+        op->client_id = peer_it->second->client_id;
        msgr.outbox_push(op);
    }
    else
@@ -1121,31 +1164,33 @@ resume_2:
        // because if some operations were invalid for the new PG count we'd get errors
        if (op->opcode == OSD_OP_READ || op->opcode == OSD_OP_READ_CHAIN_BITMAP)
        {
-            // Check parent inode
-            auto ino_it = st_cli.inode_config.find(op->cur_inode);
-            // Skip parents from the same pool
-            int skipped = 0;
-            while (!op->deoptimise_snapshot &&
-                ino_it != st_cli.inode_config.end() && ino_it->second.parent_id &&
-                INODE_POOL(ino_it->second.parent_id) == INODE_POOL(op->cur_inode))
+            uint64_t next_inode = 0;
+            auto icache = inode_cache_get(op->cur_inode);
+            if (icache)
            {
-                // Check for loops - FIXME check it in etcd_state_client
-                if (ino_it->second.parent_id == op->inode ||
-                    skipped > st_cli.inode_config.size())
+                if (icache->has_parent_loop)
                {
                    op->retval = -EINVAL;
                    erase_op(op);
                    return 1;
                }
-                skipped++;
-                ino_it = st_cli.inode_config.find(ino_it->second.parent_id);
+                if (op->deoptimise_snapshot)
+                {
+                    if (icache->chain.size() > 1)
+                        next_inode = icache->chain[1];
+                }
+                else
+                {
+                    if (icache->other_pool_parent_id)
+                        next_inode = icache->other_pool_parent_id;
+                }
            }
-            if (ino_it != st_cli.inode_config.end() &&
-                ino_it->second.parent_id &&
-                ino_it->second.parent_id != op->inode)
+            if (next_inode)
            {
                // Continue reading from the parent inode
-                op->cur_inode = ino_it->second.parent_id;
+                icache = inode_cache_get(next_inode);
+                op->cur_inode = next_inode;
+                op->enc = (icache && icache->op_enc ? std::shared_ptr<osd_op_enc_t>(icache, icache->op_enc) : nullptr);
                op->parts.clear();
                op->done_count = 0;
                goto resume_0;
@@ -1196,7 +1241,7 @@ resume_2:
    return 0;
 }

-static void add_iov(int size, bool skip, cluster_op_t *op, int &iov_idx, size_t &iov_pos, osd_op_buf_list_t &iov, void *scrap, int scrap_len)
+static void add_iov(int size, int skip, cluster_op_t *op, int &iov_idx, size_t &iov_pos, osd_op_buf_list_t &iov)
 {
    int left = size;
    while (left > 0 && iov_idx < op->iov.count)
@@ -1204,7 +1249,7 @@ static void add_iov(int size, bool skip, cluster_op_t *op, int &iov_idx, size_t
        int cur_left = op->iov.buf[iov_idx].iov_len - iov_pos;
        if (cur_left < left)
        {
-            if (!skip)
+            if (skip == 0)
            {
                iov.push_back((uint8_t*)op->iov.buf[iov_idx].iov_base + iov_pos, cur_left);
            }
@@ -1214,7 +1259,7 @@ static void add_iov(int size, bool skip, cluster_op_t *op, int &iov_idx, size_t
        }
        else
        {
-            if (!skip)
+            if (skip == 0)
            {
                iov.push_back((uint8_t*)op->iov.buf[iov_idx].iov_base + iov_pos, left);
            }
@@ -1223,16 +1268,10 @@ static void add_iov(int size, bool skip, cluster_op_t *op, int &iov_idx, size_t
        }
    }
    assert(left == 0);
-    if (skip && scrap_len > 0)
+    if (skip == 1)
    {
-        // All skipped ranges are read into the same useless buffer
-        left = size;
-        while (left > 0)
-        {
-            int cur_left = scrap_len < left ? scrap_len : left;
-            iov.push_back(scrap, cur_left);
-            left -= cur_left;
-        }
+        // data read into a NULL buffer will be discarded by messenger
+        iov.push_back(NULL, size);
    }
 }

@@ -1252,7 +1291,11 @@ void cluster_client_t::slice_rw(cluster_op_t *op)
        // Allocate memory for the bitmap
        unsigned object_bitmap_size = ((op->len / pool_cfg.bitmap_granularity + 7) / 8);
        object_bitmap_size = (object_bitmap_size < 8 ? 8 : object_bitmap_size);
-        unsigned bitmap_mem = object_bitmap_size + (pool_cfg.data_block_size / pool_cfg.bitmap_granularity / 8 * pg_data_size) * op->parts.size();
+        unsigned bitmap_mem = object_bitmap_size +
+            op->parts.size() * pg_data_size *
+            (pool_cfg.data_block_size / pool_cfg.bitmap_granularity / 8
+            // read chain info - 1 byte per block
+            + (op->enc ? op->len/pool_cfg.bitmap_granularity : 0));
        if (!op->bitmap_buf || op->bitmap_buf_size < bitmap_mem)
        {
            op->bitmap_buf = realloc_or_die(op->bitmap_buf, bitmap_mem);
@@ -1294,10 +1337,10 @@ void cluster_client_t::slice_rw(cluster_op_t *op)
                        {
                            begin = cur;
                            // Just advance iov_idx & iov_pos
-                            add_iov(cur-prev, true, op, iov_idx, iov_pos, op->parts[i].iov, NULL, 0);
+                            add_iov(cur-prev, 2, op, iov_idx, iov_pos, op->parts[i].iov);
                        }
                        else
-                            add_iov(cur-prev, skip_prev, op, iov_idx, iov_pos, op->parts[i].iov, scrap_buffer, scrap_buffer_size);
+                            add_iov(cur-prev, skip_prev ? 1 : 0, op, iov_idx, iov_pos, op->parts[i].iov);
                    }
                    skip_prev = skip;
                    prev = cur;
@@ -1308,11 +1351,11 @@ void cluster_client_t::slice_rw(cluster_op_t *op)
            if (skip_prev)
            {
                // Just advance iov_idx & iov_pos
-                add_iov(end-prev, true, op, iov_idx, iov_pos, op->parts[i].iov, NULL, 0);
+                add_iov(end-prev, 2, op, iov_idx, iov_pos, op->parts[i].iov);
                end = prev;
            }
            else
-                add_iov(cur-prev, skip_prev, op, iov_idx, iov_pos, op->parts[i].iov, scrap_buffer, scrap_buffer_size);
+                add_iov(cur-prev, skip_prev ? 1 : 0, op, iov_idx, iov_pos, op->parts[i].iov);
            if (end == begin)
            {
                op->done_count++;
@@ -1321,7 +1364,7 @@ void cluster_client_t::slice_rw(cluster_op_t *op)
        }
        else if (op->opcode != OSD_OP_READ_BITMAP && op->opcode != OSD_OP_READ_CHAIN_BITMAP && op->opcode != OSD_OP_DELETE)
        {
-            add_iov(end-begin, false, op, iov_idx, iov_pos, op->parts[i].iov, NULL, 0);
+            add_iov(end-begin, 0, op, iov_idx, iov_pos, op->parts[i].iov);
        }
        op->parts[i].parent = op;
        op->parts[i].offset = begin;
@@ -1401,15 +1444,15 @@ int cluster_client_t::try_send(cluster_op_t *op, int i, std::function<void(osd_o
                primary_osd = nearest_osd;
        }
        part->osd_num = primary_osd;
-        auto peer_it = msgr.osd_peer_fds.find(primary_osd);
-        if (peer_it != msgr.osd_peer_fds.end())
+        auto peer_it = msgr.osd_peers.find(primary_osd);
+        if (peer_it != msgr.osd_peers.end())
        {
-            int peer_fd = peer_it->second;
+            osd_client_t *cl = peer_it->second;
            part->flags |= PART_SENT|PART_VALID;
            op->inflight_count++;
-            uint64_t pg_bitmap_size = (pool_cfg.data_block_size / pool_cfg.bitmap_granularity / 8) * (
-                pool_cfg.scheme == POOL_SCHEME_REPLICATED ? 1 : pool_cfg.pg_size-pool_cfg.parity_chunks
-            );
+            uint32_t pg_data_size = (pool_cfg.scheme == POOL_SCHEME_REPLICATED ? 1 : pool_cfg.pg_size-pool_cfg.parity_chunks);
+            uint64_t pg_bitmap_size = pg_data_size * (pool_cfg.data_block_size / pool_cfg.bitmap_granularity / 8
+                + (op->opcode == OSD_OP_READ && op->enc ? pool_cfg.data_block_size/pool_cfg.bitmap_granularity : 0));
            uint64_t meta_rev = 0;
            if (op->opcode != OSD_OP_READ_BITMAP && op->opcode != OSD_OP_DELETE && !op->deoptimise_snapshot)
            {
@@ -1419,7 +1462,7 @@ int cluster_client_t::try_send(cluster_op_t *op, int i, std::function<void(osd_o
            }
            part->op = (osd_op_t){
                .op_type = OSD_OP_OUT,
-                .peer_fd = peer_fd,
+                .client_id = cl->client_id,
                .req = { .rw = {
                    .header = {
                        .magic = SECONDARY_OSD_OP_MAGIC,
@@ -1428,6 +1471,7 @@ int cluster_client_t::try_send(cluster_op_t *op, int i, std::function<void(osd_o
                    .inode = op->cur_inode,
                    .offset = part->offset,
                    .len = part->len,
+                    .flags = op->opcode == OSD_OP_READ && op->enc && !op->deoptimise_snapshot ? OSD_OP_RETURN_CHAIN : 0,
                    .meta_revision = meta_rev,
                    .version = op->opcode == OSD_OP_WRITE || op->opcode == OSD_OP_DELETE ? op->version : 0,
                } },
@@ -1435,6 +1479,7 @@ int cluster_client_t::try_send(cluster_op_t *op, int i, std::function<void(osd_o
                    ? (uint8_t*)op->part_bitmaps + pg_bitmap_size*i : NULL),
                .bitmap_len = (unsigned)(op->opcode == OSD_OP_READ || op->opcode == OSD_OP_READ_BITMAP || op->opcode == OSD_OP_READ_CHAIN_BITMAP
                    ? pg_bitmap_size : 0),
+                .enc = op->enc,
                .callback = cb ? cb : [this, part](osd_op_t *op_part)
                {
                    handle_op_part(part);
@@ -1468,8 +1513,8 @@ int cluster_client_t::continue_sync(cluster_op_t *op)
    for (auto do_it = dirty_osds.begin(); do_it != dirty_osds.end(); )
    {
        osd_num_t sync_osd = *do_it;
-        auto peer_it = msgr.osd_peer_fds.find(sync_osd);
-        if (peer_it == msgr.osd_peer_fds.end())
+        auto peer_it = msgr.osd_peers.find(sync_osd);
+        if (peer_it == msgr.osd_peers.end())
            dirty_osds.erase(do_it++);
        else
            do_it++;
@@ -1522,12 +1567,12 @@ resume_1:

 void cluster_client_t::send_sync(cluster_op_t *op, cluster_op_part_t *part)
 {
-    auto peer_fd = msgr.osd_peer_fds.at(part->osd_num);
+    osd_client_t *cl = msgr.osd_peers.at(part->osd_num);
    part->flags |= PART_SENT;
    op->inflight_count++;
    part->op = (osd_op_t){
        .op_type = OSD_OP_OUT,
-        .peer_fd = peer_fd,
+        .client_id = cl->client_id,
        .req = {
            .hdr = {
                .magic = SECONDARY_OSD_OP_MAGIC,
@@ -1567,10 +1612,10 @@ void cluster_client_t::handle_op_part(cluster_op_part_t *part)
            // Error priority: EIO > ENOSPC > ETIMEDOUT > EPIPE
            op->retval = part->op.reply.hdr.retval;
        }
-        int stop_fd = -1;
+        uint64_t stop_client_id = 0;
        if (op->retval != -EINTR && op->retval != -EIO && op->retval != -ENOSPC)
        {
-            stop_fd = part->op.peer_fd;
+            stop_client_id = part->op.client_id;
            if (op->retval != -EPIPE || log_level > 0)
            {
                fprintf(
@@ -1597,9 +1642,9 @@ void cluster_client_t::handle_op_part(cluster_op_part_t *part)
            op->retry_after = op->retval != -EPIPE ? client_eio_retry_interval : client_retry_interval;
        }
        reset_retry_timer(op->retry_after);
-        if (stop_fd >= 0)
+        if (stop_client_id)
        {
-            msgr.stop_client(stop_fd);
+            msgr.stop_client(stop_client_id);
        }
        op->inflight_count--;
        if (op->inflight_count == 0 && !op->retry_after)
@@ -1634,7 +1679,7 @@ void cluster_client_t::handle_op_part(cluster_op_part_t *part)
            if (op->opcode == OSD_OP_READ || op->opcode == OSD_OP_READ_BITMAP || op->opcode == OSD_OP_READ_CHAIN_BITMAP)
            {
                for (auto & part: op->parts)
-                    if (part.flags == (PART_SENT|PART_VALID|PART_DONE))
+                    if ((part.flags & (PART_SENT|PART_VALID|PART_DONE)) == (PART_SENT|PART_VALID|PART_DONE))
                        copy_part_bitmap(op, &part);
            }
            if (op->opcode == OSD_OP_SYNC)
@@ -5,6 +5,7 @@

 #include "messenger.h"
 #include "etcd_state_client.h"
+#include "../util/robin_hood.h"

 #define DEFAULT_CLIENT_MAX_DIRTY_BYTES 32*1024*1024
 #define DEFAULT_CLIENT_MAX_DIRTY_OPS 1024
@@ -71,6 +72,7 @@ protected:
    cluster_op_t *prev = NULL, *next = NULL;
    int prev_wait = 0;
    uint64_t flush_id = 0;
+    std::shared_ptr<osd_op_enc_t> enc;
    friend class cluster_client_t;
    friend class writeback_cache_t;
 };
@@ -80,6 +82,25 @@ struct inode_list_osd_t;
 struct inode_list_pg_t;
 class writeback_cache_t;

+struct inode_cache_t
+{
+    std::vector<inode_t> chain;
+    uint8_t *key_data = NULL;
+    osd_op_enc_t *op_enc = NULL;
+    bool readonly = false;
+    bool has_parent_loop = false;
+    inode_t other_pool_parent_id = 0;
+    int err_code = 0;
+
+    ~inode_cache_t();
+};
+
+struct vault_load_key_t
+{
+    int key_state = 0;
+    std::string key;
+};
+
 // FIXME: Split into public and private interfaces
 class __attribute__((visibility("default"))) cluster_client_t
 {
@@ -89,8 +110,8 @@ public:
    timerfd_manager_t *tfd = NULL;
    ring_loop_t *ringloop = NULL;

-    std::map<pool_id_t, uint64_t> pg_counts;
-    std::map<pool_pg_num_t, osd_num_t> pg_primary;
+    // config:
+
    // client_max_dirty_* is actually "max unsynced", for the case when immediate_commit is off
    uint64_t client_max_dirty_bytes = 0;
    uint64_t client_max_dirty_ops = 0;
@@ -102,12 +123,23 @@ public:
    uint64_t client_max_writeback_iodepth = 0;
    std::string conf_hostname;

+    std::string vault_url;
+    std::string vault_client_cert;
+    std::string vault_client_key;
+    std::string vault_ca;
+    std::string vault_secret_api_path;
+    uint64_t vault_timeout_ms = 0;
+    uint64_t vault_error_timeout_sec = 0;
+    uint64_t vault_refresh_leeway_sec = 0;
+
    int log_level = 0;
    int client_retry_interval = 50; // ms
    int client_eio_retry_interval = 1000; // ms
    bool client_retry_enospc = true;
    int client_wait_up_timeout = 16; // sec (for listings)

+    // state:
+
    std::string client_hostname;
    std::map<std::string, int> self_tree_metrics;
    std::map<osd_num_t, int> osd_tree_metrics;
@@ -115,15 +147,28 @@ public:
    int retry_timeout_id = -1;
    int retry_timeout_duration = 0;
    std::vector<cluster_op_t*> offline_ops;
+    std::vector<cluster_op_t*> key_wait_ops;
    cluster_op_t *op_queue_head = NULL, *op_queue_tail = NULL;
    writeback_cache_t *wb = NULL;
    std::set<osd_num_t> dirty_osds;
    uint64_t dirty_bytes = 0, dirty_ops = 0;

-    void *scrap_buffer = NULL;
-    unsigned scrap_buffer_size = 0;
+    // inodes require some extra state for read/write, it's stored here.
+    // moreover, robin_hood access is slightly faster than std::map :)
+    robin_hood::unordered_flat_map<inode_t, std::shared_ptr<inode_cache_t>> inode_cache;
+    std::set<std::pair<inode_t, inode_t>> inode_cache_children;
+
+    http_context_t *vault_http_ctx = NULL;
+    http_co_t *vault_http_cli = NULL;
+    bool vault_loading = false;
+    std::string vault_token;
+    bool vault_auth_error = false;
+    timespec vault_token_expire = {};
+    std::vector<std::string> vault_key_load_queue;
+    std::map<std::string, vault_load_key_t> vault_keys;

    bool pgs_loaded = false;
+    std::map<pool_id_t, uint64_t> pg_counts;
    ring_consumer_t consumer;
    std::vector<std::function<void(void)>> on_ready_hooks;
    int list_retry_timeout_id = -1;
@@ -163,6 +208,13 @@ protected:
 #endif
    void continue_ops(int time_passed = 0);

+    std::shared_ptr<inode_cache_t> inode_cache_get(inode_t ino);
+    void vault_parse_config();
+    bool vault_check_token();
+    void vault_load_keys();
+    void vault_destroy();
+    void vault_parse_secret(const std::string & key_id, const std::string & err, json11::Json data);
+
 protected:
    bool affects_osd(uint64_t inode, uint64_t offset, uint64_t len, osd_num_t osd);
    bool affects_pg(uint64_t inode, uint64_t offset, uint64_t len, pool_id_t pool_id, pg_num_t pg_num);
@@ -173,6 +225,7 @@ protected:
    void on_change_pg_state_hook(pool_id_t pool_id, pg_num_t pg_num, osd_num_t prev_primary);
    void on_change_osd_state_hook(uint64_t peer_osd);
    void on_change_node_placement_hook();
+    void on_change_inode_hook(uint64_t inode, bool removed);

    void execute_internal(cluster_op_t *op);
    void execute_cas(cluster_op_t *op);
@@ -189,6 +242,7 @@ protected:
    void erase_op(cluster_op_t *op);
    void calc_wait(cluster_op_t *op);
    void inc_wait(uint64_t opcode, uint64_t flags, cluster_op_t *next, int inc);
+
    void continue_lists();
    bool continue_listing(inode_list_t *lst);
    bool restart_listing(inode_list_t* lst);
@@ -0,0 +1,367 @@
+// Copyright (c) Vitaliy Filippov, 2019+
+// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
+
+#include <stdexcept>
+#include <assert.h>
+#include "cluster_client_impl.h"
+#include "http_client.h"
+#include "str_util.h"
+
+#define VAULT_KEY_NOT_LOADED 0
+#define VAULT_KEY_LOADING 1
+#define VAULT_KEY_LOADED 2
+#define VAULT_KEY_ERROR 3
+
+inode_cache_t::~inode_cache_t()
+{
+    if (key_data)
+    {
+        free(key_data);
+        key_data = NULL;
+        op_enc = NULL;
+    }
+}
+
+void cluster_client_t::vault_destroy()
+{
+    if (vault_http_ctx)
+    {
+#ifndef __MOCK__
+        http_destroy(vault_http_cli);
+        http_context_destroy(vault_http_ctx);
+        vault_http_cli = NULL;
+        vault_http_ctx = NULL;
+#endif
+    }
+}
+
+void cluster_client_t::vault_parse_config()
+{
+    vault_url = config["vault_url"].string_value();
+    vault_client_cert = config["vault_client_cert"].string_value();
+    vault_client_key = config["vault_client_key"].string_value();
+    vault_ca = config["vault_ca"].string_value();
+    vault_secret_api_path = "/v1/secret/";
+    if (config["vault_secret_api_path"].is_string())
+        vault_secret_api_path = config["vault_secret_api_path"].string_value();
+    vault_timeout_ms = config["vault_timeout_ms"].uint64_value();
+    if (!vault_timeout_ms)
+        vault_timeout_ms = 5000;
+    vault_error_timeout_sec = config["vault_error_timeout_sec"].uint64_value();
+    if (!vault_error_timeout_sec)
+        vault_error_timeout_sec = 60;
+    vault_refresh_leeway_sec = config["vault_refresh_leeway_sec"].uint64_value();
+    if (!vault_refresh_leeway_sec)
+        vault_refresh_leeway_sec = 60;
+}
+
+// FIXME: Rework client API by adding open/close and cache inode information in the "FD" (maybe)
+void cluster_client_t::on_change_inode_hook(uint64_t inode, bool removed)
+{
+    std::vector<inode_t> children = { inode };
+    for (size_t i = 0; i < children.size(); i++)
+    {
+        auto it = inode_cache_children.lower_bound(std::make_pair(children[i], (inode_t)0));
+        while (it != inode_cache_children.end() && it->first == children[i])
+        {
+            children.push_back(it->second);
+            it++;
+        }
+    }
+    for (auto & inode: children)
+    {
+        auto it = inode_cache.find(inode);
+        if (it != inode_cache.end())
+        {
+            auto icache = it->second;
+            for (auto & parent: icache->chain)
+            {
+                inode_cache_children.erase(std::make_pair(parent, inode));
+            }
+            inode_cache.erase(it);
+        }
+    }
+}
+
+std::shared_ptr<inode_cache_t> cluster_client_t::inode_cache_get(inode_t ino)
+{
+    auto icache_it = inode_cache.find(ino);
+    if (icache_it != inode_cache.end())
+    {
+        return icache_it->second;
+    }
+    // Fill inode cache
+    auto ino_it = st_cli.inode_config.find(ino);
+    if (ino_it == st_cli.inode_config.end())
+    {
+        inode_cache[ino] = NULL;
+        return NULL;
+    }
+    auto pool_it = st_cli.pool_config.find(INODE_POOL(ino));
+    if (pool_it == st_cli.pool_config.end())
+    {
+        inode_cache[ino] = NULL;
+        return NULL;
+    }
+    auto & inode_cfg = ino_it->second;
+    auto & pool_cfg = pool_it->second;
+    std::shared_ptr<inode_cache_t> icache = std::make_shared<inode_cache_t>();
+    icache->readonly = inode_cfg.readonly;
+    icache->chain.push_back(ino);
+    std::vector<inode_config_t*> chain_cfg;
+    // FIXME: Allow unencrypted read & write when all chain is encrypted with the same key
+    int enc_key_count = !inode_cfg.enc_key.empty() ? 1 : 0;
+    if (inode_cfg.parent_id)
+    {
+        // Check for loops and cache the chain
+        robin_hood::unordered_flat_set<inode_t> seen;
+        seen.insert(ino);
+        uint64_t parent_id = inode_cfg.parent_id;
+        while (parent_id)
+        {
+            if (seen.find(parent_id) != seen.end())
+            {
+                icache->has_parent_loop = true;
+                break;
+            }
+            seen.insert(parent_id);
+            ino_it = st_cli.inode_config.find(parent_id);
+            if (INODE_POOL(parent_id) == INODE_POOL(ino))
+            {
+                icache->chain.push_back(parent_id);
+                if (ino_it == st_cli.inode_config.end())
+                    chain_cfg.push_back(NULL);
+                else
+                {
+                    chain_cfg.push_back(&ino_it->second);
+                    if (!ino_it->second.enc_key.empty())
+                        enc_key_count++;
+                }
+            }
+            else if (!icache->other_pool_parent_id)
+                icache->other_pool_parent_id = parent_id;
+            if (ino_it == st_cli.inode_config.end())
+                break;
+            parent_id = ino_it->second.parent_id;
+        }
+    }
+    // Check external keys and wait for loading, if required
+    if (enc_key_count)
+    {
+        for (size_t i = 0; i <= chain_cfg.size(); i++)
+        {
+            inode_config_t *cfg = !i ? &inode_cfg : chain_cfg[i-1];
+            if (cfg && cfg->enc_key.substr(0, strlen(VAULT_KEY_PREFIX)) == VAULT_KEY_PREFIX)
+            {
+                auto & ik = vault_keys[inode_cfg.enc_key];
+                if (ik.key_state == VAULT_KEY_ERROR || vault_url.empty())
+                {
+                    icache->err_code = EPERM;
+                    enc_key_count = 0;
+                }
+                else if (ik.key_state == VAULT_KEY_NOT_LOADED)
+                {
+                    ik.key_state = VAULT_KEY_LOADING;
+                    vault_key_load_queue.push_back(inode_cfg.enc_key);
+                    vault_load_keys();
+                    icache->err_code = EAGAIN;
+                    enc_key_count = 0;
+                }
+                else if (ik.key_state == VAULT_KEY_LOADING)
+                {
+                    icache->err_code = EAGAIN;
+                    enc_key_count = 0;
+                }
+                else
+                {
+                    assert(ik.key_state == VAULT_KEY_LOADED);
+                }
+            }
+        }
+    }
+    // Generate encryption key chain, if applicable
+    if (enc_key_count)
+    {
+        uint8_t *key_data = (uint8_t*)malloc_or_die(
+            AES_256_XTS_KEY_SIZE * enc_key_count +
+            sizeof(uint8_t*) * icache->chain.size() +
+            sizeof(osd_op_enc_t)
+        );
+        uint8_t **keys = (uint8_t**)(key_data + AES_256_XTS_KEY_SIZE * enc_key_count);
+        osd_op_enc_t *enc = (osd_op_enc_t*)((uint8_t*)keys + sizeof(uint8_t*)*icache->chain.size());
+        size_t key_pos = 0;
+        for (size_t i = 0; i <= chain_cfg.size(); i++)
+        {
+            inode_config_t *cfg = !i ? &inode_cfg : chain_cfg[i-1];
+            if (cfg && !cfg->enc_key.empty())
+            {
+                const auto & key = cfg->enc_key.substr(0, strlen(VAULT_KEY_PREFIX)) == VAULT_KEY_PREFIX
+                    ? vault_keys.at(cfg->enc_key).key
+                    : cfg->enc_key;
+                assert(key_pos < AES_256_XTS_KEY_SIZE * enc_key_count);
+                assert(key.size() == 2*AES_256_XTS_KEY_SIZE);
+                keys[i] = key_data + key_pos;
+                fromhexstr(key, AES_256_XTS_KEY_SIZE, key_data + key_pos);
+                key_pos += AES_256_XTS_KEY_SIZE;
+            }
+            else
+                keys[i] = NULL;
+        }
+        enc->key_chain = keys;
+        enc->chain_size = icache->chain.size();
+        enc->read_chain_bitmap_pos = pool_cfg.data_block_size/pool_cfg.bitmap_granularity/8;
+        enc->bitmap_granularity = pool_cfg.bitmap_granularity;
+        icache->key_data = key_data;
+        icache->op_enc = enc;
+    }
+    inode_cache[ino] = icache;
+    for (auto & parent: icache->chain)
+    {
+        if (parent != ino)
+            inode_cache_children.insert(std::make_pair(parent, ino));
+    }
+    return icache;
+}
+
+#ifndef __MOCK__
+bool cluster_client_t::vault_check_token()
+{
+    timespec now;
+    clock_gettime(CLOCK_REALTIME, &now);
+    if (!vault_token_expire.tv_sec || vault_token_expire.tv_sec < now.tv_sec)
+    {
+        vault_loading = true;
+        http_json_post(
+            vault_http_cli, vault_url+"/v1/auth/cert/login", json11::Json::object{}, "",
+            (http_options_t){ .timeout = (int)vault_timeout_ms, .keepalive = true },
+            [this](http_message_t *response)
+            {
+                clock_gettime(CLOCK_REALTIME, &vault_token_expire);
+                vault_loading = false;
+                std::string err;
+                json11::Json data;
+                response->parse_json_response(err, data);
+                if (err != "")
+                {
+                    vault_token_expire.tv_sec += vault_error_timeout_sec;
+                    fprintf(stderr, "Vault request failed: %s\n", err.c_str());
+                }
+                else
+                {
+                    uint64_t ttl = data["auth"]["lease_duration"].uint64_value();
+                    vault_token = data["auth"]["client_token"].string_value();
+                    if (vault_token.empty() || !ttl)
+                    {
+                        vault_token_expire.tv_sec += vault_error_timeout_sec;
+                        fprintf(stderr, "No token or lease_duration in Vault response: %s\n", data.dump().c_str());
+                    }
+                    else
+                    {
+                        if (ttl < vault_refresh_leeway_sec)
+                            vault_token_expire.tv_sec += ttl/2;
+                        else
+                            vault_token_expire.tv_sec += ttl - vault_refresh_leeway_sec;
+                    }
+                }
+                vault_load_keys();
+            }
+        );
+        return false;
+    }
+    if (vault_token.empty())
+    {
+        // Auth error happened, mark all loads as failed
+        for (auto & key_id: vault_key_load_queue)
+        {
+            auto & k = vault_keys[key_id];
+            k.key_state = VAULT_KEY_ERROR;
+        }
+        vault_key_load_queue.clear();
+        auto ops = std::move(key_wait_ops);
+        for (cluster_op_t *op: ops)
+            inode_cache.erase(op->inode);
+        for (cluster_op_t *op: ops)
+            execute_internal(op);
+        return false;
+    }
+    return true;
+}
+#endif
+
+void cluster_client_t::vault_load_keys()
+{
+    if (vault_loading || !vault_key_load_queue.size())
+    {
+        return;
+    }
+#ifdef __MOCK__
+    vault_loading = true;
+#else
+    if (!vault_http_ctx)
+    {
+        std::string error;
+        vault_http_ctx = http_context_init(tfd, vault_client_cert, vault_client_key, vault_ca, true, error);
+        if (!vault_http_ctx)
+        {
+            fprintf(stderr, "Failed to initialize HTTP context for Vault: %s\n", error.c_str());
+            exit(1);
+        }
+        vault_http_cli = http_init(vault_http_ctx);
+    }
+    if (!vault_check_token())
+    {
+        return;
+    }
+    std::string key_id = vault_key_load_queue[0];
+    vault_key_load_queue.erase(vault_key_load_queue.begin());
+    vault_loading = true;
+    http_get(
+        vault_http_cli, vault_url+vault_secret_api_path+key_id.substr(strlen(VAULT_KEY_PREFIX)), "X-Vault-Token: "+vault_token+"\r\n",
+        (http_options_t){ .timeout = (int)vault_timeout_ms, .keepalive = true },
+        [this, key_id](http_message_t *response)
+        {
+            vault_loading = false;
+            std::string err;
+            json11::Json data;
+            response->parse_json_response(err, data);
+            vault_parse_secret(key_id, err, data);
+        }
+    );
+#endif
+}
+
+void cluster_client_t::vault_parse_secret(const std::string & key_id, const std::string & err, json11::Json data)
+{
+    vault_loading = false;
+    auto & k = vault_keys[key_id];
+    if (err != "")
+    {
+        k.key_state = VAULT_KEY_ERROR;
+        fprintf(stderr, "Vault %s%s%s request failed: %s\n", vault_url.c_str(),
+            vault_secret_api_path.c_str(), key_id.c_str()+strlen(VAULT_KEY_PREFIX), err.c_str());
+    }
+    else
+    {
+        auto hexkey = data["data"]["key"].string_value();
+        if (hexkey.empty() || !ishexstr(hexkey) || hexkey.size() != 2*AES_256_XTS_KEY_SIZE)
+        {
+            k.key_state = VAULT_KEY_ERROR;
+            fprintf(stderr, "Vault /v1/secret/%s request failed: 'key' is empty or has invalid format\n", key_id.c_str());
+        }
+        else
+        {
+            k.key_state = VAULT_KEY_LOADED;
+            k.key = hexkey;
+        }
+    }
+    if (vault_key_load_queue.empty())
+    {
+        auto ops = std::move(key_wait_ops);
+        for (cluster_op_t *op: ops)
+            inode_cache.erase(op->inode);
+        for (cluster_op_t *op: ops)
+            execute_internal(op);
+    }
+    else
+        vault_load_keys();
+}
@@ -5,7 +5,6 @@

 #include "cluster_client.h"

-#define SCRAP_BUFFER_SIZE 4*1024*1024
 #define PART_SENT 1
 #define PART_DONE 2
 #define PART_ERROR 4
@@ -295,7 +295,7 @@ int cluster_client_t::start_pg_listing(inode_list_pg_t *pg)
    bool conn = true;
    for (osd_num_t peer_osd: all_peers)
    {
-        if (msgr.osd_peer_fds.find(peer_osd) == msgr.osd_peer_fds.end())
+        if (msgr.osd_peers.find(peer_osd) == msgr.osd_peers.end())
        {
            // Initiate connection
            if (st_cli.peer_states[peer_osd].is_null())
@@ -340,7 +340,7 @@ void cluster_client_t::send_list(inode_list_osd_t *cur_list)
    osd_op_t *op = new osd_op_t();
    op->op_type = OSD_OP_OUT;
    // Already checked that it exists above, but anyway
-    op->peer_fd = msgr.osd_peer_fds.at(cur_list->osd_num);
+    op->client_id = msgr.osd_peers.at(cur_list->osd_num)->client_id;
    op->req = (osd_any_op_t){
        .sec_list = {
            .header = {
@@ -1,7 +1,10 @@
 // Copyright (c) Vitaliy Filippov, 2019+
 // License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)

+#include <assert.h>
+#include "malloc_or_die.h"
 #include "osd_ops.h"
+#include "msgr_op.h"
 #include "pg_states.h"
 #include "etcd_state_client.h"
 #ifndef __MOCK__
@@ -22,14 +25,19 @@ etcd_state_client_t::~etcd_state_client_t()
    stop_ws_keepalive();
    if (etcd_watch_ws)
    {
-        http_close(etcd_watch_ws);
+        http_destroy(etcd_watch_ws);
        etcd_watch_ws = NULL;
    }
    if (keepalive_client)
    {
-        http_close(keepalive_client);
+        http_destroy(keepalive_client);
        keepalive_client = NULL;
    }
+    if (http_ctx)
+    {
+        http_context_destroy(http_ctx);
+        http_ctx = NULL;
+    }
 #endif
    if (load_pgs_timer_id >= 0)
    {
@@ -72,55 +80,51 @@ std::vector<std::string> etcd_state_client_t::get_addresses()
    return addrs;
 }

-void etcd_state_client_t::etcd_call_oneshot(std::string etcd_address, std::string api, json11::Json payload,
+http_context_t *etcd_state_client_t::get_http_ctx()
+{
+    if (!http_ctx)
+    {
+        std::string error;
+        http_ctx = http_context_init(tfd, etcd_client_cert, etcd_client_key, etcd_ca, true, error);
+        if (!http_ctx)
+        {
+            fprintf(stderr, "Failed to initialize HTTP context: %s\n", error.c_str());
+            exit(1);
+        }
+    }
+    return http_ctx;
+}
+
+void etcd_state_client_t::etcd_call_oneshot(const std::string & etcd_url, const std::string & api, json11::Json payload,
    int timeout, std::function<void(std::string, json11::Json)> callback)
 {
-    std::string etcd_api_path;
-    int pos = etcd_address.find('/');
-    if (pos >= 0)
-    {
-        etcd_api_path = etcd_address.substr(pos);
-        etcd_address = etcd_address.substr(0, pos);
-    }
-    std::string req = payload.dump();
-    req = "POST "+etcd_api_path+api+" HTTP/1.1\r\n"
-        "Host: "+etcd_address+"\r\n"
-        "Content-Type: application/json\r\n"
-        "Content-Length: "+std::to_string(req.size())+"\r\n"
-        "Connection: close\r\n"
-        "\r\n"+req;
-    auto http_cli = http_init(tfd);
-    auto cb = [http_cli, callback](const http_response_t *response)
+    auto http_cli = http_init(get_http_ctx());
+    http_json_post(http_cli, etcd_url+api, payload, "", { .timeout = timeout }, [http_cli, callback](http_message_t *response)
    {
        std::string err;
        json11::Json data;
        response->parse_json_response(err, data);
        callback(err, data);
-        http_close(http_cli);
-    };
-    http_request(http_cli, etcd_address, req, { .timeout = timeout }, cb);
+        http_destroy(http_cli);
+    });
 }

-void etcd_state_client_t::etcd_call(std::string api, json11::Json payload, int timeout,
+void etcd_state_client_t::etcd_call(const std::string & api, json11::Json payload, int timeout,
    int retries, int interval, std::function<void(std::string, json11::Json)> callback)
 {
-    if (!etcd_addresses.size() && !etcd_local.size())
+    pick_next_etcd([=]()
    {
-        fprintf(stderr, "etcd_address is missing in Vitastor configuration\n");
-        exit(1);
-    }
-    pick_next_etcd();
-    std::string etcd_address = selected_etcd_address;
-    std::string etcd_api_path;
-    int pos = etcd_address.find('/');
-    if (pos >= 0)
-    {
-        etcd_api_path = etcd_address.substr(pos);
-        etcd_address = etcd_address.substr(0, pos);
-    }
+        etcd_call_selected(api, payload, timeout, retries, interval, callback);
+    });
+}
+
+void etcd_state_client_t::etcd_call_selected(const std::string & api, json11::Json payload, int timeout,
+    int retries, int interval, std::function<void(std::string, json11::Json)> callback)
+{
+    const auto & url = selected_etcd_url;
    std::string req = payload.dump();
-    req = "POST "+etcd_api_path+api+" HTTP/1.1\r\n"
-        "Host: "+etcd_address+"\r\n"
+    req = "POST "+url.path+api+" HTTP/1.1\r\n"
+        "Host: "+url.hostname+"\r\n"
        "Content-Type: application/json\r\n"
        "Content-Length: "+std::to_string(req.size())+"\r\n"
        "Connection: keep-alive\r\n"
@@ -128,15 +132,15 @@ void etcd_state_client_t::etcd_call(std::string api, json11::Json payload, int t
        "\r\n"+req;
    retries--;
    auto cb = [this, api, payload, timeout, retries, interval, callback,
-        cur_addr = selected_etcd_address](const http_response_t *response)
+        cur_addr = url.addr](http_message_t *response)
    {
        std::string err;
        json11::Json data;
        response->parse_json_response(err, data);
        if (err != "")
        {
-            if (cur_addr == selected_etcd_address)
-                selected_etcd_address = "";
+            if (cur_addr == selected_etcd_url.addr)
+                selected_etcd_url = (http_url_t){};
            if (retries > 0)
            {
                if (this->log_level > 0)
@@ -164,54 +168,58 @@ void etcd_state_client_t::etcd_call(std::string api, json11::Json payload, int t
            callback(err, data);
    };
    if (!keepalive_client)
-    {
-        keepalive_client = http_init(tfd);
-    }
-    http_request(keepalive_client, etcd_address, req, { .timeout = timeout, .keepalive = true }, cb);
+        keepalive_client = http_init(get_http_ctx());
+    http_request(keepalive_client, url.addr, req, { .timeout = timeout, .keepalive = true, .ssl = url.ssl }, cb);
 }

-void etcd_state_client_t::add_etcd_url(std::string addr)
+
+void etcd_state_client_t::add_etcd_url(std::string etcd_address)
 {
-    if (addr.length() > 0)
+    if (etcd_address.size() > 0)
    {
-        if (strtolower(addr.substr(0, 7)) == "http://")
-            addr = addr.substr(7);
-        else if (strtolower(addr.substr(0, 8)) == "https://")
-        {
-            fprintf(stderr, "HTTPS is unsupported for etcd. Either use plain HTTP or setup a local proxy for etcd interaction\n");
-            exit(1);
-        }
        if (!local_ips.size())
-            local_ips = getifaddr_list(std::vector<addr_mask_t>(), true);
-        std::string check_addr;
-        int pos = addr.find('/');
-        int pos2 = addr.find(':');
-        if (pos2 >= 0)
-            check_addr = addr.substr(0, pos2);
-        else if (pos >= 0)
-            check_addr = addr.substr(0, pos);
-        else
-            check_addr = addr;
-        if (pos == std::string::npos)
-            addr += "/v3";
-        bool local = false;
-        int i;
-        for (i = 0; i < local_ips.size(); i++)
        {
-            if (local_ips[i] == check_addr)
-            {
-                local = true;
-                break;
-            }
+            // Fill local_ips
+            for (auto & ip: getifaddr_list(std::vector<addr_mask_t>(), true))
+                local_ips.insert(ip);
        }
-        auto & to = local ? this->etcd_local : this->etcd_addresses;
+        std::string etcd_api_path;
+        bool ssl = false;
+        if (etcd_address.substr(0, 8) == "https://")
+        {
+            ssl = true;
+            etcd_address = etcd_address.substr(8);
+        }
+        else if (etcd_address.substr(0, 7) == "http://")
+            etcd_address = etcd_address.substr(7);
+        auto pos = etcd_address.find('/');
+        if (pos != std::string::npos)
+        {
+            etcd_api_path = etcd_address.substr(pos);
+            etcd_address = etcd_address.substr(0, pos);
+        }
+        else
+            etcd_api_path = "/v3";
+        pos = etcd_address.find(':');
+        auto check_addr = (pos != std::string::npos ? etcd_address.substr(0, pos) : etcd_address);
+        bool is_local = local_ips.find(check_addr) != local_ips.end();
+        auto & to = (is_local ? etcd_local : etcd_addresses);
+        check_addr = (ssl ? "https://" : "http://") + etcd_address + etcd_api_path;
+        size_t i;
        for (i = 0; i < to.size(); i++)
        {
-            if (to[i] == addr)
+            if (to[i] == check_addr)
                break;
        }
        if (i >= to.size())
-            to.push_back(addr);
+        {
+            to.push_back(check_addr);
+            // Check if it's a domain name
+            sockaddr_storage ss;
+            bool is_name = !is_local && !string_to_addr(etcd_address, true, 0, &ss);
+            auto & to_addr = (is_local ? etcd_local_addr_urls : (is_name ? etcd_name_urls : etcd_nonlocal_addr_urls));
+            to_addr.push_back((http_url_t){ .ssl = ssl, .addr = etcd_address, .hostname = etcd_address, .path = etcd_api_path });
+        }
    }
 }

@@ -219,6 +227,9 @@ void etcd_state_client_t::parse_config(const json11::Json & config)
 {
    this->etcd_local.clear();
    this->etcd_addresses.clear();
+    this->etcd_local_addr_urls.clear();
+    this->etcd_nonlocal_addr_urls.clear();
+    this->etcd_name_urls.clear();
    if (config["etcd_address"].is_string())
    {
        std::string ea = config["etcd_address"].string_value();
@@ -239,7 +250,19 @@ void etcd_state_client_t::parse_config(const json11::Json & config)
            add_etcd_url(ea.string_value());
        }
    }
+    if (this->osd_num)
+    {
+        this->etcd_client_cert = config["osd_etcd_client_cert"].string_value();
+        this->etcd_client_key = config["osd_etcd_client_key"].string_value();
+    }
+    else
+    {
+        this->etcd_client_cert = config["etcd_client_cert"].string_value();
+        this->etcd_client_key = config["etcd_client_key"].string_value();
+    }
+    this->etcd_ca = config["etcd_ca"].string_value();
    this->etcd_prefix = config["etcd_prefix"].string_value();
+    this->use_auth = config["use_auth"].bool_value();
    if (this->etcd_prefix == "")
    {
        this->etcd_prefix = "/vitastor";
@@ -291,66 +314,130 @@ void etcd_state_client_t::parse_config(const json11::Json & config)
    }
 }

-void etcd_state_client_t::pick_next_etcd()
-{
-    if (selected_etcd_address != "")
-        return;
-    if (addresses_to_try.size() == 0)
-    {
-        // Prefer local etcd, if any
-        for (int i = 0; i < etcd_local.size(); i++)
-            addresses_to_try.push_back(etcd_local[i]);
-        std::vector<int> ns;
-        for (int i = 0; i < etcd_addresses.size(); i++)
-            ns.push_back(i);
-        if (!rand_initialized)
-        {
-            timespec tv;
-            clock_gettime(CLOCK_REALTIME, &tv);
-            srand48(tv.tv_sec*1000000000 + tv.tv_nsec);
-            rand_initialized = true;
-        }
-        while (ns.size())
-        {
-            int i = lrand48() % ns.size();
-            addresses_to_try.push_back(etcd_addresses[ns[i]]);
-            ns.erase(ns.begin()+i, ns.begin()+i+1);
-        }
-    }
-    selected_etcd_address = addresses_to_try[0];
-    addresses_to_try.erase(addresses_to_try.begin(), addresses_to_try.begin()+1);
-}
-
-void etcd_state_client_t::start_etcd_watcher()
+void etcd_state_client_t::pick_next_etcd(std::function<void()> cb)
 {
    if (!etcd_addresses.size() && !etcd_local.size())
    {
        fprintf(stderr, "etcd_address is missing in Vitastor configuration\n");
        exit(1);
    }
-    pick_next_etcd();
-    std::string etcd_address = selected_etcd_address;
-    std::string etcd_api_path;
-    int pos = etcd_address.find('/');
-    if (pos >= 0)
+    if (selected_etcd_url.addr != "")
    {
-        etcd_api_path = etcd_address.substr(pos);
-        etcd_address = etcd_address.substr(0, pos);
+        cb();
+        return;
    }
+    if (etcd_urls_to_try.size() != 0)
+    {
+        selected_etcd_url = std::move(etcd_urls_to_try[0]);
+        etcd_urls_to_try.erase(etcd_urls_to_try.begin());
+        cb();
+        return;
+    }
+    on_resolve_queue.push_back(std::move(cb));
+    if (on_resolve_queue.size() > 1)
+    {
+        // Already resolving
+        return;
+    }
+    assert(!resolve_count);
+    local_to_try = 0;
+    for (auto & url: etcd_local_addr_urls)
+    {
+        // Prefer local IPs, if any
+        etcd_urls_to_try.push_back(url);
+        local_to_try++;
+    }
+    for (auto & url: etcd_nonlocal_addr_urls)
+    {
+        etcd_urls_to_try.push_back(url);
+    }
+    resolve_count++;
+    for (auto & url: etcd_name_urls)
+    {
+        resolve_count++;
+        http_resolve(get_http_ctx(), url.ssl, url.addr, [this, url](const std::string & error, const std::vector<std::string>& addresses)
+        {
+            if (error != "")
+                fprintf(stderr, "Error resolving %s: %s\n", url.addr.c_str(), error.c_str());
+            for (auto & addr: addresses)
+            {
+                auto url_copy = url;
+                url_copy.addr = addr;
+                if (local_ips.find(addr) != local_ips.end())
+                {
+                    etcd_urls_to_try.insert(etcd_urls_to_try.begin(), std::move(url_copy));
+                    local_to_try++;
+                }
+                else
+                    etcd_urls_to_try.push_back(std::move(url_copy));
+            }
+            resolve_count--;
+            if (!resolve_count)
+                pick_next_etcd_on_resolve();
+        });
+    }
+    resolve_count--;
+    if (!resolve_count)
+    {
+        pick_next_etcd_on_resolve();
+    }
+}
+
+void etcd_state_client_t::pick_next_etcd_on_resolve()
+{
+    if (!etcd_urls_to_try.size())
+    {
+        fprintf(stderr, "None of etcd_address could be resolved\n");
+        exit(1);
+    }
+    if (!rand_initialized)
+    {
+        timespec tv;
+        clock_gettime(CLOCK_REALTIME, &tv);
+        srand48(tv.tv_sec*1000000000 + tv.tv_nsec);
+        rand_initialized = true;
+    }
+    // Shuffle addresses
+    for (size_t i = etcd_urls_to_try.size()-1; i > local_to_try; i--)
+    {
+        size_t j = local_to_try + lrand48() % (i - local_to_try);
+        if (j != i)
+            std::swap(etcd_urls_to_try[i], etcd_urls_to_try[j]);
+    }
+    selected_etcd_url = std::move(etcd_urls_to_try[0]);
+    etcd_urls_to_try.erase(etcd_urls_to_try.begin());
+    auto cbs = std::move(on_resolve_queue);
+    for (auto cb: cbs)
+    {
+        cb();
+    }
+}
+
+void etcd_state_client_t::start_etcd_watcher()
+{
+    pick_next_etcd([this]()
+    {
+        start_etcd_watcher_selected();
+    });
+}
+
+void etcd_state_client_t::start_etcd_watcher_selected()
+{
+    const auto & url = selected_etcd_url;
    etcd_watches_initialised = 0;
    ws_alive = 1;
-    if (etcd_watch_ws)
-    {
-        http_close(etcd_watch_ws);
-        etcd_watch_ws = NULL;
-    }
    if (this->log_level > 1)
    {
-        fprintf(stderr, "Trying to connect to etcd websocket at %s, watch from revision %ju/%ju/%ju\n", etcd_address.c_str(),
+        fprintf(stderr, "Trying to connect to etcd websocket at %s%s%s (hostname %s), watch from revision %ju/%ju/%ju\n",
+            url.ssl ? "https://" : "http://", url.addr.c_str(), url.path.c_str(), url.hostname.c_str(),
            etcd_watch_revision_config, etcd_watch_revision_osd, etcd_watch_revision_pg);
    }
-    etcd_watch_ws = open_websocket(tfd, etcd_address, etcd_api_path+"/watch", etcd_slow_timeout,
-        [this, cur_addr = selected_etcd_address](const http_response_t *msg)
+    if (!etcd_watch_ws)
+        etcd_watch_ws = http_init(get_http_ctx());
+    else
+        http_close(etcd_watch_ws);
+    open_websocket(etcd_watch_ws, url.addr, url.hostname, url.path+"/watch", { .timeout = etcd_slow_timeout, .ssl = url.ssl },
+        [this, cur_addr = url.addr](http_message_t *msg)
    {
        if (msg->body.length())
        {
@@ -393,7 +480,6 @@ void etcd_state_client_t::start_etcd_watcher()
                                fprintf(stderr, "Revisions before %ju were compacted by etcd, reloading state\n",
                                    data["result"]["compact_revision"].uint64_value());
                                http_close(etcd_watch_ws);
-                                etcd_watch_ws = NULL;
                                etcd_watch_revision_config = etcd_watch_revision_osd = etcd_watch_revision_pg = 0;
                                on_reload_hook();
                            }
@@ -438,7 +524,7 @@ void etcd_state_client_t::start_etcd_watcher()
                        etcd_watch_revision_pg = watch_rev;
                    else if (watch_id == ETCD_OSD_STATE_WATCH_ID)
                        etcd_watch_revision_osd = watch_rev;
-                    addresses_to_try.clear();
+                    etcd_urls_to_try.clear();
                }
                // First gather all changes into a hash to remove multiple overwrites
                std::map<std::string, etcd_kv_t> changes;
@@ -468,13 +554,8 @@ void etcd_state_client_t::start_etcd_watcher()
        if (msg->eof)
        {
            fprintf(stderr, "Disconnected from etcd %s\n", cur_addr.c_str());
-            if (cur_addr == selected_etcd_address)
-                selected_etcd_address = "";
-            if (etcd_watch_ws)
-            {
-                http_close(etcd_watch_ws);
-                etcd_watch_ws = NULL;
-            }
+            if (cur_addr == selected_etcd_url.addr)
+                selected_etcd_url = (http_url_t){};
            if (etcd_watches_initialised == 0)
            {
                // Connection not established, retry in <etcd_quick_timeout>
@@ -549,12 +630,7 @@ void etcd_state_client_t::start_ws_keepalive()
            {
                if (this->log_level > 0)
                {
-                    fprintf(stderr, "Websocket ping failed, disconnecting from etcd %s\n", selected_etcd_address.c_str());
-                }
-                if (etcd_watch_ws)
-                {
-                    http_close(etcd_watch_ws);
-                    etcd_watch_ws = NULL;
+                    fprintf(stderr, "Websocket ping failed, disconnecting from etcd %s\n", selected_etcd_url.addr.c_str());
                }
                start_etcd_watcher();
            }
@@ -942,6 +1018,8 @@ void etcd_state_client_t::parse_state(const etcd_kv_t & kv)
                pc.used_for_app = "fs:"+pc.used_for_app;
            else
                pc.used_for_app = pool_item.second["used_for_app"].as_string();
+            // Create group permission
+            pc.creator_group = pool_item.second["creator_group"].string_value();
            // Local Read Configuration
            std::string local_reads = pool_item.second["local_reads"].string_value();
            if (local_reads == "nearest")
@@ -1265,33 +1343,7 @@ void etcd_state_client_t::parse_state(const etcd_kv_t & kv)
            }
            else
            {
-                inode_t parent_inode_num = value["parent_id"].uint64_value();
-                if (parent_inode_num && !(parent_inode_num >> (64-POOL_ID_BITS)))
-                {
-                    uint64_t parent_pool_id = value["parent_pool"].uint64_value();
-                    if (!parent_pool_id)
-                        parent_inode_num |= pool_id << (64-POOL_ID_BITS);
-                    else if (parent_pool_id >= POOL_ID_MAX)
-                    {
-                        fprintf(
-                            stderr, "Inode %ju/%ju parent_pool value is invalid, ignoring parent setting\n",
-                            inode_num >> (64-POOL_ID_BITS), inode_num & (((uint64_t)1 << (64-POOL_ID_BITS)) - 1)
-                        );
-                        parent_inode_num = 0;
-                    }
-                    else
-                        parent_inode_num |= parent_pool_id << (64-POOL_ID_BITS);
-                }
-                insert_inode_config((inode_config_t){
-                    .num = inode_num,
-                    .name = value["name"].string_value(),
-                    .size = value["size"].uint64_value(),
-                    .parent_id = parent_inode_num,
-                    .readonly = value["readonly"].bool_value(),
-                    .deleted = value["deleted"].bool_value(),
-                    .meta = value["meta"],
-                    .mod_revision = kv.mod_revision,
-                });
+                insert_inode_config(deserialize_inode_cfg(inode_num, kv.value, kv.mod_revision));
            }
        }
    }
@@ -1302,6 +1354,14 @@ void etcd_state_client_t::parse_state(const etcd_kv_t & kv)
        if (on_change_node_placement_hook)
            on_change_node_placement_hook();
    }
+    else if (use_auth && key.substr(0, etcd_prefix.length()+13) == etcd_prefix+"/config/user/")
+    {
+        // <etcd_prefix>/config/user/<username>
+        if (!value.is_object())
+            user_info.erase(key.substr(etcd_prefix.length()+13));
+        else
+            user_info[key.substr(etcd_prefix.length()+13)] = value;
+    }
 }

 uint32_t etcd_state_client_t::parse_immediate_commit(const std::string & immediate_commit_str, uint32_t default_value)
@@ -1380,6 +1440,10 @@ json11::Json::object etcd_state_client_t::serialize_inode_cfg(inode_config_t *cf
            new_cfg["parent_pool"] = (uint64_t)INODE_POOL(cfg->parent_id);
        new_cfg["parent_id"] = (uint64_t)INODE_NO_POOL(cfg->parent_id);
    }
+    if (!cfg->enc_key.empty())
+    {
+        new_cfg["enc_key"] = cfg->enc_key;
+    }
    if (cfg->readonly)
    {
        new_cfg["readonly"] = true;
@@ -1388,6 +1452,18 @@ json11::Json::object etcd_state_client_t::serialize_inode_cfg(inode_config_t *cf
    {
        new_cfg["deleted"] = true;
    }
+    if (!cfg->owner.empty())
+    {
+        new_cfg["owner"] = cfg->owner;
+    }
+    if (!cfg->owner_group.empty())
+    {
+        new_cfg["owner_group"] = cfg->owner_group;
+    }
+    if (!cfg->reader_group.empty())
+    {
+        new_cfg["reader_group"] = cfg->reader_group;
+    }
    if (cfg->meta.is_object())
    {
        new_cfg["meta"] = cfg->meta;
@@ -1395,6 +1471,53 @@ json11::Json::object etcd_state_client_t::serialize_inode_cfg(inode_config_t *cf
    return new_cfg;
 }

+inode_config_t etcd_state_client_t::deserialize_inode_cfg(uint64_t inode_num, json11::Json value, uint64_t mod_revision)
+{
+    inode_t parent_inode_num = value["parent_id"].uint64_value();
+    if (parent_inode_num && !INODE_POOL(parent_inode_num))
+    {
+        uint64_t parent_pool_id = value["parent_pool"].uint64_value();
+        if (!parent_pool_id)
+            parent_inode_num = INODE_WITH_POOL(INODE_POOL(inode_num), parent_inode_num);
+        else if (parent_pool_id >= POOL_ID_MAX)
+        {
+            fprintf(
+                stderr, "Inode %u/%ju parent_pool value is invalid, ignoring parent setting\n",
+                INODE_POOL(inode_num), INODE_NO_POOL(inode_num)
+            );
+            parent_inode_num = 0;
+        }
+        else
+            parent_inode_num |= parent_pool_id << (64-POOL_ID_BITS);
+    }
+    std::string enc_key;
+    if (!value["enc_key"].is_null())
+    {
+        enc_key = value["enc_key"].string_value();
+        if (enc_key.substr(0, strlen(VAULT_KEY_PREFIX)) != VAULT_KEY_PREFIX &&
+            (enc_key.size() != 2*AES_256_XTS_KEY_SIZE || !ishexstr(enc_key)))
+        {
+            enc_key = "";
+            fprintf(stderr, "Inode %u/%ju has invalid enc_key, should be %u bit hex string or Vault key reference\n",
+                INODE_POOL(inode_num), INODE_NO_POOL(inode_num), AES_256_XTS_KEY_SIZE);
+        }
+    }
+    return (inode_config_t){
+        .num = inode_num,
+        .name = value["name"].string_value(),
+        .size = value["size"].uint64_value(),
+        .parent_id = parent_inode_num,
+        .readonly = value["readonly"].bool_value(),
+        .deleted = value["deleted"].bool_value(),
+        .enc_key = std::move(enc_key),
+        .owner = value["owner"].string_value(),
+        .owner_group = value["owner_group"].string_value(),
+        .reader_group = value["reader_group"].string_value(),
+        .meta = value["meta"],
+        .mod_revision = mod_revision,
+    };
+}
+
 int etcd_state_client_t::address_count()
 {
    return etcd_addresses.size() + etcd_local.size();
@@ -4,6 +4,7 @@
 #pragma once

 #include <set>
+#include <memory>

 #include "json11/json11.hpp"
 #include "object_id.h"
@@ -19,6 +20,8 @@
 #define MAX_DATA_BLOCK_SIZE 128*1024*1024
 #define DEFAULT_BITMAP_GRANULARITY 4096

+#define VAULT_KEY_PREFIX "vault:"
+
 #ifndef IMMEDIATE_NONE
 #define IMMEDIATE_NONE 0
 #define IMMEDIATE_SMALL 1
@@ -66,6 +69,7 @@ struct pool_config_t
    std::map<pg_num_t, pg_config_t> pg_config;
    uint64_t scrub_interval = 0;
    std::string used_for_app;
+    std::string creator_group;
    int backfillfull = 0;
    int local_reads = 0;

@@ -83,6 +87,9 @@ struct inode_config_t
    inode_t parent_id = 0;
    bool readonly = false;
    bool deleted = false;
+    std::string enc_key;
+    // Permissions
+    std::string owner, owner_group, reader_group;
    // Arbitrary metadata
    json11::Json meta;
    // Change revision of the metadata in etcd
@@ -95,23 +102,41 @@ struct inode_watch_t
    inode_config_t cfg = {};
 };

+struct http_url_t
+{
+    bool ssl;
+    std::string addr;
+    std::string hostname;
+    std::string path;
+};
+
 struct http_co_t;
+struct http_context_t;

 struct __attribute__((visibility("default"))) etcd_state_client_t
 {
 protected:
-    std::vector<std::string> local_ips;
-    std::vector<std::string> etcd_addresses;
+    std::set<std::string> local_ips;
    std::vector<std::string> etcd_local;
-    std::string selected_etcd_address;
-    std::vector<std::string> addresses_to_try;
+    std::vector<std::string> etcd_addresses;
+    std::vector<http_url_t> etcd_local_addr_urls;
+    std::vector<http_url_t> etcd_nonlocal_addr_urls;
+    std::vector<http_url_t> etcd_name_urls;
+    size_t local_to_try = 0;
+    std::vector<http_url_t> etcd_urls_to_try;
+    http_url_t selected_etcd_url;
+    size_t resolve_count = 0;
    std::vector<inode_watch_t*> watches;
+    std::vector<std::function<void()>> on_resolve_queue;
    bool new_pg_config = false;
    int ws_keepalive_timer = -1;
    int ws_alive = 0;
    bool rand_initialized = false;
    void add_etcd_url(std::string);
-    void pick_next_etcd();
+    void pick_next_etcd(std::function<void()> cb);
+    void pick_next_etcd_on_resolve();
+    void etcd_call_selected(const std::string & api, json11::Json payload, int timeout, int retries, int interval, std::function<void(std::string, json11::Json)> callback);
+    void start_etcd_watcher_selected();
 public:
    int etcd_keepalive_timeout = 30;
    int etcd_ws_keepalive_interval = 5;
@@ -120,14 +145,20 @@ public:
    int etcd_slow_timeout = 5000;
    int etcd_min_reload_interval = 1000;
    bool infinite_start = true;
+    bool use_auth = false;
    uint64_t global_block_size = DEFAULT_BLOCK_SIZE;
    uint32_t global_bitmap_granularity = DEFAULT_BITMAP_GRANULARITY;
    uint32_t global_immediate_commit = IMMEDIATE_NONE;

+    uint64_t osd_num = 0;
    std::string etcd_prefix;
+    std::string etcd_client_cert;
+    std::string etcd_client_key;
+    std::string etcd_ca;
    int log_level = 0;
    timerfd_manager_t *tfd = NULL;

+    http_context_t *http_ctx = NULL;
    http_co_t *etcd_watch_ws = NULL, *keepalive_client = NULL;
    int etcd_watches_initialised = 0;
    uint64_t etcd_watch_revision_config = 0;
@@ -140,6 +171,7 @@ public:
    std::set<osd_num_t> seen_peers;
    std::map<inode_t, inode_config_t> inode_config;
    std::map<std::string, inode_t> inode_by_name;
+    std::map<std::string, json11::Json> user_info;
    json11::Json node_placement;

    std::function<void(std::map<std::string, etcd_kv_t> &)> on_change_hook;
@@ -158,10 +190,12 @@ public:
    std::function<void(http_co_t *)> on_start_watcher_hook;

    json11::Json::object serialize_inode_cfg(inode_config_t *cfg);
+    inode_config_t deserialize_inode_cfg(uint64_t inode_num, json11::Json value, uint64_t mod_revision);
    etcd_kv_t parse_etcd_kv(const json11::Json & kv_json);
    std::vector<std::string> get_addresses();
-    void etcd_call_oneshot(std::string etcd_address, std::string api, json11::Json payload, int timeout, std::function<void(std::string, json11::Json)> callback);
-    void etcd_call(std::string api, json11::Json payload, int timeout, int retries, int interval, std::function<void(std::string, json11::Json)> callback);
+    http_context_t *get_http_ctx();
+    void etcd_call_oneshot(const std::string & etcd_address, const std::string & api, json11::Json payload, int timeout, std::function<void(std::string, json11::Json)> callback);
+    void etcd_call(const std::string & api, json11::Json payload, int timeout, int retries, int interval, std::function<void(std::string, json11::Json)> callback);
    void etcd_txn(json11::Json txn, int timeout, int retries, int interval, std::function<void(std::string, json11::Json)> callback);
    void etcd_txn_slow(json11::Json txn, std::function<void(std::string, json11::Json)> callback);
    void start_etcd_watcher();
@@ -17,14 +17,19 @@

 class timerfd_manager_t;

+#pragma GCC visibility push(default)
+
 struct http_options_t
 {
    int timeout;
    bool want_streaming;
    bool keepalive;
+    bool ssl;
 };

-struct http_response_t
+struct http_context_t;
+
+struct http_message_t
 {
    std::string error;

@@ -41,10 +46,26 @@ struct http_response_t
 // Opened websocket or keepalive HTTP connection
 struct http_co_t;

-http_co_t* http_init(timerfd_manager_t *tfd);
-http_co_t* open_websocket(timerfd_manager_t *tfd, const std::string & host, const std::string & path,
-    int timeout, std::function<void(const http_response_t *msg)> on_message);
+http_context_t* http_context_init(timerfd_manager_t *tfd, const std::string & ssl_cert, const std::string & ssl_key,
+    const std::string & ssl_ca, bool verify_peer, std::string & error);
+std::string http_context_get_ssl_cn(http_context_t *ctx);
+void http_resolve(http_context_t *ctx, bool ssl, std::string host,
+    std::function<void(const std::string & error, const std::vector<std::string> & addrs)> cb);
+void http_context_destroy(http_context_t *ctx);
+http_co_t* http_init(http_context_t *ctx = NULL);
+void open_websocket(http_co_t *handler, const std::string & addr, const std::string & hostname, const std::string & path,
+    const http_options_t & options, std::function<void(http_message_t *msg)> on_message);
 void http_request(http_co_t *handler, const std::string & host, const std::string & request,
-    const http_options_t & options, std::function<void(const http_response_t *response)> response_callback);
+    const http_options_t & options, std::function<void(http_message_t *response)> response_callback);
+void http_get(http_co_t *handler, const std::string & url, const std::string & headers,
+    const http_options_t & options, std::function<void(http_message_t *response)> response_callback);
+void http_json_post(http_co_t *handler, const std::string & url, json11::Json body, const std::string & headers,
+    const http_options_t & options, std::function<void(http_message_t *response)> response_callback);
 void http_post_message(http_co_t *handler, uint8_t type, const std::string & msg);
+void http_serve(http_co_t *handler, int peer_fd, const http_options_t & options,
+    std::function<void(http_message_t *msg)> request_callback);
+void http_reply(http_co_t *handler, const std::string & reply);
 void http_close(http_co_t *co);
+void http_destroy(http_co_t *co);
+
+#pragma GCC visibility pop
@@ -182,12 +182,13 @@ void osd_messenger_t::init()
    }
    keepalive_timer_id = tfd->set_timer(1000, true, [this](int)
    {
+        std::vector<uint64_t> clients_to_stop;
+        std::vector<osd_op_t*> ops_to_send;
        auto cl_it = clients.begin();
        while (cl_it != clients.end())
        {
            auto cl = cl_it->second;
            cl_it++;
-            auto peer_fd = cl->peer_fd;
            if (!cl->osd_num && !cl->in_osd_num || cl->peer_state != PEER_CONNECTED && cl->peer_state != PEER_RDMA)
            {
                // Do not run keepalive on regular clients
@@ -199,10 +200,9 @@ void osd_messenger_t::init()
                if (!cl->ping_time_remaining)
                {
                    // Ping timed out, stop the client
-                    fprintf(stderr, "Ping timed out for OSD %ju (client %d), disconnecting peer\n", cl->in_osd_num ? cl->in_osd_num : cl->osd_num, cl->peer_fd);
-                    stop_client(peer_fd, true);
-                    // Restart iterator because it may be invalidated
-                    cl_it = clients.upper_bound(peer_fd);
+                    fprintf(stderr, "Ping timed out for OSD %ju (client %ju), disconnecting peer\n",
+                        cl->in_osd_num ? cl->in_osd_num : cl->osd_num, cl->client_id);
+                    clients_to_stop.push_back(cl->client_id);
                }
            }
            else if (cl->idle_time_remaining > 0)
@@ -213,7 +213,7 @@ void osd_messenger_t::init()
                    // Connection is idle for <osd_idle_time>, send ping
                    osd_op_t *op = new osd_op_t();
                    op->op_type = OSD_OP_OUT;
-                    op->peer_fd = cl->peer_fd;
+                    op->client_id = cl->client_id;
                    op->req = (osd_any_op_t){
                        .hdr = {
                            .magic = SECONDARY_OSD_OP_MAGIC,
@@ -222,28 +222,26 @@ void osd_messenger_t::init()
                    };
                    op->callback = [this, cl](osd_op_t *op)
                    {
-                        auto cl_it = clients.find(op->peer_fd);
-                        if (cl_it == clients.end() || cl_it->second != cl)
+                        auto cl_it = clients.find(op->client_id);
+                        if (cl_it == clients.end())
                        {
                            // client is already dropped
                            delete op;
                            return;
                        }
-                        int fail_fd = (op->reply.hdr.retval != 0 ? op->peer_fd : -1);
+                        uint64_t fail_client_id = (op->reply.hdr.retval != 0 ? op->client_id : 0);
                        auto fail_osd_num = cl->in_osd_num ? cl->in_osd_num : cl->osd_num;
                        cl->ping_time_remaining = 0;
                        delete op;
-                        if (fail_fd >= 0)
+                        if (fail_client_id)
                        {
-                            fprintf(stderr, "Ping failed for OSD %ju (client %d), disconnecting peer\n", fail_osd_num, fail_fd);
-                            stop_client(fail_fd, true);
+                            fprintf(stderr, "Ping failed for OSD %ju (client %ju), disconnecting peer\n", fail_osd_num, fail_client_id);
+                            stop_client(fail_client_id);
                        }
                    };
                    cl->ping_time_remaining = osd_ping_timeout;
                    cl->idle_time_remaining = osd_idle_timeout;
-                    outbox_push(op);
-                    // Restart iterator because it may be invalidated
-                    cl_it = clients.upper_bound(peer_fd);
+                    ops_to_send.push_back(op);
                }
            }
            else
@@ -251,6 +249,14 @@ void osd_messenger_t::init()
                cl->idle_time_remaining = osd_idle_timeout;
            }
        }
+        for (uint64_t client_id: clients_to_stop)
+        {
+            stop_client(client_id);
+        }
+        for (osd_op_t *op: ops_to_send)
+        {
+            outbox_push(op);
+        }
    });
 }

@@ -263,7 +269,7 @@ osd_messenger_t::~osd_messenger_t()
    }
    while (clients.size() > 0)
    {
-        stop_client(clients.begin()->first, true, true);
+        stop_client(clients.begin()->first, true);
    }
    if (iothreads.size())
    {
@@ -289,6 +295,14 @@ osd_messenger_t::~osd_messenger_t()
        rdmacm_evch = NULL;
    }
 #endif
+    for (auto encrypt_ctx: encrypt_ctx_pool)
+    {
+        destroy_aes_xts_encrypt(encrypt_ctx);
+    }
+    for (auto decrypt_ctx: decrypt_ctx_pool)
+    {
+        destroy_aes_xts_decrypt(decrypt_ctx);
+    }
 }

 void osd_messenger_t::parse_config(const json11::Json & config)
@@ -323,6 +337,10 @@ void osd_messenger_t::parse_config(const json11::Json & config)
    if (!this->rdma_max_msg || this->rdma_max_msg > 128*1024*1024)
        this->rdma_max_msg = 129*1024;
 #endif
+    this->max_aes_xts_pool_size = config["max_aes_xts_pool_size"].uint64_value();
+    if (!this->max_aes_xts_pool_size)
+        this->max_aes_xts_pool_size = 256;
+    this->use_proto_checksums = config["use_proto_checksums"].is_null() || config["use_proto_checksums"].bool_value();
    if (!osd_num)
        this->iothread_count = (uint32_t)config["client_iothread_count"].uint64_value();
    else
@@ -440,7 +458,7 @@ void osd_messenger_t::try_connect_peer(uint64_t peer_osd)
    {
        return;
    }
-    if (osd_peer_fds.find(peer_osd) != osd_peer_fds.end())
+    if (osd_peers.find(peer_osd) != osd_peers.end())
    {
        wanted_peers.erase(peer_osd);
        return;
@@ -467,20 +485,20 @@ void osd_messenger_t::try_connect_peer_tcp(osd_num_t peer_osd, const char *peer_
 #ifdef WITH_RDMACM
    if (disable_tcp)
    {
-        on_connect_peer(peer_osd, -EINVAL);
+        on_connect_peer(peer_osd, -EINVAL, 0);
        return;
    }
 #endif
    struct sockaddr_storage addr;
    if (!string_to_addr(peer_host, 0, peer_port, &addr))
    {
-        on_connect_peer(peer_osd, -EINVAL);
+        on_connect_peer(peer_osd, -EINVAL, 0);
        return;
    }
    int peer_fd = socket(addr.ss_family, SOCK_STREAM, 0);
    if (peer_fd < 0)
    {
-        on_connect_peer(peer_osd, -errno);
+        on_connect_peer(peer_osd, -errno, 0);
        return;
    }
    fcntl(peer_fd, F_SETFL, fcntl(peer_fd, F_GETFL, 0) | O_NONBLOCK);
@@ -488,21 +506,25 @@ void osd_messenger_t::try_connect_peer_tcp(osd_num_t peer_osd, const char *peer_
    if (r < 0 && errno != EINPROGRESS)
    {
        close(peer_fd);
-        on_connect_peer(peer_osd, -errno);
+        on_connect_peer(peer_osd, -errno, 0);
        return;
    }
-    clients[peer_fd] = new osd_client_t();
+    const uint64_t client_id = next_client_id++;
+    osd_client_t *cl = new osd_client_t();
    if (log_level > 0)
    {
-        fprintf(stderr, "Connecting to OSD %ju at %s:%d (client %d)\n", peer_osd, peer_host, peer_port, peer_fd);
+        fprintf(stderr, "Connecting to OSD %ju at %s:%d (client %ju, FD %d)\n", peer_osd, peer_host, peer_port, client_id, peer_fd);
    }
-    clients[peer_fd]->peer_addr = addr;
-    clients[peer_fd]->peer_port = peer_port;
-    clients[peer_fd]->peer_fd = peer_fd;
-    clients[peer_fd]->peer_state = PEER_CONNECTING;
-    clients[peer_fd]->connect_timeout_id = -1;
-    clients[peer_fd]->osd_num = peer_osd;
-    clients[peer_fd]->in_buf = malloc_or_die(receive_buffer_size);
+    cl->client_id = client_id;
+    cl->peer_addr = addr;
+    cl->peer_port = peer_port;
+    cl->peer_fd = peer_fd;
+    cl->peer_state = PEER_CONNECTING;
+    cl->connect_timeout_id = -1;
+    cl->osd_num = peer_osd;
+    cl->in_buf = (uint8_t*)malloc_or_die(receive_buffer_size);
+    clients[client_id] = cl;
+    clients_by_fd[peer_fd] = cl;
    tfd->set_fd_handler(peer_fd, true, [this](int peer_fd, int epoll_events)
    {
        // Either OUT (connected) or HUP
@@ -510,11 +532,11 @@ void osd_messenger_t::try_connect_peer_tcp(osd_num_t peer_osd, const char *peer_
    });
    if (peer_connect_timeout > 0)
    {
-        clients[peer_fd]->connect_timeout_id = tfd->set_timer(1000*peer_connect_timeout, false, [this, peer_fd](int timer_id)
+        cl->connect_timeout_id = tfd->set_timer(1000*peer_connect_timeout, false, [this, client_id](int timer_id)
        {
-            osd_num_t peer_osd = clients.at(peer_fd)->osd_num;
-            stop_client(peer_fd, true);
-            on_connect_peer(peer_osd, -EPIPE);
+            osd_num_t peer_osd = clients.at(client_id)->osd_num;
+            stop_client(client_id);
+            on_connect_peer(peer_osd, -EPIPE, 0);
            return;
        });
    }
@@ -522,7 +544,7 @@ void osd_messenger_t::try_connect_peer_tcp(osd_num_t peer_osd, const char *peer_

 void osd_messenger_t::handle_connect_epoll(int peer_fd)
 {
-    auto cl = clients[peer_fd];
+    auto cl = clients_by_fd.at(peer_fd);
    if (cl->connect_timeout_id >= 0)
    {
        tfd->clear_timer(cl->connect_timeout_id);
@@ -537,8 +559,8 @@ void osd_messenger_t::handle_connect_epoll(int peer_fd)
    }
    if (result != 0)
    {
-        stop_client(peer_fd, true);
-        on_connect_peer(peer_osd, -result);
+        stop_client(cl->client_id);
+        on_connect_peer(peer_osd, -result, 0);
        return;
    }
    int one = 1;
@@ -555,23 +577,23 @@ void osd_messenger_t::handle_connect_epoll(int peer_fd)
 void osd_messenger_t::handle_peer_epoll(int peer_fd, int epoll_events)
 {
    // Mark client as ready (i.e. some data is available)
+    auto cl = clients_by_fd.at(peer_fd);
    if (epoll_events & EPOLLRDHUP)
    {
        // Stop client
        if (log_level > 0)
        {
-            fprintf(stderr, "[OSD %ju] client %d disconnected\n", this->osd_num, peer_fd);
+            fprintf(stderr, "[OSD %ju] client %ju disconnected\n", this->osd_num, cl->client_id);
        }
-        stop_client(peer_fd, true);
+        stop_client(cl->client_id);
    }
    else if (epoll_events & EPOLLIN)
    {
        // Mark client as ready (i.e. some data is available)
-        auto cl = clients[peer_fd];
        cl->read_ready++;
        if (cl->read_ready == 1)
        {
-            read_ready_clients.push_back(cl->peer_fd);
+            read_ready_clients.push_back(cl->client_id);
            if (ringloop)
                ringloop->wakeup();
            else
@@ -580,13 +602,13 @@ void osd_messenger_t::handle_peer_epoll(int peer_fd, int epoll_events)
    }
 }

-void osd_messenger_t::on_connect_peer(osd_num_t peer_osd, int peer_fd)
+void osd_messenger_t::on_connect_peer(osd_num_t peer_osd, int errcode, uint64_t client_id)
 {
    auto & wp = wanted_peers.at(peer_osd);
    wp.connecting = false;
-    if (peer_fd < 0)
+    if (errcode < 0)
    {
-        fprintf(stderr, "Failed to connect to peer OSD %ju address %s port %d: %s\n", peer_osd, wp.cur_addr.c_str(), wp.cur_port, strerror(-peer_fd));
+        fprintf(stderr, "Failed to connect to peer OSD %ju address %s port %d: %s\n", peer_osd, wp.cur_addr.c_str(), wp.cur_port, strerror(-errcode));
        if (wp.address_changed)
        {
            wp.address_changed = false;
@@ -613,7 +635,7 @@ void osd_messenger_t::on_connect_peer(osd_num_t peer_osd, int peer_fd)
    }
    if (log_level > 0)
    {
-        fprintf(stderr, "[OSD %ju] Connected with peer OSD %ju (client %d)\n", osd_num, peer_osd, peer_fd);
+        fprintf(stderr, "[OSD %ju] Connected with peer OSD %ju (client %ju)\n", osd_num, peer_osd, client_id);
    }
    wanted_peers.erase(peer_osd);
    repeer_pgs(peer_osd);
@@ -623,7 +645,7 @@ void osd_messenger_t::check_peer_config(osd_client_t *cl)
 {
    osd_op_t *op = new osd_op_t();
    op->op_type = OSD_OP_OUT;
-    op->peer_fd = cl->peer_fd;
+    op->client_id = cl->client_id;
    op->req = (osd_any_op_t){
        .show_conf = {
            .header = {
@@ -638,7 +660,12 @@ void osd_messenger_t::check_peer_config(osd_client_t *cl)
        // Inform that we're OSD <osd_num>
        payload["osd_num"] = osd_num;
    }
-    payload["features"] = json11::Json::object{ { "check_sequencing", true } };
+    auto features = json11::Json::object{ { "check_sequencing", true } };
+    if (use_proto_checksums)
+    {
+        features["proto_checksums"] = true;
+    }
+    payload["features"] = features;
 #ifdef WITH_RDMA
    if (!use_rdmacm && rdma_contexts.size())
    {
@@ -647,7 +674,7 @@ void osd_messenger_t::check_peer_config(osd_client_t *cl)
        if (!selected_ctx)
        {
            if (log_level > 0)
-                fprintf(stderr, "No RDMA context for OSD %ju connection (peer %d), using only TCP\n", cl->osd_num, cl->peer_fd);
+                fprintf(stderr, "No RDMA context for OSD %ju connection (client %ju), using only TCP\n", cl->osd_num, cl->client_id);
        }
        else
        {
@@ -708,11 +735,15 @@ void osd_messenger_t::check_peer_config(osd_client_t *cl)
        if (err)
        {
            osd_num_t peer_osd = cl->osd_num;
-            stop_client(op->peer_fd);
-            on_connect_peer(peer_osd, -EINVAL);
+            stop_client(op->client_id);
+            on_connect_peer(peer_osd, -EINVAL, 0);
            delete op;
            return;
        }
+        if (use_proto_checksums && config["features"]["proto_checksums"].bool_value())
+        {
+            cl->proto_csum_status = MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT;
+        }
 #ifdef WITH_RDMA
        if (!use_rdmacm && cl->rdma_conn && config["rdma_address"].is_string())
        {
@@ -744,8 +775,8 @@ void osd_messenger_t::check_peer_config(osd_client_t *cl)
            }
        }
 #endif
-        osd_peer_fds[cl->osd_num] = cl->peer_fd;
-        on_connect_peer(cl->osd_num, cl->peer_fd);
+        osd_peers[cl->osd_num] = cl;
+        on_connect_peer(cl->osd_num, 0, cl->client_id);
        delete op;
    };
    outbox_push(op);
@@ -760,20 +791,23 @@ void osd_messenger_t::accept_connections(int listen_fd)
    while ((peer_fd = accept(listen_fd, (sockaddr*)&addr, &peer_addr_size)) >= 0)
    {
        assert(peer_fd != 0);
-        fprintf(stderr, "[OSD %ju] new client %d: connection from %s\n", this->osd_num, peer_fd,
+        const uint64_t client_id = next_client_id++;
+        fprintf(stderr, "[OSD %ju] new client %ju (FD %d): connection from %s\n", this->osd_num, client_id, peer_fd,
            addr_to_string(addr).c_str());
        fcntl(peer_fd, F_SETFL, fcntl(peer_fd, F_GETFL, 0) | O_NONBLOCK);
        int one = 1;
        setsockopt(peer_fd, SOL_TCP, TCP_NODELAY, &one, sizeof(one));
        auto cl = new osd_client_t();
-        clients[peer_fd] = cl;
+        cl->client_id = client_id;
+        clients[cl->client_id] = cl;
+        clients_by_fd[peer_fd] = cl;
        cl->is_incoming = true;
        cl->peer_addr = addr;
        cl->peer_addr = addr;
        cl->peer_port = ntohs(((sockaddr_in*)&addr)->sin_port);
        cl->peer_fd = peer_fd;
        cl->peer_state = PEER_CONNECTED;
-        cl->in_buf = malloc_or_die(receive_buffer_size);
+        cl->in_buf = (uint8_t*)malloc_or_die(receive_buffer_size);
        // Add FD to epoll
        tfd->set_fd_handler(peer_fd, false, [this](int peer_fd, int epoll_events)
        {
@@ -12,6 +12,8 @@
 #include <deque>
 #include <vector>

+#include "../util/xxh_x86dispatch.h"
+#include "../util/robin_hood.h"
 #include "malloc_or_die.h"
 #include "json11/json11.hpp"
 #include "msgr_op.h"
@@ -30,13 +32,13 @@
 #define PEER_RDMA 4
 #define PEER_STOPPED 5

+#define MSGR_PEER_CSUM_IN 1
+#define MSGR_PEER_CSUM_OUT 2
+
 #define VITASTOR_CONFIG_PATH "/etc/vitastor/vitastor.conf"

 #define DEFAULT_MIN_ZEROCOPY_SEND_SIZE 32*1024

-#define MSGR_SENDP_HDR 1
-#define MSGR_SENDP_FREE 2
-
 struct msgr_sendp_t
 {
    osd_op_t *op;
@@ -48,8 +50,14 @@ struct msgr_rdma_connection_t;
 struct msgr_rdma_context_t;
 #endif

+struct op_aes_xts_encrypt_t;
+struct op_aes_xts_decrypt_t;
+void destroy_aes_xts_encrypt(op_aes_xts_encrypt_t *encrypt_ctx);
+void destroy_aes_xts_decrypt(op_aes_xts_decrypt_t *decrypt_ctx);
+
 struct osd_client_t
 {
+    uint64_t client_id = 0;
    int refs = 0;

    sockaddr_storage peer_addr = {};
@@ -63,7 +71,7 @@ struct osd_client_t
    osd_num_t in_osd_num = 0;
    bool is_incoming = false;

-    void *in_buf = NULL;
+    uint8_t *in_buf = NULL;

 #ifdef WITH_RDMA
    msgr_rdma_connection_t *rdma_conn = NULL;
@@ -72,31 +80,43 @@ struct osd_client_t
    // Read state
    int read_ready = 0;
    osd_op_t *read_op = NULL;
+    size_t read_op_size = 0;
+    size_t read_op_pos = 0;
    iovec read_iov = { 0 };
    msghdr read_msg = { 0 };
-    int read_remaining = 0;
-    int read_state = 0;
-    osd_op_buf_list_t recv_list;
+    std::vector<iovec> recv_list;
+    size_t recv_list_size = 0;
    uint64_t read_op_id = 1;
    bool check_sequencing = false;
    bool enable_pg_locks = false;
+    op_aes_xts_decrypt_t *decrypt_ctx = NULL;
+    size_t read_op_inline_decrypt_pos = 0;
+    size_t read_op_inline_decrypt_in = 0;
+    int proto_csum_status = 0;
+    XXH3_state_t* read_csum_state = NULL;

    // Incoming operations
    std::vector<osd_op_t*> received_ops;

    // Outbound operations
-    std::map<uint64_t, osd_op_t*> sent_ops;
+    robin_hood::unordered_flat_map<uint64_t, osd_op_t*> sent_ops;
    uint64_t send_op_id = 0;

    // PGs dirtied by this client's primary-writes
    std::set<pool_pg_num_t> dirty_pgs;

    // Write state
+    std::deque<osd_op_t *> write_ops;
+    osd_op_t *write_op = NULL;
+    size_t write_op_pos = 0;
    msghdr write_msg = { 0 };
    int write_state = 0;
-    std::vector<iovec> send_list, next_send_list;
-    std::vector<msgr_sendp_t> outbox, next_outbox;
+    std::vector<iovec> send_list;
+    size_t send_list_size = 0;
+    std::deque<osd_op_t*> send_free_ops;
    std::vector<osd_op_t*> zc_free_list;
+    op_aes_xts_encrypt_t *encrypt_ctx = NULL;
+    XXH3_state_t* write_csum_state = NULL;

    ~osd_client_t();
    void cancel_ops();
@@ -188,6 +208,7 @@ protected:
    bool use_sync_send_recv = false;
    int min_zerocopy_send_size = DEFAULT_MIN_ZEROCOPY_SEND_SIZE;
    int iothread_count = 0;
+    int max_aes_xts_pool_size = 256;

 #ifdef WITH_RDMA
    bool use_rdma = true;
@@ -201,38 +222,45 @@ protected:
    uint64_t rdma_max_sge = 0, rdma_max_send = 0, rdma_max_recv = 0;
    uint64_t rdma_max_msg = 0;
    rdma_event_channel *rdmacm_evch = NULL;
-    std::map<rdma_cm_id*, osd_client_t*> rdmacm_connections;
-    std::map<rdma_cm_id*, rdmacm_connecting_t*> rdmacm_connecting;
+    robin_hood::unordered_flat_map<rdma_cm_id*, osd_client_t*> rdmacm_connections;
+    robin_hood::unordered_flat_map<rdma_cm_id*, rdmacm_connecting_t*> rdmacm_connecting;
 #endif

    std::vector<msgr_iothread_t*> iothreads;
-    std::vector<int> read_ready_clients;
-    std::vector<int> write_ready_clients;
+    std::vector<uint64_t> read_ready_clients;
+    std::vector<uint64_t> write_ready_clients;
    // We don't use ringloop->set_immediate here because we may have no ringloop in client :)
    std::deque<osd_op_t*> set_immediate_ops;

+    std::vector<op_aes_xts_encrypt_t*> encrypt_ctx_pool;
+    std::vector<op_aes_xts_decrypt_t*> decrypt_ctx_pool;
+
 public:
    timerfd_manager_t *tfd = NULL;
    ring_loop_t *ringloop = NULL;
    bool has_sendmsg_zc = false;
    // osd_num_t is only for logging and asserts
+    uint64_t next_client_id = 1;
    osd_num_t osd_num;
-    std::map<int, osd_client_t*> clients;
-    std::map<osd_num_t, osd_wanted_peer_t> wanted_peers;
-    std::map<uint64_t, int> osd_peer_fds;
+    robin_hood::unordered_flat_map<uint64_t, osd_client_t*> clients;
+    robin_hood::unordered_flat_map<uint64_t, osd_client_t*> osd_peers;
+    robin_hood::unordered_flat_map<int, osd_client_t*> clients_by_fd;
+    robin_hood::unordered_flat_map<osd_num_t, osd_wanted_peer_t> wanted_peers;
    std::vector<std::string> osd_networks;
    std::vector<addr_mask_t> osd_network_masks;
    std::vector<std::string> osd_cluster_networks;
    std::vector<addr_mask_t> osd_cluster_network_masks;
    std::vector<std::string> all_osd_networks;
    std::vector<addr_mask_t> all_osd_network_masks;
+    bool use_proto_checksums = true;
    // op statistics
    osd_op_stats_t stats, recovery_stats;

    void init();
    void parse_config(const json11::Json & config);
    void connect_peer(uint64_t osd_num, json11::Json peer_state);
-    void stop_client(int peer_fd, bool force = false, bool force_delete = false);
+    void stop_client(uint64_t client_id, bool force_delete = false);
+    void destroy_client(osd_client_t *cl);
    void outbox_push(osd_op_t *cur_op);
    std::function<void(osd_op_t*)> exec_op;
    std::function<void(osd_num_t)> repeer_pgs;
@@ -251,7 +279,7 @@ public:

 #ifdef WITH_RDMA
    bool is_rdma_enabled();
-    bool connect_rdma(int peer_fd, std::string rdma_address, uint64_t client_max_msg);
+    bool connect_rdma(uint64_t client_id, std::string rdma_address, uint64_t client_max_msg);
 #endif
 #ifdef WITH_RDMACM
    bool is_use_rdmacm();
@@ -267,25 +295,36 @@ protected:
    void try_connect_peer_tcp(osd_num_t peer_osd, const char *peer_host, int peer_port);
    void handle_peer_epoll(int peer_fd, int epoll_events);
    void handle_connect_epoll(int peer_fd);
-    void on_connect_peer(osd_num_t peer_osd, int peer_fd);
+    void on_connect_peer(osd_num_t peer_osd, int errcode, uint64_t client_id);
    void check_peer_config(osd_client_t *cl);
    void cancel_osd_ops(osd_client_t *cl);
    void cancel_op(osd_op_t *op);

    bool try_send(osd_client_t *cl);
    void handle_send(int result, bool prev, bool more, osd_client_t *cl);
+    size_t op_copy_to(osd_client_t *cl, uint8_t *dst, size_t dst_len);
+    void op_get_write_buffers(osd_client_t *cl, std::vector<iovec> & lst);

-    bool handle_read(int result, osd_client_t *cl);
-    bool handle_read_buffer(osd_client_t *cl, void *curbuf, int remain);
-    bool handle_finished_read(osd_client_t *cl);
-    void handle_op_hdr(osd_client_t *cl);
-    bool handle_reply_hdr(osd_client_t *cl);
-    void handle_reply_ready(osd_op_t *op);
+    void handle_read(int result, osd_client_t *cl);
+    bool handle_read_buffer(osd_client_t *cl, uint8_t *curbuf, size_t bufsize);
+    bool handle_hdr(osd_client_t *cl);
+    bool allocate_op_buffers(osd_client_t *cl);
+    bool allocate_reply_buffers(osd_client_t *cl, osd_op_t *op);
+    bool op_copy_from(osd_client_t *cl, uint8_t *src, size_t src_len, size_t & done);
+    void op_get_read_buffers(osd_client_t *cl, std::vector<iovec> & lst);
+    void op_alloc_temp_buffers(osd_op_t *op, int i);
+    bool handle_finished_op(osd_client_t *cl);
    void handle_immediate_ops();
-    void clear_immediate_ops(int peer_fd);
+
+    bool op_encrypted_copy_data_to(osd_client_t* cl, uint8_t *buf, size_t len, size_t from, size_t & done);
+    bool op_decrypted_copy_data_from(osd_client_t* cl, uint8_t *buf, size_t len, size_t from, size_t & done);
+    void op_decrypt_start(osd_client_t* cl);
+    void op_decrypt_inline(osd_client_t* cl);
+    void op_decrypt_free(osd_client_t* cl);

 #ifdef WITH_RDMA
    void try_send_rdma(osd_client_t *cl);
+    int try_send_rdma_copy(osd_client_t *cl, uint8_t *dst, int dst_len);
    bool init_recv_rdma(osd_client_t *cl);
    void handle_rdma_events(msgr_rdma_context_t *rdma_context);
    msgr_rdma_context_t* choose_rdma_context(osd_client_t *cl);
@@ -0,0 +1,484 @@
+// Copyright (c) Vitaliy Filippov, 2026+
+// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
+
+#include <assert.h>
+
+#include "etcd_state_client.h"
+#include "messenger.h"
+#include "msgr_encrypt.h"
+
+op_aes_xts_encrypt_t::op_aes_xts_encrypt_t()
+{
+#ifdef WITH_OPENSSL
+    if (!(ctx = EVP_CIPHER_CTX_new()))
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    EVP_CIPHER_CTX_set_padding(ctx, 0);
+    if (EVP_EncryptInit_ex(ctx, EVP_aes_256_xts(), NULL, NULL, NULL) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+#else
+    fprintf(stderr, "Error: Vitastor is built without encryption support\n");
+    abort();
+#endif
+}
+
+op_aes_xts_encrypt_t::~op_aes_xts_encrypt_t()
+{
+    assert(!encrypted);
+#ifdef WITH_OPENSSL
+    EVP_CIPHER_CTX_free(ctx);
+#endif
+    if (tmp)
+        free(tmp);
+}
+
+void op_aes_xts_encrypt_t::start(uint8_t *key, uint64_t start_offset, size_t block_size)
+{
+    assert(!encrypted);
+    this->start_offset = start_offset;
+    this->key = key;
+    this->block_size = block_size;
+    this->offset = 0;
+    this->encrypted = false;
+    this->tmp_pos = 0;
+    if (tmp && tmp_size != block_size)
+    {
+        free(tmp);
+        tmp = NULL;
+        tmp_size = 0;
+    }
+#ifdef WITH_OPENSSL
+    if (EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+#endif
+}
+
+void op_aes_xts_encrypt_t::encrypt_block(uint8_t *in, uint8_t *out)
+{
+#ifdef WITH_OPENSSL
+    uint8_t iv[16] = { 0 };
+    *((uint64_t*)iv) = start_offset + offset - offset%block_size;
+    if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    int actual_out = 0;
+    if (EVP_EncryptUpdate(ctx, out, &actual_out, in, block_size) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    assert(actual_out == block_size);
+#endif
+}
+
+void op_aes_xts_encrypt_t::update(uint8_t *in, size_t max_in, uint8_t *out, size_t max_out, size_t & done_in, size_t & done_out)
+{
+    // Fucking AES-XTS implementations (all of them) don't have streaming support,
+    // crafting IV to resume encryption is slow, so we have to accumulate a full block
+    // and encrypt it at once :-(
+    // And then we have to support consuming it in parts because it's simpler for the
+    // higher layers.
+    if (encrypted)
+    {
+        // Copy accumulated and encrypted output
+        assert(tmp);
+        if (max_out > block_size - tmp_pos)
+            max_out = block_size - tmp_pos;
+        memcpy(out, tmp + tmp_pos, max_out);
+        done_out += max_out;
+        tmp_pos += max_out;
+        if (tmp_pos >= block_size)
+            encrypted = false;
+    }
+    else if (max_in < block_size - offset%block_size)
+    {
+        // Just accumulate input
+        if (!tmp)
+        {
+            tmp = (uint8_t*)malloc_or_die(block_size);
+            tmp_size = block_size;
+        }
+        memcpy(tmp + offset%block_size, in, max_in);
+        done_in += max_in;
+        offset += max_in;
+    }
+    else if (max_out < block_size)
+    {
+        // Accumulate and encrypt input in <tmp>, then copy part of it to <out>
+        if (!tmp)
+        {
+            tmp = (uint8_t*)malloc_or_die(block_size);
+            tmp_size = block_size;
+        }
+        max_in = block_size - offset%block_size;
+        memcpy(tmp + offset%block_size, in, max_in);
+        encrypt_block(tmp, tmp);
+        encrypted = true;
+        memcpy(out, tmp, max_out);
+        tmp_pos = max_out;
+        done_in += max_in;
+        offset += max_in;
+        done_out += max_out;
+    }
+    else if (!(offset%block_size))
+    {
+        // Full block - simplest case
+        encrypt_block(in, out);
+        done_in += block_size;
+        offset += block_size;
+        done_out += block_size;
+    }
+    else
+    {
+        // Accumulate input and encrypt directly to <output>
+        assert(tmp);
+        max_in = block_size - offset%block_size;
+        memcpy(tmp + offset%block_size, in, max_in);
+        encrypt_block(tmp, out);
+        done_in += max_in;
+        offset += max_in;
+        done_out += block_size;
+    }
+}
+
+void destroy_aes_xts_encrypt(op_aes_xts_encrypt_t *encrypt_ctx)
+{
+    delete encrypt_ctx;
+}
+
+op_aes_xts_decrypt_t::op_aes_xts_decrypt_t()
+{
+#ifdef WITH_OPENSSL
+    if (!(ctx = EVP_CIPHER_CTX_new()))
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    EVP_CIPHER_CTX_set_padding(ctx, 0);
+    if (EVP_DecryptInit_ex(ctx, EVP_aes_256_xts(), NULL, NULL, NULL) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+#else
+    fprintf(stderr, "Error: Vitastor is built without encryption support\n");
+    abort();
+#endif
+}
+
+op_aes_xts_decrypt_t::~op_aes_xts_decrypt_t()
+{
+    assert(!decrypted);
+#ifdef WITH_OPENSSL
+    EVP_CIPHER_CTX_free(ctx);
+#endif
+    if (tmp)
+        free(tmp);
+}
+
+void op_aes_xts_decrypt_t::start(uint8_t **key_chain, size_t chain_size, uint8_t *key_indexes, uint64_t start_offset, size_t block_size)
+{
+    assert(!decrypted);
+    this->start_offset = start_offset;
+    this->key_chain = chain_size > 1 ? key_chain : 0;
+    this->chain_size = chain_size > 1 ? chain_size : 0;
+    this->key_indexes = chain_size > 1 ? key_indexes : NULL;
+    assert(chain_size <= 1 || key_indexes != NULL);
+    this->block_size = block_size;
+    this->offset = 0;
+    this->tmp_pos = 0;
+    if (tmp && tmp_size != block_size)
+    {
+        free(tmp);
+        tmp = NULL;
+        tmp_size = 0;
+    }
+#ifdef WITH_OPENSSL
+    if (chain_size == 1 && key_chain[0] && EVP_DecryptInit_ex(ctx, NULL, NULL, key_chain[0], NULL) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+#endif
+}
+
+void op_aes_xts_decrypt_t::decrypt_block(uint8_t *in, uint8_t *out)
+{
+    uint8_t *key = NULL;
+    if (chain_size)
+    {
+        assert(key_indexes[offset/block_size] < chain_size);
+        key = key_chain[key_indexes[offset/block_size]];
+        if (!key)
+        {
+            if (in != out)
+                memcpy(out, in, block_size);
+            return;
+        }
+    }
+#ifdef WITH_OPENSSL
+    uint8_t iv[16] = { 0 };
+    *((uint64_t*)iv) = start_offset + offset - offset%block_size;
+    if (EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    int actual_out = 0;
+    if (EVP_DecryptUpdate(ctx, out, &actual_out, in, block_size) != 1)
+    {
+        ERR_print_errors_fp(stderr);
+        abort();
+    }
+    assert(actual_out == block_size);
+#endif
+}
+
+// out may be NULL, in this case all input is still decrypted to calculate checksums,
+// but part of it is skipped and not copied to out
+void op_aes_xts_decrypt_t::update(uint8_t *in, size_t max_in, uint8_t *out, size_t max_out, size_t & done_in, size_t & done_out)
+{
+    // Fucking AES-XTS implementations (all of them) don't have streaming support,
+    // crafting IV to resume decryption is slow, so we have to accumulate a full block
+    // and decrypt it at once :-(
+    // And then we have to support consuming it in parts because clients sometimes need
+    // fragmented output.
+    if (decrypted)
+    {
+        // Copy accumulated and decrypted output
+        assert(tmp);
+        if (max_out > block_size - tmp_pos)
+            max_out = block_size - tmp_pos;
+        if (out)
+            memcpy(out, tmp + tmp_pos, max_out);
+        done_out += max_out;
+        tmp_pos += max_out;
+        if (tmp_pos >= block_size)
+            decrypted = false;
+    }
+    else if (max_in < block_size - offset%block_size)
+    {
+        // Just accumulate input
+        if (!tmp)
+        {
+            tmp = (uint8_t*)malloc_or_die(block_size);
+            tmp_size = block_size;
+        }
+        memcpy(tmp + offset%block_size, in, max_in);
+        done_in += max_in;
+        offset += max_in;
+    }
+    else if (max_out < block_size || !out)
+    {
+        // Accumulate and decrypt input in <tmp>, then copy part of it to <out>
+        if (!tmp)
+        {
+            tmp = (uint8_t*)malloc_or_die(block_size);
+            tmp_size = block_size;
+        }
+        max_in = block_size - offset%block_size;
+        memcpy(tmp + offset%block_size, in, max_in);
+        decrypt_block(tmp, tmp);
+        decrypted = true;
+        if (out)
+            memcpy(out, tmp, max_out);
+        tmp_pos = max_out;
+        done_in += max_in;
+        offset += max_in;
+        done_out += max_out;
+    }
+    else if (!(offset%block_size))
+    {
+        // Full block - simplest case
+        if (out)
+            decrypt_block(in, out);
+        done_in += block_size;
+        offset += block_size;
+        done_out += block_size;
+    }
+    else
+    {
+        // Accumulate input and decrypt directly to <output>
+        assert(tmp);
+        max_in = block_size - offset%block_size;
+        memcpy(tmp + offset%block_size, in, max_in);
+        assert(out);
+        decrypt_block(tmp, out);
+        done_in += max_in;
+        offset += max_in;
+        done_out += block_size;
+    }
+}
+
+void destroy_aes_xts_decrypt(op_aes_xts_decrypt_t *decrypt_ctx)
+{
+    delete decrypt_ctx;
+}
+
+bool osd_messenger_t::op_encrypted_copy_data_to(osd_client_t* cl, uint8_t *enc_buf, size_t enc_len, size_t from, size_t & done)
+{
+    auto op = cl->write_op;
+    auto & op_pos = cl->write_op_pos;
+    assert(op->req.hdr.opcode == OSD_OP_WRITE);
+    if (!from)
+    {
+        if (!cl->encrypt_ctx)
+        {
+            if (encrypt_ctx_pool.size())
+            {
+                cl->encrypt_ctx = encrypt_ctx_pool.back();
+                encrypt_ctx_pool.pop_back();
+            }
+            else
+                cl->encrypt_ctx = new op_aes_xts_encrypt_t();
+        }
+        assert(op->enc->key_chain[0]);
+        cl->encrypt_ctx->start(op->enc->key_chain[0], op->req.rw.offset, op->enc->bitmap_granularity);
+    }
+    for (int i = 0; i < op->iov.count; i++)
+    {
+        uint8_t *plain = (uint8_t*)op->iov.buf[i].iov_base;
+        size_t plain_len = op->iov.buf[i].iov_len;
+        while (from < plain_len || cl->encrypt_ctx->has_buffered())
+        {
+            if (done >= enc_len)
+                return false;
+            size_t done_in = 0;
+            size_t done_out = 0;
+            cl->encrypt_ctx->update(plain+from, plain_len-from, enc_buf+done, enc_len-done, done_in, done_out);
+            if (cl->write_csum_state && done_out > 0)
+                XXH3_64bits_update(cl->write_csum_state, enc_buf+done, done_out);
+            done += done_out;
+            op_pos += done_in;
+            from += done_in;
+        }
+        from -= plain_len;
+    }
+    if (cl->encrypt_ctx)
+    {
+        if (encrypt_ctx_pool.size() > max_aes_xts_pool_size)
+            delete cl->encrypt_ctx;
+        else
+            encrypt_ctx_pool.push_back(cl->encrypt_ctx);
+        cl->encrypt_ctx = NULL;
+    }
+    return true;
+}
+
+bool osd_messenger_t::op_decrypted_copy_data_from(osd_client_t* cl, uint8_t *enc_buf, size_t enc_len, size_t from, size_t & done)
+{
+    op_decrypt_start(cl);
+    auto op = cl->read_op;
+    assert(op->req.hdr.opcode == OSD_OP_READ);
+    for (int i = 0; i < op->iov.count; i++)
+    {
+        uint8_t *plain = (uint8_t*)op->iov.buf[i].iov_base;
+        size_t plain_len = op->iov.buf[i].iov_len;
+        while (from < plain_len)
+        {
+            if (done >= enc_len)
+                return false;
+            size_t done_in = 0;
+            size_t done_out = 0;
+            // plain == NULL means skip output
+            cl->decrypt_ctx->update(enc_buf+done, enc_len-done, plain ? plain+from : NULL, plain_len-from, done_in, done_out);
+            if (cl->read_csum_state && done_in > 0)
+                XXH3_64bits_update(cl->read_csum_state, enc_buf+done, done_in);
+            done += done_in;
+            cl->read_op_pos += done_out;
+            cl->read_op_inline_decrypt_in += done_in;
+            from += done_out;
+            if (!done_out)
+                return false;
+        }
+        from -= plain_len;
+    }
+    op_decrypt_free(cl);
+    return true;
+}
+
+void osd_messenger_t::op_decrypt_start(osd_client_t* cl)
+{
+    if (!cl->decrypt_ctx)
+    {
+        if (decrypt_ctx_pool.size())
+        {
+            cl->decrypt_ctx = decrypt_ctx_pool.back();
+            decrypt_ctx_pool.pop_back();
+        }
+        else
+            cl->decrypt_ctx = new op_aes_xts_decrypt_t();
+        auto & enc = cl->read_op->enc;
+        cl->decrypt_ctx->start(enc->key_chain, enc->chain_size,
+            (cl->read_op->req.rw.flags & OSD_OP_RETURN_CHAIN) ? (uint8_t*)cl->read_op->bitmap + enc->read_chain_bitmap_pos : 0,
+            cl->read_op->req.rw.offset, enc->bitmap_granularity);
+    }
+}
+
+void osd_messenger_t::op_decrypt_inline(osd_client_t* cl)
+{
+    op_decrypt_start(cl);
+    osd_op_t *op = cl->read_op;
+    size_t from_in = cl->read_op_inline_decrypt_in;
+    int i = 0;
+    while (i < op->iov.count && from_in >= op->iov.buf[i].iov_len)
+    {
+        from_in -= op->iov.buf[i].iov_len;
+        i++;
+    }
+    size_t from_out = cl->read_op_inline_decrypt_pos - OSD_PACKET_SIZE - op->reply.rw.bitmap_len;
+    int j = 0;
+    while (j < op->iov.count && from_out >= op->iov.buf[j].iov_len)
+    {
+        from_out -= op->iov.buf[j].iov_len;
+        j++;
+    }
+    while (i < op->iov.count && j < op->iov.count)
+    {
+        uint8_t *in = (uint8_t*)op->iov.buf[i].iov_base + from_in;
+        size_t in_len = op->iov.buf[i].iov_len - from_in;
+        uint8_t *out = (uint8_t*)op->iov.buf[j].iov_base + from_out;
+        size_t out_len = op->iov.buf[j].iov_len - from_out;
+        size_t done_in = 0;
+        size_t done_out = 0;
+        cl->decrypt_ctx->update(in, in_len, out, out_len, done_in, done_out);
+        if (done_in >= in_len)
+        {
+            i++;
+            from_in = 0;
+        }
+        else
+            from_in += done_in;
+        if (done_out >= out_len)
+        {
+            j++;
+            from_out = 0;
+        }
+        else
+            from_out += done_out;
+    }
+    assert(j >= op->iov.count);
+    op_decrypt_free(cl);
+}
+
+void osd_messenger_t::op_decrypt_free(osd_client_t* cl)
+{
+    if (cl->decrypt_ctx)
+    {
+        if (decrypt_ctx_pool.size() > max_aes_xts_pool_size)
+            delete cl->decrypt_ctx;
+        else
+            decrypt_ctx_pool.push_back(cl->decrypt_ctx);
+        cl->decrypt_ctx = NULL;
+    }
+}
@@ -0,0 +1,68 @@
+// Copyright (c) Vitaliy Filippov, 2026+
+// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
+
+#include <stdint.h>
+
+#include "../util/xxh_x86dispatch.h"
+// WITH_OPENSSL is left to possibly support other crypto libraries
+#ifdef WITH_OPENSSL
+#include <openssl/conf.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#endif
+
+class op_aes_xts_encrypt_t
+{
+#ifdef WITH_OPENSSL
+    EVP_CIPHER_CTX *ctx = NULL;
+#endif
+    uint64_t start_offset = 0;
+    uint8_t *key = NULL;
+    size_t offset = 0;
+    size_t block_size = 0;
+    uint8_t *tmp = NULL;
+    size_t tmp_size = 0;
+    size_t tmp_pos = 0;
+    bool encrypted = false;
+
+    void encrypt_block(uint8_t *in, uint8_t *out);
+
+public:
+    op_aes_xts_encrypt_t();
+    ~op_aes_xts_encrypt_t();
+
+    inline bool has_buffered() { return encrypted; };
+    void start(uint8_t *key, uint64_t start_offset, size_t block_size);
+    void update(uint8_t *in, size_t max_in, uint8_t *out, size_t max_out, size_t & done_in, size_t & done_out);
+};
+
+void destroy_aes_xts_encrypt(op_aes_xts_encrypt_t *encrypt_ctx);
+
+class op_aes_xts_decrypt_t
+{
+#ifdef WITH_OPENSSL
+    EVP_CIPHER_CTX *ctx = NULL;
+#endif
+    uint64_t start_offset = 0;
+    uint8_t **key_chain = NULL;
+    size_t chain_size = 0;
+    uint8_t *key_indexes = NULL;
+    size_t offset = 0;
+    size_t block_size = 0;
+    uint8_t *tmp = NULL;
+    size_t tmp_size = 0;
+    size_t tmp_pos = 0;
+    bool decrypted = false;
+
+    void decrypt_block(uint8_t *in, uint8_t *out);
+
+public:
+    op_aes_xts_decrypt_t();
+    ~op_aes_xts_decrypt_t();
+
+    inline bool has_buffered() { return decrypted; };
+    void start(uint8_t **key_chain, size_t chain_size, uint8_t *key_indexes, uint64_t start_offset, size_t block_size);
+    void update(uint8_t *in, size_t max_in, uint8_t *out, size_t max_out, size_t & done_in, size_t & done_out);
+};
+
+void destroy_aes_xts_decrypt(op_aes_xts_decrypt_t *decrypt_ctx);
@@ -8,7 +8,6 @@
 osd_op_t::~osd_op_t()
 {
    assert(!bs_op);
-    assert(!op_data);
    if (bitmap_buf)
    {
        free(bitmap_buf);
@@ -23,6 +22,14 @@ osd_op_t::~osd_op_t()
        // So we don't reuse it, but free it every time
        free(buf);
    }
+    if (enc_buf)
+    {
+        free(enc_buf);
+    }
+    if (op_data)
+    {
+        free(op_data);
+    }
 }

 bool osd_op_t::is_recovery_related()
@@ -3,6 +3,8 @@

 #pragma once

+#include <memory>
+
 #include <sys/uio.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -16,6 +18,8 @@

 #define OSD_OP_INLINE_BUF_COUNT 16

+#define AES_256_XTS_KEY_SIZE 64
+
 // Kind of a vector with small-list-optimisation
 struct osd_op_buf_list_t
 {
@@ -152,11 +156,24 @@ struct blockstore_op_t;

 struct osd_primary_op_data_t;

+struct osd_op_enc_t
+{
+    // Keys may contain more information in the future, like encryption algorithm and key ID
+    // In this case, key_chain will become inode_key_t* with inode_key_t also being a structure
+    // Currently all keys are required to be 512 bit (64 byte) long, for AES-256-XTS
+    // Raw pointers are convenient for messenger code; external users may use shared_ptr aliasing
+    // to implement complex freeing of osd_op_enc_t along with their external inode cache info
+    uint8_t** key_chain = NULL;
+    size_t chain_size = 0;
+    uint32_t read_chain_bitmap_pos = 0;
+    uint32_t bitmap_granularity = 0;
+};
+
 struct __attribute__((visibility("default"))) osd_op_t
 {
    timespec tv_begin = { 0 }, tv_end = { 0 };
    uint64_t op_type = OSD_OP_IN;
-    int peer_fd;
+    uint64_t client_id = 0;
    osd_any_op_t req;
    osd_any_reply_t reply;
    blockstore_op_t *bs_op = NULL;
@@ -167,6 +184,9 @@ struct __attribute__((visibility("default"))) osd_op_t
    unsigned bmp_data = 0;
    void *bitmap_buf = NULL;
    void *rmw_buf = NULL;
+    std::shared_ptr<osd_op_enc_t> enc;
+    uint8_t *enc_buf = NULL;
+    uint64_t csum = 0; // network layer checksum
    osd_primary_op_data_t* op_data = NULL;
    std::function<void(osd_op_t*)> callback;

@@ -176,4 +196,5 @@ struct __attribute__((visibility("default"))) osd_op_t
    void cancel();

    bool is_recovery_related();
+    uint64_t calc_data_checksum();
 };
@@ -493,7 +493,7 @@ int msgr_rdma_connection_t::connect(msgr_rdma_address_t *dest)
    return 0;
 }

-bool osd_messenger_t::connect_rdma(int peer_fd, std::string rdma_address, uint64_t client_max_msg)
+bool osd_messenger_t::connect_rdma(uint64_t client_id, std::string rdma_address, uint64_t client_max_msg)
 {
    // Try to connect to the peer using RDMA
    msgr_rdma_address_t addr;
@@ -503,12 +503,12 @@ bool osd_messenger_t::connect_rdma(int peer_fd, std::string rdma_address, uint64
        {
            client_max_msg = rdma_max_msg;
        }
-        auto cl = clients.at(peer_fd);
+        auto cl = clients.at(client_id);
        msgr_rdma_context_t *selected_ctx = choose_rdma_context(cl);
        if (!selected_ctx)
        {
            if (log_level > 0)
-                fprintf(stderr, "No RDMA context for peer %d, using only TCP\n", cl->peer_fd);
+                fprintf(stderr, "No RDMA context for peer %ju, using only TCP\n", client_id);
            return false;
        }
        msgr_rdma_connection_t *rdma_conn = msgr_rdma_connection_t::create(selected_ctx, rdma_max_send, rdma_max_recv, rdma_max_sge, client_max_msg);
@@ -519,14 +519,13 @@ bool osd_messenger_t::connect_rdma(int peer_fd, std::string rdma_address, uint64
            {
                delete rdma_conn;
                fprintf(
-                    stderr, "Failed to connect RDMA queue pair to %s (client %d)\n",
-                    addr.to_string().c_str(), peer_fd
+                    stderr, "Failed to connect RDMA queue pair to %s (client %ju)\n",
+                    addr.to_string().c_str(), client_id
                );
            }
            else
            {
                // Remember connection, but switch to RDMA only after sending the configuration response
-                auto cl = clients.at(peer_fd);
                cl->rdma_conn = rdma_conn;
                cl->peer_state = PEER_RDMA_CONNECTING;
                return true;
@@ -540,7 +539,7 @@ static void try_send_rdma_wr(osd_client_t *cl, ibv_sge *sge, int op_sge)
 {
    ibv_send_wr *bad_wr = NULL;
    ibv_send_wr wr = {
-        .wr_id = (uint64_t)(cl->peer_fd*2+1),
+        .wr_id = cl->client_id,
        .sg_list = sge,
        .num_sge = op_sge,
        .opcode = IBV_WR_SEND,
@@ -555,23 +554,28 @@ static void try_send_rdma_wr(osd_client_t *cl, ibv_sge *sge, int op_sge)
    cl->rdma_conn->cur_send++;
 }

-static int try_send_rdma_copy(osd_client_t *cl, uint8_t *dst, int dst_len)
+int osd_messenger_t::try_send_rdma_copy(osd_client_t *cl, uint8_t *dst, int dst_len)
 {
-    auto rc = cl->rdma_conn;
    int total_dst_len = dst_len;
-    while (dst_len > 0 && rc->send_pos < cl->send_list.size())
+    while (dst_len > 0 && (cl->write_op || cl->write_ops.size()))
    {
-        iovec & iov = cl->send_list[rc->send_pos];
-        uint32_t len = (uint32_t)(iov.iov_len-rc->send_buf_pos < dst_len
-            ? iov.iov_len-rc->send_buf_pos : dst_len);
-        memcpy(dst, (uint8_t*)iov.iov_base+rc->send_buf_pos, len);
-        dst += len;
-        dst_len -= len;
-        rc->send_buf_pos += len;
-        if (rc->send_buf_pos >= iov.iov_len)
+        if (!cl->write_op)
        {
-            rc->send_pos++;
-            rc->send_buf_pos = 0;
+            cl->write_op = cl->write_ops.front();
+            cl->write_ops.pop_front();
+        }
+        osd_op_t *op = cl->write_op;
+        size_t copied = op_copy_to(cl, dst, dst_len);
+        if (!copied)
+        {
+            break;
+        }
+        dst += copied;
+        dst_len -= copied;
+        if (!cl->write_op && op->op_type == OSD_OP_IN)
+        {
+            // this is a reply, free the op after sending it
+            cl->send_free_ops.push_back(op);
        }
    }
    return total_dst_len-dst_len;
@@ -618,6 +622,7 @@ void osd_messenger_t::try_send_rdma(osd_client_t *cl)
            };
            try_send_rdma_wr(cl, &sge, 1);
            rc->send_sizes.push_back(copied);
+            cl->send_free_ops.push_back(NULL); // end marker
        }
    }
 }
@@ -631,7 +636,7 @@ static void try_recv_rdma_wr(osd_client_t *cl, void *buf)
    };
    ibv_recv_wr *bad_wr = NULL;
    ibv_recv_wr wr = {
-        .wr_id = (uint64_t)(cl->peer_fd*2),
+        .wr_id = cl->client_id,
        .sg_list = &sge,
        .num_sge = 1,
    };
@@ -688,8 +693,8 @@ void osd_messenger_t::handle_rdma_events(msgr_rdma_context_t *rdma_context)
        event_count = ibv_poll_cq(rdma_context->cq, RDMA_EVENTS_AT_ONCE, wc);
        for (int i = 0; i < event_count; i++)
        {
-            int client_id = wc[i].wr_id >> 1;
-            bool is_send = wc[i].wr_id & 1;
+            uint64_t client_id = wc[i].wr_id;
+            bool is_send = wc[i].opcode == IBV_WC_SEND;
            auto cl_it = clients.find(client_id);
            if (cl_it == clients.end())
            {
@@ -703,26 +708,20 @@ void osd_messenger_t::handle_rdma_events(msgr_rdma_context_t *rdma_context)
            auto rc = cl->rdma_conn;
            if (wc[i].status != IBV_WC_SUCCESS)
            {
-                fprintf(stderr, "RDMA work request failed for client %d", client_id);
+                fprintf(stderr, "RDMA work request failed for client %ju", client_id);
                if (cl->osd_num)
                {
                    fprintf(stderr, " (OSD %ju)", cl->osd_num);
                }
                fprintf(stderr, " with status: %s, stopping client\n", ibv_wc_status_str(wc[i].status));
                stop_client(client_id);
-                clear_immediate_ops(client_id);
                continue;
            }
            if (!is_send)
            {
-                // Reset OSD ping state - client is obviously alive
-                cl->ping_time_remaining = 0;
-                cl->idle_time_remaining = osd_idle_timeout;
                rc->cur_recv--;
                if (!handle_read_buffer(cl, rc->recv_buffers[rc->next_recv_buf], wc[i].byte_len))
                {
-                    // handle_read_buffer may stop the client
-                    clear_immediate_ops(client_id);
                    continue;
                }
                try_recv_rdma_wr(cl, rc->recv_buffers[rc->next_recv_buf]);
@@ -731,54 +730,27 @@ void osd_messenger_t::handle_rdma_events(msgr_rdma_context_t *rdma_context)
            else
            {
                rc->cur_send--;
-                uint64_t sent_size = rc->send_sizes.at(0);
-                rc->send_sizes.erase(rc->send_sizes.begin(), rc->send_sizes.begin()+1);
+                // byte_len is not filled for send operations
+                uint64_t sent_size = rc->send_sizes.front();
+                rc->send_sizes.pop_front();
                rc->send_done_pos += sent_size;
                rc->send_out_full = false;
                if (rc->send_done_pos == rc->send_out_size)
                    rc->send_done_pos = 0;
                assert(rc->send_done_pos < rc->send_out_size);
-                int send_pos = 0, send_buf_pos = 0;
-                while (sent_size > 0)
+                while (cl->send_free_ops.front())
                {
-                    if (sent_size >= cl->send_list.at(send_pos).iov_len)
-                    {
-                        sent_size -= cl->send_list[send_pos].iov_len;
-                        send_pos++;
-                    }
-                    else
-                    {
-                        send_buf_pos = sent_size;
-                        sent_size = 0;
-                    }
+                    delete cl->send_free_ops.front();
+                    cl->send_free_ops.pop_front();
                }
-                assert(rc->send_pos >= send_pos);
-                if (rc->send_pos == send_pos)
+                cl->send_free_ops.pop_front();
+                if (cl->proto_csum_status == MSGR_PEER_CSUM_IN && !cl->write_op && !cl->write_ops.size())
                {
-                    rc->send_buf_pos -= send_buf_pos;
-                }
-                rc->send_pos -= send_pos;
-                for (int i = 0; i < send_pos; i++)
-                {
-                    if (cl->outbox[i].flags & MSGR_SENDP_FREE)
-                    {
-                        // Reply fully sent
-                        delete cl->outbox[i].op;
-                    }
-                }
-                if (send_pos > 0)
-                {
-                    cl->send_list.erase(cl->send_list.begin(), cl->send_list.begin()+send_pos);
-                    cl->outbox.erase(cl->outbox.begin(), cl->outbox.begin()+send_pos);
-                }
-                if (send_buf_pos > 0)
-                {
-                    cl->send_list[0].iov_base = (uint8_t*)cl->send_list[0].iov_base + send_buf_pos;
-                    cl->send_list[0].iov_len -= send_buf_pos;
+                    // Checksums negotiated, enable
+                    cl->proto_csum_status = MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT;
                }
                try_send_rdma(cl);
            }
        }
    } while (event_count > 0);
-    handle_immediate_ops();
 }
@@ -8,8 +8,11 @@
 #include <infiniband/verbs.h>
 #include <string>
 #include <vector>
+#include <deque>
 #include "addr_util.h"

+struct osd_op_t;
+
 struct msgr_rdma_address_t
 {
    ibv_gid gid;
@@ -72,9 +75,9 @@ struct msgr_rdma_connection_t
    int cur_send = 0, cur_recv = 0;
    int send_pos = 0, send_buf_pos = 0;
    int next_recv_buf = 0;
-    std::vector<void*> recv_buffers;
+    std::vector<uint8_t*> recv_buffers;
    msgr_rdma_buf_t recv_buf;
-    std::vector<uint64_t> send_sizes;
+    std::deque<uint64_t> send_sizes;
    msgr_rdma_buf_t send_out;
    int send_out_pos = 0, send_done_pos = 0, send_out_size = 0;
    bool send_out_full = false;
@@ -11,7 +11,7 @@
 struct rdmacm_connecting_t
 {
    rdma_cm_id *cmid = NULL;
-    int peer_fd = -1;
+    uint64_t client_id = 0;
    osd_num_t peer_osd = 0;
    std::string addr;
    sockaddr_storage parsed_addr = {};
@@ -117,9 +117,9 @@ void osd_messenger_t::handle_rdmacm_events()
            auto cli_it = rdmacm_connections.find(ev->id);
            if (cli_it != rdmacm_connections.end())
            {
-                fprintf(stderr, "Received %s event for peer %d, closing connection\n",
-                    event_type_name, cli_it->second->peer_fd);
-                stop_client(cli_it->second->peer_fd);
+                fprintf(stderr, "Received %s event for client %ju, closing connection\n",
+                    event_type_name, cli_it->second->client_id);
+                stop_client(cli_it->second->client_id);
            }
            else if (rdmacm_connecting.find(ev->id) != rdmacm_connecting.end())
            {
@@ -265,14 +265,6 @@ msgr_rdma_context_t* osd_messenger_t::rdmacm_create_qp(rdma_cm_id *cmid)

 void osd_messenger_t::rdmacm_accept(rdma_cm_event *ev)
 {
-    // Make a fake FD (FIXME: do not use FDs for identifying clients!)
-    int fake_fd = socket(AF_INET, SOCK_STREAM, 0);
-    if (fake_fd < 0)
-    {
-        fprintf(stderr, "Failed to allocate a fake socket for RDMA-CM client: %s (code %d)\n", strerror(errno), errno);
-        rdma_destroy_id(ev->id);
-        return;
-    }
    auto rdma_context = rdmacm_create_qp(ev->id);
    if (!rdma_context)
    {
@@ -297,12 +289,12 @@ void osd_messenger_t::rdmacm_accept(rdma_cm_event *ev)
    // Wait for RDMA_CM_ESTABLISHED, and enable the connection only after it
    auto conn = new rdmacm_connecting_t;
    conn->cmid = ev->id;
-    conn->peer_fd = fake_fd;
+    conn->client_id = next_client_id++;
    conn->parsed_addr = *(sockaddr_storage*)rdma_get_peer_addr(ev->id);
    conn->rdma_context = rdma_context;
    rdmacm_set_conn_timeout(conn);
    rdmacm_connecting[ev->id] = conn;
-    fprintf(stderr, "[OSD %ju] new client %d: connection from %s via RDMA-CM\n", this->osd_num, conn->peer_fd,
+    fprintf(stderr, "[OSD %ju] new client %ju: connection from %s via RDMA-CM\n", this->osd_num, conn->client_id,
        addr_to_string(conn->parsed_addr).c_str());
 }

@@ -332,8 +324,6 @@ void osd_messenger_t::rdmacm_on_connect_peer_error(rdma_cm_id *cmid, int res)
    auto peer_osd = conn->peer_osd;
    if (conn->timeout_id >= 0)
        tfd->clear_timer(conn->timeout_id);
-    if (conn->peer_fd >= 0)
-        close(conn->peer_fd);
    if (conn->rdma_context)
        conn->rdma_context->reserve_cqe(-rdma_max_send-rdma_max_recv);
    if (conn->cmid)
@@ -354,7 +344,7 @@ void osd_messenger_t::rdmacm_on_connect_peer_error(rdma_cm_id *cmid, int res)
        else
        {
            // TCP is disabled
-            on_connect_peer(peer_osd, res == 0 ? -EINVAL : (res > 0 ? -res : res));
+            on_connect_peer(peer_osd, res == 0 ? -EINVAL : (res > 0 ? -res : res), 0);
        }
    }
 }
@@ -365,7 +355,7 @@ void osd_messenger_t::rdmacm_try_connect_peer(uint64_t peer_osd, const std::stri
    if (!string_to_addr(addr, false, rdmacm_port, &sa))
    {
        fprintf(stderr, "Address %s is invalid\n", addr.c_str());
-        on_connect_peer(peer_osd, -EINVAL);
+        on_connect_peer(peer_osd, -EINVAL, 0);
        return;
    }
    rdma_cm_id *cmid = NULL;
@@ -376,17 +366,7 @@ void osd_messenger_t::rdmacm_try_connect_peer(uint64_t peer_osd, const std::stri
        if (!disable_tcp)
            try_connect_peer_tcp(peer_osd, addr.c_str(), fallback_tcp_port);
        else
-            on_connect_peer(peer_osd, res);
-        return;
-    }
-    // Make a fake FD (FIXME: do not use FDs for identifying clients!)
-    int fake_fd = socket(AF_INET, SOCK_STREAM, 0);
-    if (fake_fd < 0)
-    {
-        int res = -errno;
-        rdma_destroy_id(cmid);
-        // Can't create socket, pointless to try TCP
-        on_connect_peer(peer_osd, res);
+            on_connect_peer(peer_osd, res, 0);
        return;
    }
    if (log_level > 0)
@@ -394,7 +374,7 @@ void osd_messenger_t::rdmacm_try_connect_peer(uint64_t peer_osd, const std::stri
    auto conn = new rdmacm_connecting_t;
    rdmacm_connecting[cmid] = conn;
    conn->cmid = cmid;
-    conn->peer_fd = fake_fd;
+    conn->client_id = next_client_id++;
    conn->peer_osd = peer_osd;
    conn->addr = addr;
    conn->parsed_addr = sa;
@@ -511,13 +491,13 @@ void osd_messenger_t::rdmacm_established(rdma_cm_event *ev)
    auto cl = new osd_client_t();
    cl->peer_addr = conn->parsed_addr;
    cl->peer_port = conn->rdmacm_port;
-    cl->peer_fd = conn->peer_fd;
+    cl->client_id = conn->client_id;
    cl->peer_state = PEER_RDMA;
    cl->connect_timeout_id = -1;
    cl->osd_num = peer_osd;
-    cl->in_buf = malloc_or_die(receive_buffer_size);
+    cl->in_buf = (uint8_t*)malloc_or_die(receive_buffer_size);
    cl->rdma_conn = rc;
-    clients[conn->peer_fd] = cl;
+    clients[conn->client_id] = cl;
    if (conn->timeout_id >= 0)
    {
        tfd->clear_timer(conn->timeout_id);
@@ -1,21 +1,27 @@
 // Copyright (c) Vitaliy Filippov, 2019+
 // License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)

+#define _XOPEN_SOURCE
+#include <limits.h>
 #include "messenger.h"

 void osd_messenger_t::read_requests()
 {
    for (int i = 0; i < read_ready_clients.size(); i++)
    {
-        int peer_fd = read_ready_clients[i];
-        auto cl_it = clients.find(peer_fd);
+        uint64_t client_id = read_ready_clients[i];
+        auto cl_it = clients.find(client_id);
        if (cl_it == clients.end() || !cl_it->second || cl_it->second->read_msg.msg_iovlen ||
-            cl_it->second->peer_state == PEER_RDMA || cl_it->second->peer_state == PEER_RDMA_CONNECTING)
+            cl_it->second->peer_state != PEER_CONNECTED)
        {
            continue;
        }
        auto cl = cl_it->second;
-        if (cl->read_remaining < receive_buffer_size)
+        if (cl->read_op && cl->read_op_size-(cl->read_op_pos-OSD_PACKET_SIZE) >= receive_buffer_size)
+        {
+            op_get_read_buffers(cl, cl->recv_list);
+        }
+        if (!cl->recv_list.size())
        {
            cl->read_iov.iov_base = cl->in_buf;
            cl->read_iov.iov_len = receive_buffer_size;
@@ -25,14 +31,15 @@ void osd_messenger_t::read_requests()
        else
        {
            cl->read_iov.iov_base = 0;
-            cl->read_iov.iov_len = cl->read_remaining;
-            cl->read_msg.msg_iov = cl->recv_list.get_iovec();
-            cl->read_msg.msg_iovlen = cl->recv_list.get_size();
+            cl->read_iov.iov_len = 0;
+            cl->read_msg.msg_iov = cl->recv_list.data();
+            cl->read_msg.msg_iovlen = cl->recv_list.size();
        }
+        assert(!cl->read_op || cl->read_op_pos < OSD_PACKET_SIZE || cl->read_op_size >= (cl->read_op_pos-OSD_PACKET_SIZE));
        cl->refs++;
        if (ringloop && !use_sync_send_recv)
        {
-            auto iothread = iothreads.size() ? iothreads[peer_fd % iothreads.size()] : NULL;
+            auto iothread = iothreads.size() ? iothreads[cl->peer_fd % iothreads.size()] : NULL;
            io_uring_sqe sqe_local;
            ring_data_t data_local;
            io_uring_sqe* sqe = (iothread ? &sqe_local : ringloop->get_sqe());
@@ -50,7 +57,7 @@ void osd_messenger_t::read_requests()
            }
            ring_data_t* data = ((ring_data_t*)sqe->user_data);
            data->callback = [this, cl](ring_data_t *data) { handle_read(data->res, cl); };
-            io_uring_prep_recvmsg(sqe, peer_fd, &cl->read_msg, 0);
+            io_uring_prep_recvmsg(sqe, cl->peer_fd, &cl->read_msg, cl->recv_list.size() ? MSG_WAITALL : 0);
            if (iothread)
            {
                iothread->add_sqe(sqe_local);
@@ -58,7 +65,7 @@ void osd_messenger_t::read_requests()
        }
        else
        {
-            int result = recvmsg(peer_fd, &cl->read_msg, 0);
+            int result = recvmsg(cl->peer_fd, &cl->read_msg, 0);
            if (result < 0)
            {
                result = -errno;
@@ -68,99 +75,92 @@ void osd_messenger_t::read_requests()
        }
    }
    read_ready_clients.clear();
+    handle_immediate_ops();
 }

-bool osd_messenger_t::handle_read(int result, osd_client_t *cl)
+void osd_messenger_t::handle_read(int result, osd_client_t *cl)
 {
-    bool ret = false;
-    int peer_fd = cl->peer_fd;
-    cl->read_msg.msg_iovlen = 0;
    cl->refs--;
    if (cl->peer_state == PEER_RDMA)
    {
-        return true;
+        return;
    }
    if (cl->peer_state == PEER_STOPPED)
    {
        if (cl->refs <= 0)
        {
-            delete cl;
+            destroy_client(cl);
        }
-        return false;
+        return;
    }
    if (result <= 0 && result != -EAGAIN && result != -EINTR)
    {
        // this is a client socket, so don't panic on error. just disconnect it
        if (result != 0)
        {
-            fprintf(stderr, "Client %d socket read error: %d (%s). Disconnecting client\n", cl->peer_fd, -result, strerror(-result));
+            fprintf(stderr, "Client %ju socket read error: %d (%s). Disconnecting client\n", cl->client_id, -result, strerror(-result));
        }
-        stop_client(cl->peer_fd);
-        return false;
-    }
-    if (result == -EAGAIN || result == -EINTR || result < cl->read_iov.iov_len)
-    {
-        cl->read_ready--;
-        if (cl->read_ready > 0)
-            read_ready_clients.push_back(cl->peer_fd);
-    }
-    else
-    {
-        read_ready_clients.push_back(cl->peer_fd);
+        stop_client(cl->client_id);
+out_wakeup:
+        if (set_immediate_ops.size())
+            ringloop->wakeup();
+        return;
    }
+    bool full_read = false;
    if (result > 0)
    {
        if (cl->read_iov.iov_base == cl->in_buf)
        {
+            full_read = result >= cl->read_iov.iov_len;
            if (!handle_read_buffer(cl, cl->in_buf, result))
-            {
-                clear_immediate_ops(peer_fd);
-                handle_immediate_ops();
-                return false;
-            }
+                goto out_wakeup;
        }
        else
        {
+            // Reset OSD ping state
+            cl->ping_time_remaining = 0;
+            cl->idle_time_remaining = osd_idle_timeout;
            // Long data
-            cl->read_remaining -= result;
-            cl->recv_list.eat(result);
-            if (cl->recv_list.done >= cl->recv_list.count)
+            size_t i = 0;
+            while (i < cl->recv_list.size() && result >= cl->recv_list[i].iov_len)
            {
-                if (!handle_finished_read(cl))
+                if (cl->read_csum_state && cl->recv_list[i].iov_len > 0 &&
+                    i != cl->recv_list.size()-1) // skip the checksum itself
                {
-                    clear_immediate_ops(peer_fd);
-                    handle_immediate_ops();
-                    return false;
+                    XXH3_64bits_update(cl->read_csum_state, cl->recv_list[i].iov_base, cl->recv_list[i].iov_len);
                }
+                result -= cl->recv_list[i].iov_len;
+                i++;
+            }
+            if (i < cl->recv_list.size())
+            {
+                cl->recv_list[i].iov_base += result;
+                cl->recv_list[i].iov_len -= result;
+            }
+            else
+            {
+                full_read = true;
+            }
+            cl->recv_list.erase(cl->recv_list.begin(), cl->recv_list.begin()+i);
+            if (!cl->recv_list.size())
+            {
+                if (!handle_finished_op(cl))
+                    goto out_wakeup;
            }
        }
-        if (result >= cl->read_iov.iov_len)
-        {
-            ret = true;
-        }
    }
-    handle_immediate_ops();
-    return ret;
-}
-
-void osd_messenger_t::clear_immediate_ops(int peer_fd)
-{
-    size_t i = 0, j = 0;
-    while (i < set_immediate_ops.size())
+    cl->read_msg.msg_iovlen = 0;
+    if (result == -EAGAIN || result == -EINTR || !full_read)
    {
-        if (set_immediate_ops[i]->peer_fd == peer_fd && set_immediate_ops[i]->op_type == OSD_OP_IN)
-        {
-            delete set_immediate_ops[i];
-        }
-        else
-        {
-            if (i != j)
-                set_immediate_ops[j] = set_immediate_ops[i];
-            j++;
-        }
-        i++;
+        cl->read_ready--;
+        if (cl->read_ready > 0)
+            read_ready_clients.push_back(cl->client_id);
    }
-    set_immediate_ops.resize(j);
+    else
+    {
+        read_ready_clients.push_back(cl->client_id);
+    }
+    goto out_wakeup;
 }

 void osd_messenger_t::handle_immediate_ops()
@@ -171,7 +171,11 @@ void osd_messenger_t::handle_immediate_ops()
        set_immediate_ops.pop_front();
        if (op->op_type == OSD_OP_IN)
        {
-            exec_op(op);
+            auto cl_it = clients.find(op->client_id);
+            if (cl_it != clients.end() && cl_it->second->peer_state != PEER_STOPPED)
+                exec_op(op);
+            else
+                delete op;
        }
        else
        {
@@ -181,113 +185,105 @@ void osd_messenger_t::handle_immediate_ops()
    }
 }

-bool osd_messenger_t::handle_read_buffer(osd_client_t *cl, void *curbuf, int remain)
-{
-    // Compose operation(s) from the buffer
-    while (remain > 0)
-    {
-        if (!cl->read_op)
-        {
-            cl->read_op = new osd_op_t;
-            cl->read_op->peer_fd = cl->peer_fd;
-            cl->read_op->op_type = OSD_OP_IN;
-            cl->recv_list.push_back(cl->read_op->req.buf, OSD_PACKET_SIZE);
-            cl->read_remaining = OSD_PACKET_SIZE;
-            cl->read_state = CL_READ_HDR;
-        }
-        while (cl->recv_list.done < cl->recv_list.count && remain > 0)
-        {
-            iovec* cur = cl->recv_list.get_iovec();
-            if (cur->iov_len > remain)
-            {
-                memcpy(cur->iov_base, curbuf, remain);
-                cl->read_remaining -= remain;
-                cur->iov_len -= remain;
-                cur->iov_base = (uint8_t*)cur->iov_base + remain;
-                remain = 0;
-            }
-            else
-            {
-                memcpy(cur->iov_base, curbuf, cur->iov_len);
-                curbuf = (uint8_t*)curbuf + cur->iov_len;
-                cl->read_remaining -= cur->iov_len;
-                remain -= cur->iov_len;
-                cur->iov_len = 0;
-                cl->recv_list.done++;
-            }
-        }
-        if (cl->recv_list.done >= cl->recv_list.count)
-        {
-            if (!handle_finished_read(cl))
-            {
-                return false;
-            }
-        }
-    }
-    return true;
-}
-
-bool osd_messenger_t::handle_finished_read(osd_client_t *cl)
+bool osd_messenger_t::handle_read_buffer(osd_client_t *cl, uint8_t *curbuf, size_t bufsize)
 {
    // Reset OSD ping state
    cl->ping_time_remaining = 0;
    cl->idle_time_remaining = osd_idle_timeout;
-    cl->recv_list.reset();
-    if (cl->read_state == CL_READ_HDR)
+    // Compose operation(s) from the buffer
+    size_t done = 0;
+    while (done < bufsize)
    {
-        if (cl->read_op->req.hdr.magic == SECONDARY_OSD_REPLY_MAGIC)
-            return handle_reply_hdr(cl);
-        else if (cl->read_op->req.hdr.magic == SECONDARY_OSD_OP_MAGIC)
+        if (!cl->read_op)
        {
-            if (cl->check_sequencing)
+            cl->read_op = new osd_op_t;
+            cl->read_op->client_id = cl->client_id;
+            cl->read_op->op_type = OSD_OP_IN;
+            cl->read_op_pos = 0;
+            cl->read_op_size = 0;
+            cl->read_op_inline_decrypt_in = 0;
+            cl->read_op_inline_decrypt_pos = (size_t)-1;
+            if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
            {
-                if (cl->read_op->req.hdr.id != cl->read_op_id)
-                {
-                    fprintf(stderr, "Warning: operation sequencing is broken on client %d: expected num %ju, got %ju, stopping client\n", cl->peer_fd, cl->read_op_id, cl->read_op->req.hdr.id);
-                    stop_client(cl->peer_fd);
-                    return false;
-                }
-                cl->read_op_id++;
+                if (!cl->read_csum_state)
+                    cl->read_csum_state = XXH3_createState();
+                XXH3_64bits_reset(cl->read_csum_state);
            }
-            handle_op_hdr(cl);
        }
-        else
+        if (cl->read_op_pos < OSD_PACKET_SIZE)
+        {
+            int len = OSD_PACKET_SIZE - cl->read_op_pos;
+            if (len > bufsize-done)
+                len = bufsize-done;
+            memcpy(cl->read_op->req.buf + cl->read_op_pos, curbuf+done, len);
+            done += len;
+            cl->read_op_pos += len;
+            if (cl->read_op_pos < OSD_PACKET_SIZE)
+                return true;
+            if (!handle_hdr(cl))
+            {
+                stop_client(cl->client_id);
+                return false;
+            }
+        }
+        if (!op_copy_from(cl, curbuf, bufsize, done))
        {
-            fprintf(stderr, "Received garbage: magic=%jx id=%ju opcode=%jx from %d\n", cl->read_op->req.hdr.magic, cl->read_op->req.hdr.id, cl->read_op->req.hdr.opcode, cl->peer_fd);
-            stop_client(cl->peer_fd);
            return false;
        }
    }
-    else if (cl->read_state == CL_READ_DATA)
-    {
-        // Operation is ready
-        cl->received_ops.push_back(cl->read_op);
-        set_immediate_ops.push_back(cl->read_op);
-        cl->read_op = NULL;
-        cl->read_state = 0;
-    }
-    else if (cl->read_state == CL_READ_REPLY_DATA)
-    {
-        // Reply is ready
-        handle_reply_ready(cl->read_op);
-        cl->read_op = NULL;
-        cl->read_state = 0;
-    }
-    else
-    {
-        assert(0);
-    }
    return true;
 }

-void osd_messenger_t::handle_op_hdr(osd_client_t *cl)
+bool osd_messenger_t::handle_hdr(osd_client_t *cl)
+{
+    if (cl->read_op->req.hdr.magic == SECONDARY_OSD_REPLY_MAGIC)
+    {
+        auto req_it = cl->sent_ops.find(cl->read_op->req.hdr.id);
+        if (req_it == cl->sent_ops.end())
+        {
+            // Command out of sync. Drop connection
+            fprintf(stderr, "Client %ju command out of sync: id %ju\n", cl->client_id, cl->read_op->req.hdr.id);
+            return false;
+        }
+        osd_op_t *op = req_it->second;
+        memcpy(op->reply.buf, cl->read_op->req.buf, OSD_PACKET_SIZE);
+        if (!allocate_reply_buffers(cl, op))
+        {
+            return false;
+        }
+        cl->sent_ops.erase(req_it);
+        delete cl->read_op;
+        cl->read_op = op;
+    }
+    else if (cl->read_op->req.hdr.magic == SECONDARY_OSD_OP_MAGIC)
+    {
+        if (cl->check_sequencing)
+        {
+            if (cl->read_op->req.hdr.id != cl->read_op_id)
+            {
+                fprintf(stderr, "Warning: operation sequencing is broken on client %d: expected num %ju, got %ju, stopping client\n", cl->peer_fd, cl->read_op_id, cl->read_op->req.hdr.id);
+                return false;
+            }
+            cl->read_op_id++;
+        }
+        if (!allocate_op_buffers(cl))
+        {
+            return false;
+        }
+    }
+    else
+    {
+        fprintf(stderr, "Received garbage: magic=%jx id=%ju opcode=%jx from client %ju\n", cl->read_op->req.hdr.magic, cl->read_op->req.hdr.id, cl->read_op->req.hdr.opcode, cl->client_id);
+        return false;
+    }
+    return true;
+}
+
+bool osd_messenger_t::allocate_op_buffers(osd_client_t *cl)
 {
    osd_op_t *cur_op = cl->read_op;
-    if (cur_op->req.hdr.opcode == OSD_OP_SEC_READ)
-    {
-        cl->read_remaining = 0;
-    }
-    else if (cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
+    cl->read_op_size = 0;
+    if (cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
        cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE)
    {
        if (cur_op->req.sec_rw.attr_len > 0)
@@ -296,14 +292,12 @@ void osd_messenger_t::handle_op_hdr(osd_client_t *cl)
                cur_op->bitmap = cur_op->rmw_buf = malloc_or_die(cur_op->req.sec_rw.attr_len);
            else
                cur_op->bitmap = &cur_op->bmp_data;
-            cl->recv_list.push_back(cur_op->bitmap, cur_op->req.sec_rw.attr_len);
        }
        if (cur_op->req.sec_rw.len > 0)
        {
            cur_op->buf = memalign_or_die(MEM_ALIGNMENT, cur_op->req.sec_rw.len);
-            cl->recv_list.push_back(cur_op->buf, cur_op->req.sec_rw.len);
        }
-        cl->read_remaining = cur_op->req.sec_rw.len + cur_op->req.sec_rw.attr_len;
+        cl->read_op_size = cur_op->req.sec_rw.len + cur_op->req.sec_rw.attr_len;
    }
    else if (cur_op->req.hdr.opcode == OSD_OP_SEC_STABILIZE ||
        cur_op->req.hdr.opcode == OSD_OP_SEC_ROLLBACK)
@@ -311,27 +305,24 @@ void osd_messenger_t::handle_op_hdr(osd_client_t *cl)
        if (cur_op->req.sec_stab.len > 0)
        {
            cur_op->buf = memalign_or_die(MEM_ALIGNMENT, cur_op->req.sec_stab.len);
-            cl->recv_list.push_back(cur_op->buf, cur_op->req.sec_stab.len);
        }
-        cl->read_remaining = cur_op->req.sec_stab.len;
+        cl->read_op_size = cur_op->req.sec_stab.len;
    }
    else if (cur_op->req.hdr.opcode == OSD_OP_SEC_READ_BMP)
    {
        if (cur_op->req.sec_read_bmp.len > 0)
        {
            cur_op->buf = memalign_or_die(MEM_ALIGNMENT, cur_op->req.sec_read_bmp.len);
-            cl->recv_list.push_back(cur_op->buf, cur_op->req.sec_read_bmp.len);
        }
-        cl->read_remaining = cur_op->req.sec_read_bmp.len;
+        cl->read_op_size = cur_op->req.sec_read_bmp.len;
    }
    else if (cur_op->req.hdr.opcode == OSD_OP_WRITE)
    {
        if (cur_op->req.rw.len > 0)
        {
            cur_op->buf = memalign_or_die(MEM_ALIGNMENT, cur_op->req.rw.len);
-            cl->recv_list.push_back(cur_op->buf, cur_op->req.rw.len);
        }
-        cl->read_remaining = cur_op->req.rw.len;
+        cl->read_op_size = cur_op->req.rw.len;
    }
    else if (cur_op->req.hdr.opcode == OSD_OP_SHOW_CONFIG)
    {
@@ -339,44 +330,19 @@ void osd_messenger_t::handle_op_hdr(osd_client_t *cl)
        {
            cur_op->buf = malloc_or_die(cur_op->req.show_conf.json_len+1);
            ((uint8_t*)cur_op->buf)[cur_op->req.show_conf.json_len] = 0;
-            cl->recv_list.push_back(cur_op->buf, cur_op->req.show_conf.json_len);
        }
-        cl->read_remaining = cur_op->req.show_conf.json_len;
+        cl->read_op_size = cur_op->req.show_conf.json_len;
    }
-    /*else if (cur_op->req.hdr.opcode == OSD_OP_READ ||
-        cur_op->req.hdr.opcode == OSD_OP_SCRUB ||
-        cur_op->req.hdr.opcode == OSD_OP_DESCRIBE)
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
    {
-        cl->read_remaining = 0;
-    }*/
-    if (cl->read_remaining > 0)
-    {
-        // Read data
-        cl->read_state = CL_READ_DATA;
-    }
-    else
-    {
-        // Operation is ready
-        cl->received_ops.push_back(cur_op);
-        set_immediate_ops.push_back(cur_op);
-        cl->read_op = NULL;
-        cl->read_state = 0;
+        cl->read_op_size += 8;
    }
+    return true;
 }

-bool osd_messenger_t::handle_reply_hdr(osd_client_t *cl)
+bool osd_messenger_t::allocate_reply_buffers(osd_client_t *cl, osd_op_t *op)
 {
-    auto req_it = cl->sent_ops.find(cl->read_op->req.hdr.id);
-    if (req_it == cl->sent_ops.end())
-    {
-        // Command out of sync. Drop connection
-        fprintf(stderr, "Client %d command out of sync: id %ju\n", cl->peer_fd, cl->read_op->req.hdr.id);
-        stop_client(cl->peer_fd);
-        return false;
-    }
-    osd_op_t *op = req_it->second;
-    memcpy(op->reply.buf, cl->read_op->req.buf, OSD_PACKET_SIZE);
-    cl->sent_ops.erase(req_it);
+    cl->read_op_size = 0;
    if (op->reply.hdr.opcode == OSD_OP_SEC_READ || op->reply.hdr.opcode == OSD_OP_READ)
    {
        // Read data. In this case we assume that the buffer is preallocated by the caller (!)
@@ -385,99 +351,370 @@ bool osd_messenger_t::handle_reply_hdr(osd_client_t *cl)
        if (op->reply.hdr.retval >= 0 && (op->reply.hdr.retval != expected_size || bmp_len > op->bitmap_len))
        {
            // Check reply length to not overflow the buffer
-            fprintf(stderr, "Client %d read reply of different length: expected %u+%u, got %jd+%u\n",
-                cl->peer_fd, expected_size, op->bitmap_len, op->reply.hdr.retval, bmp_len);
-            cl->sent_ops[op->req.hdr.id] = op;
-            stop_client(cl->peer_fd);
+            fprintf(stderr, "Client %ju read reply of different length: expected %u+%u, got %jd+%u\n",
+                cl->client_id, expected_size, op->bitmap_len, op->reply.hdr.retval, bmp_len);
            return false;
        }
        if (bmp_len > 0)
        {
            assert(op->bitmap);
-            cl->recv_list.push_back(op->bitmap, bmp_len);
-            cl->read_remaining += bmp_len;
+            cl->read_op_size += bmp_len;
        }
        if (op->reply.hdr.retval > 0)
        {
            assert(op->iov.count > 0);
-            cl->recv_list.append(op->iov);
-            cl->read_remaining += op->reply.hdr.retval;
+            cl->read_op_size += op->reply.hdr.retval;
        }
-        if (cl->read_remaining == 0)
-        {
-            goto reuse;
-        }
-        delete cl->read_op;
-        cl->read_op = op;
-        cl->read_state = CL_READ_REPLY_DATA;
    }
    else if (op->reply.hdr.opcode == OSD_OP_SEC_LIST && op->reply.hdr.retval > 0)
    {
        assert(!op->iov.count);
-        delete cl->read_op;
-        cl->read_op = op;
-        cl->read_state = CL_READ_REPLY_DATA;
-        cl->read_remaining = sizeof(obj_ver_id) * op->reply.hdr.retval;
-        op->buf = memalign_or_die(MEM_ALIGNMENT, cl->read_remaining);
-        cl->recv_list.push_back(op->buf, cl->read_remaining);
+        cl->read_op_size = sizeof(obj_ver_id) * op->reply.hdr.retval;
+        op->buf = memalign_or_die(MEM_ALIGNMENT, cl->read_op_size);
    }
    else if (op->reply.hdr.opcode == OSD_OP_SEC_READ_BMP && op->reply.hdr.retval > 0)
    {
        assert(!op->iov.count);
-        delete cl->read_op;
-        cl->read_op = op;
-        cl->read_state = CL_READ_REPLY_DATA;
-        cl->read_remaining = op->reply.hdr.retval;
+        cl->read_op_size = op->reply.hdr.retval;
        free(op->buf);
-        op->buf = memalign_or_die(MEM_ALIGNMENT, cl->read_remaining);
-        cl->recv_list.push_back(op->buf, cl->read_remaining);
+        op->buf = memalign_or_die(MEM_ALIGNMENT, cl->read_op_size);
    }
    else if (op->reply.hdr.opcode == OSD_OP_SHOW_CONFIG && op->reply.hdr.retval > 0)
    {
-        delete cl->read_op;
-        cl->read_op = op;
-        cl->read_state = CL_READ_REPLY_DATA;
-        cl->read_remaining = op->reply.hdr.retval;
+        cl->read_op_size = op->reply.hdr.retval;
        free(op->buf);
        op->buf = malloc_or_die(op->reply.hdr.retval);
-        cl->recv_list.push_back(op->buf, op->reply.hdr.retval);
    }
    else if (op->reply.hdr.opcode == OSD_OP_DESCRIBE && op->reply.describe.result_bytes > 0)
    {
-        delete cl->read_op;
-        cl->read_op = op;
-        cl->read_state = CL_READ_REPLY_DATA;
-        cl->read_remaining = op->reply.describe.result_bytes;
+        cl->read_op_size = op->reply.describe.result_bytes;
        free(op->buf);
        op->buf = malloc_or_die(op->reply.describe.result_bytes);
-        cl->recv_list.push_back(op->buf, op->reply.describe.result_bytes);
    }
-    else
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
    {
-reuse:
-        // It's fine to reuse cl->read_op for the next reply
-        handle_reply_ready(op);
-        cl->recv_list.push_back(cl->read_op->req.buf, OSD_PACKET_SIZE);
-        cl->read_remaining = OSD_PACKET_SIZE;
-        cl->read_state = CL_READ_HDR;
+        cl->read_op_size += 8;
    }
    return true;
 }

-void osd_messenger_t::handle_reply_ready(osd_op_t *op)
+bool osd_messenger_t::op_copy_from(osd_client_t *cl, uint8_t *src, size_t src_len, size_t & done)
 {
-    // Measure subop latency
-    timespec tv_end;
-    clock_gettime(CLOCK_REALTIME, &tv_end);
-    stats.subop_stat_count[op->req.hdr.opcode]++;
-    if (!stats.subop_stat_count[op->req.hdr.opcode])
+    osd_op_t *op = cl->read_op;
+    size_t from = cl->read_op_pos-OSD_PACKET_SIZE;
+    auto op_read_buf = [&](uint8_t *dst, size_t dst_len, bool skip_csum = false)
    {
-        stats.subop_stat_count[op->req.hdr.opcode]++;
-        stats.subop_stat_sum[op->req.hdr.opcode] = 0;
+        if (from < dst_len)
+        {
+            size_t n = dst_len-from;
+            if (n > src_len-done)
+                n = src_len-done;
+            if (cl->read_csum_state && !skip_csum)
+            {
+                // it may be skipped if !dst but checksum is still calculated
+                XXH3_64bits_update(cl->read_csum_state, src+done, n);
+            }
+            if (dst)
+                memcpy(dst+from, src+done, n);
+            else
+                assert(!this->osd_num); // NULL buffers are only used by clients
+            done += n;
+            cl->read_op_pos += n;
+            from += n;
+            if (from < dst_len)
+                return false;
+            from = 0;
+        }
+        else
+            from -= dst_len;
+        return true;
+    };
+    if (cl->read_csum_state && !from)
+    {
+        XXH3_64bits_update(cl->read_csum_state, (op->op_type == OSD_OP_IN ? op->req.buf : op->reply.buf), OSD_PACKET_SIZE);
    }
-    stats.subop_stat_sum[op->req.hdr.opcode] += (
-        (tv_end.tv_sec - op->tv_begin.tv_sec)*1000000 +
-        (tv_end.tv_nsec - op->tv_begin.tv_nsec)/1000
-    );
-    set_immediate_ops.push_back(op);
+    if (op->op_type == OSD_OP_IN)
+    {
+        if (op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
+            op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE)
+        {
+            if (!op_read_buf((uint8_t*)op->bitmap, op->req.sec_rw.attr_len))
+                return true;
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_rw.len))
+                return true;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SEC_STABILIZE ||
+            op->req.hdr.opcode == OSD_OP_SEC_ROLLBACK)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_stab.len))
+                return true;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SEC_READ_BMP)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_read_bmp.len))
+                return true;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_WRITE)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.rw.len))
+                return true;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SHOW_CONFIG)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.show_conf.json_len))
+                return true;
+        }
+    }
+    else
+    {
+        if (op->reply.hdr.opcode == OSD_OP_SEC_READ)
+        {
+            if (op->reply.sec_rw.attr_len > 0)
+            {
+                if (!op_read_buf((uint8_t*)op->bitmap, op->reply.sec_rw.attr_len))
+                    return true;
+            }
+            if (op->reply.hdr.retval > 0)
+            {
+                for (int i = 0; i < op->iov.count; i++)
+                    if (!op_read_buf((uint8_t*)op->iov.buf[i].iov_base, op->iov.buf[i].iov_len))
+                        return true;
+            }
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_READ)
+        {
+            if (op->reply.rw.bitmap_len > 0)
+            {
+                if (!op_read_buf((uint8_t*)op->bitmap, op->reply.rw.bitmap_len))
+                    return true;
+            }
+            if (op->reply.hdr.retval > 0)
+            {
+                if (op->enc)
+                {
+                    if (!op_decrypted_copy_data_from(cl, src, src_len, from, done))
+                        return true;
+                }
+                else
+                {
+                    for (int i = 0; i < op->iov.count; i++)
+                        if (!op_read_buf((uint8_t*)op->iov.buf[i].iov_base, op->iov.buf[i].iov_len))
+                            return true;
+                }
+            }
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_SEC_LIST && op->reply.hdr.retval > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, sizeof(obj_ver_id) * op->reply.hdr.retval))
+                return true;
+        }
+        else if ((op->reply.hdr.opcode == OSD_OP_SEC_READ_BMP ||
+            op->reply.hdr.opcode == OSD_OP_SHOW_CONFIG) && op->reply.hdr.retval > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->reply.hdr.retval))
+                return true;
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_DESCRIBE && op->reply.describe.result_bytes > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->reply.describe.result_bytes))
+                return true;
+        }
+    }
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
+    {
+        if (!op_read_buf((uint8_t*)&op->csum, 8, true))
+            return true;
+    }
+    return handle_finished_op(cl);
+}
+
+void osd_messenger_t::op_get_read_buffers(osd_client_t *cl, std::vector<iovec> & lst)
+{
+    osd_op_t *op = cl->read_op;
+    size_t from = cl->read_op_pos-OSD_PACKET_SIZE;
+    size_t done = 0;
+    auto op_read_buf = [&](uint8_t *dst, size_t dst_len)
+    {
+        if (lst.size() >= IOV_MAX)
+            return false;
+        if (from < dst_len)
+        {
+            lst.push_back((iovec){ .iov_base = dst+from, .iov_len = dst_len-from });
+            cl->read_op_pos += dst_len-from;
+            done += dst_len-from;
+            from = 0;
+        }
+        else
+            from -= dst_len;
+        return true;
+    };
+    if (op->op_type == OSD_OP_IN)
+    {
+        if (op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
+            op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE)
+        {
+            if (!op_read_buf((uint8_t*)op->bitmap, op->req.sec_rw.attr_len))
+                return;
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_rw.len))
+                return;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SEC_STABILIZE ||
+            op->req.hdr.opcode == OSD_OP_SEC_ROLLBACK)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_stab.len))
+                return;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SEC_READ_BMP)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.sec_read_bmp.len))
+                return;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_WRITE)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.rw.len))
+                return;
+        }
+        else if (op->req.hdr.opcode == OSD_OP_SHOW_CONFIG)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->req.show_conf.json_len))
+                return;
+        }
+    }
+    else
+    {
+        if (op->reply.hdr.opcode == OSD_OP_SEC_READ)
+        {
+            if (op->reply.sec_rw.attr_len > 0)
+            {
+                if (!op_read_buf((uint8_t*)op->bitmap, op->reply.sec_rw.attr_len))
+                    return;
+            }
+            if (op->reply.hdr.retval > 0)
+            {
+                for (int i = 0; i < op->iov.count; i++)
+                    if (!op_read_buf((uint8_t*)op->iov.buf[i].iov_base, op->iov.buf[i].iov_len))
+                        return;
+            }
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_READ)
+        {
+            if (op->reply.rw.bitmap_len > 0)
+            {
+                if (!op_read_buf((uint8_t*)op->bitmap, op->reply.rw.bitmap_len))
+                    return;
+            }
+            if (op->reply.hdr.retval > 0)
+            {
+                if (op->enc)
+                {
+                    cl->read_op_inline_decrypt_pos = cl->read_op_pos;
+                    cl->read_op_pos = cl->read_op_inline_decrypt_in + OSD_PACKET_SIZE + op->reply.rw.bitmap_len;
+                    from = cl->read_op_inline_decrypt_in;
+                }
+                for (int i = 0; i < op->iov.count; i++)
+                {
+                    if (!op->iov.buf[i].iov_base)
+                    {
+                        // When we recvmsg directly into the operation without copying,
+                        // we need some place for all buffers, so we allocate temporary
+                        // buffers for all skipped parts
+                        op_alloc_temp_buffers(op, i);
+                    }
+                    if (!op_read_buf((uint8_t*)op->iov.buf[i].iov_base, op->iov.buf[i].iov_len))
+                        return;
+                }
+            }
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_SEC_LIST && op->reply.hdr.retval > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, sizeof(obj_ver_id) * op->reply.hdr.retval))
+                return;
+        }
+        else if ((op->reply.hdr.opcode == OSD_OP_SEC_READ_BMP ||
+            op->reply.hdr.opcode == OSD_OP_SHOW_CONFIG) && op->reply.hdr.retval > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->reply.hdr.retval))
+                return;
+        }
+        else if (op->reply.hdr.opcode == OSD_OP_DESCRIBE && op->reply.describe.result_bytes > 0)
+        {
+            if (!op_read_buf((uint8_t*)op->buf, op->reply.describe.result_bytes))
+                return;
+        }
+    }
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
+    {
+        if (!op_read_buf((uint8_t*)&op->csum, 8))
+            return;
+    }
+}
+
+void osd_messenger_t::op_alloc_temp_buffers(osd_op_t *op, int i)
+{
+    size_t total_skip = 0;
+    for (int j = i; j < op->iov.count; j++)
+    {
+        if (!op->iov.buf[j].iov_base)
+        {
+            total_skip += op->iov.buf[j].iov_len;
+        }
+    }
+    assert(total_skip);
+    assert(!op->rmw_buf);
+    op->rmw_buf = malloc_or_die(total_skip);
+    total_skip = 0;
+    for (int j = i; j < op->iov.count; j++)
+    {
+        if (!op->iov.buf[j].iov_base)
+        {
+            op->iov.buf[j].iov_base = (uint8_t*)op->rmw_buf + total_skip;
+            total_skip += op->iov.buf[j].iov_len;
+        }
+    }
+}
+
+bool osd_messenger_t::handle_finished_op(osd_client_t *cl)
+{
+    osd_op_t *op = cl->read_op;
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT))
+    {
+        uint64_t real_csum = XXH3_64bits_digest(cl->read_csum_state);
+        if (op->csum != real_csum)
+        {
+            fprintf(stderr, "Client %ju checksum mismatch for received data: expected %016jx, got %016jx, disconnecting client\n",
+                cl->client_id, op->csum, real_csum);
+            stop_client(cl->client_id);
+            return false;
+        }
+    }
+    if (op->op_type == OSD_OP_IN)
+    {
+        // Operation is ready
+        cl->received_ops.push_back(op);
+    }
+    else
+    {
+        // Inline decryption
+        if (cl->read_op_inline_decrypt_pos != (size_t)-1)
+        {
+            op_decrypt_inline(cl);
+            cl->read_op_inline_decrypt_pos = (size_t)-1;
+        }
+        // Measure subop (outbound op) latency
+        timespec tv_end;
+        clock_gettime(CLOCK_REALTIME, &tv_end);
+        stats.subop_stat_count[op->req.hdr.opcode]++;
+        if (!stats.subop_stat_count[op->req.hdr.opcode])
+        {
+            stats.subop_stat_count[op->req.hdr.opcode]++;
+            stats.subop_stat_sum[op->req.hdr.opcode] = 0;
+        }
+        stats.subop_stat_sum[op->req.hdr.opcode] += (
+            (tv_end.tv_sec - op->tv_begin.tv_sec)*1000000 +
+            (tv_end.tv_nsec - op->tv_begin.tv_nsec)/1000
+        );
+    }
+    set_immediate_ops.push_back(op);
+    cl->read_op = NULL;
+    return true;
 }
@@ -9,17 +9,23 @@

 void osd_messenger_t::outbox_push(osd_op_t *cur_op)
 {
-    assert(cur_op->peer_fd);
-    osd_client_t *cl = clients.at(cur_op->peer_fd);
+    assert(cur_op->client_id);
+    auto cl_it = clients.find(cur_op->client_id);
+    if (cl_it == clients.end() || cl_it->second->peer_state == PEER_STOPPED)
+    {
+        delete cur_op;
+        return;
+    }
+    osd_client_t *cl = cl_it->second;
    if (cur_op->op_type == OSD_OP_OUT)
    {
        clock_gettime(CLOCK_REALTIME, &cur_op->tv_begin);
        cur_op->req.hdr.id = ++cl->send_op_id;
+        cl->sent_ops[cur_op->req.hdr.id] = cur_op;
    }
    else
    {
-        // Check that operation actually belongs to this client
-        // FIXME: Review if this is still needed
+        // Remove the operation from received op list
        bool found = false;
        for (auto it = cl->received_ops.begin(); it != cl->received_ops.end(); it++)
        {
@@ -30,82 +36,11 @@ void osd_messenger_t::outbox_push(osd_op_t *cur_op)
                break;
            }
        }
-        if (!found)
-        {
-            delete cur_op;
-            return;
-        }
-    }
-    auto & to_send_list = cl->write_msg.msg_iovlen ? cl->next_send_list : cl->send_list;
-    auto & to_outbox = cl->write_msg.msg_iovlen ? cl->next_outbox : cl->outbox;
-    if (cur_op->op_type == OSD_OP_IN)
-    {
+        // Can't be not found because client IDs are unique
+        assert(found);
        measure_exec(cur_op);
-        to_send_list.push_back((iovec){ .iov_base = cur_op->reply.buf, .iov_len = OSD_PACKET_SIZE });
-    }
-    else
-    {
-        to_send_list.push_back((iovec){ .iov_base = cur_op->req.buf, .iov_len = OSD_PACKET_SIZE });
-        cl->sent_ops[cur_op->req.hdr.id] = cur_op;
-    }
-    to_outbox.push_back((msgr_sendp_t){ .op = cur_op, .flags = MSGR_SENDP_HDR });
-    // Bitmap
-    if (cur_op->op_type == OSD_OP_IN &&
-        cur_op->req.hdr.opcode == OSD_OP_SEC_READ &&
-        cur_op->reply.sec_rw.attr_len > 0)
-    {
-        to_send_list.push_back((iovec){
-            .iov_base = cur_op->bitmap,
-            .iov_len = cur_op->reply.sec_rw.attr_len,
-        });
-        to_outbox.push_back((msgr_sendp_t){ .op = cur_op, .flags = 0 });
-    }
-    else if (cur_op->op_type == OSD_OP_OUT &&
-        (cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE || cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE) &&
-        cur_op->req.sec_rw.attr_len > 0)
-    {
-        to_send_list.push_back((iovec){
-            .iov_base = cur_op->bitmap,
-            .iov_len = cur_op->req.sec_rw.attr_len,
-        });
-        to_outbox.push_back((msgr_sendp_t){ .op = cur_op, .flags = 0 });
-    }
-    // Operation data
-    if ((cur_op->op_type == OSD_OP_IN
-        ? (cur_op->req.hdr.opcode == OSD_OP_READ ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_READ ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_LIST ||
-        cur_op->req.hdr.opcode == OSD_OP_SHOW_CONFIG ||
-        cur_op->req.hdr.opcode == OSD_OP_DESCRIBE)
-        : (cur_op->req.hdr.opcode == OSD_OP_WRITE ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_STABILIZE ||
-        cur_op->req.hdr.opcode == OSD_OP_SEC_ROLLBACK ||
-        cur_op->req.hdr.opcode == OSD_OP_SHOW_CONFIG)) && cur_op->iov.count > 0)
-    {
-        for (int i = 0; i < cur_op->iov.count; i++)
-        {
-            if (cur_op->iov.buf[i].iov_len > 0)
-            {
-                assert(cur_op->iov.buf[i].iov_base);
-                to_send_list.push_back(cur_op->iov.buf[i]);
-                to_outbox.push_back((msgr_sendp_t){ .op = cur_op, .flags = 0 });
-            }
-        }
-    }
-    if (cur_op->req.hdr.opcode == OSD_OP_SEC_READ_BMP)
-    {
-        if (cur_op->op_type == OSD_OP_IN && cur_op->reply.hdr.retval > 0)
-            to_send_list.push_back((iovec){ .iov_base = cur_op->buf, .iov_len = (size_t)cur_op->reply.hdr.retval });
-        else if (cur_op->op_type == OSD_OP_OUT && cur_op->req.sec_read_bmp.len > 0)
-            to_send_list.push_back((iovec){ .iov_base = cur_op->buf, .iov_len = (size_t)cur_op->req.sec_read_bmp.len });
-        to_outbox.push_back((msgr_sendp_t){ .op = cur_op, .flags = 0 });
-    }
-    if (cur_op->op_type == OSD_OP_IN)
-    {
-        to_outbox[to_outbox.size()-1].flags |= MSGR_SENDP_FREE;
    }
+    cl->write_ops.push_back(cur_op);
 #ifdef WITH_RDMA
    if (cl->peer_state == PEER_RDMA)
    {
@@ -116,7 +51,7 @@ void osd_messenger_t::outbox_push(osd_op_t *cur_op)
    if (!ringloop)
    {
        // FIXME: It's worse because it doesn't allow batching
-        while (cl->outbox.size())
+        while (cl->write_op || cl->write_ops.size())
        {
            try_send(cl);
        }
@@ -126,7 +61,7 @@ void osd_messenger_t::outbox_push(osd_op_t *cur_op)
        if ((cl->write_msg.msg_iovlen > 0 || !try_send(cl)) && (cl->write_state == 0))
        {
            cl->write_state = CL_WRITE_READY;
-            write_ready_clients.push_back(cur_op->peer_fd);
+            write_ready_clients.push_back(cur_op->client_id);
        }
        ringloop->wakeup();
    }
@@ -183,15 +118,28 @@ void osd_messenger_t::measure_exec(osd_op_t *cur_op)

 bool osd_messenger_t::try_send(osd_client_t *cl)
 {
-    int peer_fd = cl->peer_fd;
-    if (!cl->send_list.size() || cl->write_msg.msg_iovlen > 0)
+    if (!cl->write_op && !cl->write_ops.size() || cl->write_msg.msg_iovlen > 0 || cl->peer_state == PEER_STOPPED || cl->peer_fd < 0)
    {
        return true;
    }
    assert(cl->peer_state != PEER_RDMA);
+    while ((cl->write_op || cl->write_ops.size()) && cl->send_list.size() < IOV_MAX)
+    {
+        if (!cl->write_op)
+        {
+            cl->write_op = cl->write_ops.front();
+            cl->write_ops.pop_front();
+        }
+        osd_op_t *op = cl->write_op;
+        op_get_write_buffers(cl, cl->send_list);
+        if (!cl->write_op && op->op_type == OSD_OP_IN)
+        {
+            cl->send_free_ops.push_back(op);
+        }
+    }
    if (ringloop && !use_sync_send_recv)
    {
-        auto iothread = iothreads.size() ? iothreads[peer_fd % iothreads.size()] : NULL;
+        auto iothread = iothreads.size() ? iothreads[cl->peer_fd % iothreads.size()] : NULL;
        io_uring_sqe sqe_local;
        ring_data_t data_local;
        io_uring_sqe* sqe = (iothread ? &sqe_local : ringloop->get_sqe());
@@ -201,28 +149,32 @@ bool osd_messenger_t::try_send(osd_client_t *cl)
            data_local = {};
        }
        if (!sqe)
+        {
            return false;
+        }
+        cl->send_list_size = 0;
+        for (auto & iov: cl->send_list)
+        {
+            cl->send_list_size += iov.iov_len;
+        }
        cl->write_msg.msg_iov = cl->send_list.data();
        cl->write_msg.msg_iovlen = cl->send_list.size() < IOV_MAX ? cl->send_list.size() : IOV_MAX;
        cl->refs++;
        ring_data_t* data = ((ring_data_t*)sqe->user_data);
        data->callback = [this, cl](ring_data_t *data) { handle_send(data->res, data->prev, data->more, cl); };
        bool use_zc = has_sendmsg_zc && min_zerocopy_send_size >= 0;
-        if (use_zc && min_zerocopy_send_size > 0)
+        if (use_zc && min_zerocopy_send_size > 0 &&
+            cl->send_list_size/cl->write_msg.msg_iovlen < min_zerocopy_send_size)
        {
-            size_t avg_size = 0;
-            for (size_t i = 0; i < cl->write_msg.msg_iovlen; i++)
-                avg_size += cl->write_msg.msg_iov[i].iov_len;
-            if (avg_size/cl->write_msg.msg_iovlen < min_zerocopy_send_size)
-                use_zc = false;
+            use_zc = false;
        }
        if (use_zc)
        {
-            io_uring_prep_sendmsg_zc(sqe, peer_fd, &cl->write_msg, MSG_WAITALL);
+            io_uring_prep_sendmsg_zc(sqe, cl->peer_fd, &cl->write_msg, MSG_WAITALL);
        }
        else
        {
-            io_uring_prep_sendmsg(sqe, peer_fd, &cl->write_msg, MSG_WAITALL);
+            io_uring_prep_sendmsg(sqe, cl->peer_fd, &cl->write_msg, MSG_WAITALL);
        }
        if (iothread)
        {
@@ -234,7 +186,7 @@ bool osd_messenger_t::try_send(osd_client_t *cl)
        cl->write_msg.msg_iov = cl->send_list.data();
        cl->write_msg.msg_iovlen = cl->send_list.size() < IOV_MAX ? cl->send_list.size() : IOV_MAX;
        cl->refs++;
-        int result = sendmsg(peer_fd, &cl->write_msg, MSG_NOSIGNAL);
+        int result = sendmsg(cl->peer_fd, &cl->write_msg, MSG_NOSIGNAL);
        if (result < 0)
        {
            result = -errno;
@@ -249,8 +201,8 @@ void osd_messenger_t::send_replies()
 {
    for (int i = 0; i < write_ready_clients.size(); i++)
    {
-        int peer_fd = write_ready_clients[i];
-        auto cl_it = clients.find(peer_fd);
+        uint64_t client_id = write_ready_clients[i];
+        auto cl_it = clients.find(client_id);
        if (cl_it != clients.end() && cl_it->second->peer_state != PEER_RDMA && !try_send(cl_it->second))
        {
            write_ready_clients.erase(write_ready_clients.begin(), write_ready_clients.begin() + i);
@@ -265,6 +217,7 @@ void osd_messenger_t::handle_send(int result, bool prev, bool more, osd_client_t
    if (!prev)
    {
        cl->write_msg.msg_iovlen = 0;
+        cl->send_list.clear();
    }
    if (!more)
    {
@@ -274,15 +227,15 @@ void osd_messenger_t::handle_send(int result, bool prev, bool more, osd_client_t
    {
        if (cl->refs <= 0)
        {
-            delete cl;
+            destroy_client(cl);
        }
        return;
    }
    if (result < 0 && result != -EAGAIN && result != -EINTR)
    {
        // this is a client socket, so don't panic. just disconnect it
-        fprintf(stderr, "Client %d socket write error: %d (%s). Disconnecting client\n", cl->peer_fd, -result, strerror(-result));
-        stop_client(cl->peer_fd);
+        fprintf(stderr, "Client %ju socket write error: %d (%s). Disconnecting client\n", cl->client_id, -result, strerror(-result));
+        stop_client(cl->client_id);
        return;
    }
    if (result >= 0)
@@ -297,62 +250,36 @@ void osd_messenger_t::handle_send(int result, bool prev, bool more, osd_client_t
                cl->zc_free_list.erase(cl->zc_free_list.begin(), cl->zc_free_list.begin()+i+1);
            return;
        }
-        int done = 0;
-        while (result > 0 && done < cl->send_list.size())
+        if (cl->send_list_size > result)
        {
-            iovec & iov = cl->send_list[done];
-            if (iov.iov_len <= result)
-            {
-                if (cl->outbox[done].flags & MSGR_SENDP_FREE)
-                {
-                    // Reply fully sent
-                    if (more)
-                        cl->zc_free_list.push_back(cl->outbox[done].op);
-                    else
-                        delete cl->outbox[done].op;
-                }
-                result -= iov.iov_len;
-                done++;
-            }
+            fprintf(stderr, "Client %ju socket write error: expected to send "
+                "%zu bytes with MSG_WAITALL but sent %u. Disconnecting client\n", cl->client_id, cl->send_list_size, result);
+            stop_client(cl->client_id);
+            return;
+        }
+        for (auto op: cl->send_free_ops)
+        {
+            if (more)
+                cl->zc_free_list.push_back(op);
            else
-            {
-                iov.iov_len -= result;
-                iov.iov_base = (uint8_t*)iov.iov_base + result;
-                break;
-            }
+                delete op;
        }
        if (more)
-        {
-            int expected = cl->send_list.size() < IOV_MAX ? cl->send_list.size() : IOV_MAX;
-            if (done != expected)
-            {
-                fprintf(stderr, "Client %d socket write error: expected to send "
-                    "%d iovecs with MSG_WAITALL but sent %d. Disconnecting client\n", cl->peer_fd, expected, done);
-                stop_client(cl->peer_fd);
-                return;
-            }
            cl->zc_free_list.push_back(NULL); // end marker
-        }
-        if (done > 0)
+        cl->send_free_ops.clear();
+        cl->write_state = cl->write_op || cl->write_ops.size() ? CL_WRITE_READY : 0;
+        if (cl->proto_csum_status == MSGR_PEER_CSUM_IN && !cl->write_op && !cl->write_ops.size())
        {
-            cl->send_list.erase(cl->send_list.begin(), cl->send_list.begin()+done);
-            cl->outbox.erase(cl->outbox.begin(), cl->outbox.begin()+done);
+            // Checksums negotiated, enable
+            cl->proto_csum_status = MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT;
        }
-        if (cl->next_send_list.size())
-        {
-            cl->send_list.insert(cl->send_list.end(), cl->next_send_list.begin(), cl->next_send_list.end());
-            cl->outbox.insert(cl->outbox.end(), cl->next_outbox.begin(), cl->next_outbox.end());
-            cl->next_send_list.clear();
-            cl->next_outbox.clear();
-        }
-        cl->write_state = cl->outbox.size() > 0 ? CL_WRITE_READY : 0;
 #ifdef WITH_RDMA
-        if (cl->rdma_conn && !cl->outbox.size() && cl->peer_state == PEER_RDMA_CONNECTING)
+        if (cl->rdma_conn && !cl->write_op && !cl->write_ops.size() && cl->peer_state == PEER_RDMA_CONNECTING)
        {
            // FIXME: Ignore pings during RDMA state transition
            if (log_level > 0)
            {
-                fprintf(stderr, "Successfully connected with client %d using RDMA\n", cl->peer_fd);
+                fprintf(stderr, "Successfully connected with client %ju using RDMA\n", cl->client_id);
            }
            cl->peer_state = PEER_RDMA;
            // Add the initial receive request
@@ -362,6 +289,191 @@ void osd_messenger_t::handle_send(int result, bool prev, bool more, osd_client_t
    }
    if (cl->write_state != 0)
    {
-        write_ready_clients.push_back(cl->peer_fd);
+        write_ready_clients.push_back(cl->client_id);
    }
 }
+
+static inline bool op_write_headers(osd_op_t *op, std::function<bool(uint8_t*, size_t)> op_write_buf)
+{
+    // Header
+    if (!op_write_buf((op->op_type == OSD_OP_IN ? op->reply.buf : op->req.buf), OSD_PACKET_SIZE))
+        return false;
+    // Bitmap
+    if (op->op_type == OSD_OP_IN &&
+        op->req.hdr.opcode == OSD_OP_SEC_READ &&
+        op->reply.sec_rw.attr_len > 0)
+    {
+        if (!op_write_buf((uint8_t*)op->bitmap, op->reply.sec_rw.attr_len))
+            return false;
+    }
+    else if (op->op_type == OSD_OP_OUT &&
+        (op->req.hdr.opcode == OSD_OP_SEC_WRITE || op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE) &&
+        op->req.sec_rw.attr_len > 0)
+    {
+        if (!op_write_buf((uint8_t*)op->bitmap, op->req.sec_rw.attr_len))
+            return false;
+    }
+    if (op->req.hdr.opcode == OSD_OP_SEC_READ_BMP)
+    {
+        if (op->op_type == OSD_OP_IN && op->reply.hdr.retval > 0)
+        {
+            if (!op_write_buf((uint8_t*)op->buf, (size_t)op->reply.hdr.retval))
+                return false;
+        }
+        else if (op->op_type == OSD_OP_OUT && op->req.sec_read_bmp.len > 0)
+        {
+            if (!op_write_buf((uint8_t*)op->buf, (size_t)op->req.sec_read_bmp.len))
+                return false;
+        }
+    }
+    return true;
+}
+
+static inline bool op_has_data(osd_op_t *op)
+{
+    return (op->op_type == OSD_OP_IN
+        ? (op->req.hdr.opcode == OSD_OP_READ ||
+        op->req.hdr.opcode == OSD_OP_SEC_READ ||
+        op->req.hdr.opcode == OSD_OP_SEC_LIST ||
+        op->req.hdr.opcode == OSD_OP_SHOW_CONFIG ||
+        op->req.hdr.opcode == OSD_OP_DESCRIBE)
+        : (op->req.hdr.opcode == OSD_OP_WRITE ||
+        op->req.hdr.opcode == OSD_OP_SEC_WRITE ||
+        op->req.hdr.opcode == OSD_OP_SEC_WRITE_STABLE ||
+        op->req.hdr.opcode == OSD_OP_SEC_STABILIZE ||
+        op->req.hdr.opcode == OSD_OP_SEC_ROLLBACK ||
+        op->req.hdr.opcode == OSD_OP_SHOW_CONFIG)) && op->iov.count > 0;
+}
+
+size_t osd_messenger_t::op_copy_to(osd_client_t *cl, uint8_t *dst, size_t dst_len)
+{
+    size_t done = 0;
+    size_t from = cl->write_op_pos;
+    auto op_write_buf = [&](uint8_t *src, size_t src_len, bool skip_csum = false)
+    {
+        if (from < src_len)
+        {
+            size_t n = src_len-from;
+            if (n > dst_len-done)
+                n = dst_len-done;
+            if (cl->write_csum_state && !skip_csum)
+                XXH3_64bits_update(cl->write_csum_state, src+from, n);
+            memcpy(dst+done, src+from, n);
+            done += n;
+            cl->write_op_pos += n;
+            from += n;
+            if (from < src_len)
+                return false;
+            from = 0;
+        }
+        else
+            from -= src_len;
+        return true;
+    };
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT) && !from)
+    {
+        if (!cl->write_csum_state)
+            cl->write_csum_state = XXH3_createState();
+        XXH3_64bits_reset(cl->write_csum_state);
+    }
+    if (!op_write_headers(cl->write_op, op_write_buf))
+    {
+        return done;
+    }
+    // Operation data
+    if (op_has_data(cl->write_op))
+    {
+        if (cl->write_op->enc)
+        {
+            if (!op_encrypted_copy_data_to(cl, dst, dst_len, from, done))
+            {
+                return done;
+            }
+        }
+        else
+        {
+            for (int i = 0; i < cl->write_op->iov.count; i++)
+            {
+                if (!op_write_buf((uint8_t*)cl->write_op->iov.buf[i].iov_base, cl->write_op->iov.buf[i].iov_len))
+                    return done;
+            }
+        }
+    }
+    if (cl->write_csum_state)
+    {
+        if (!from)
+            cl->write_op->csum = XXH3_64bits_digest(cl->write_csum_state);
+        if (!op_write_buf((uint8_t*)&cl->write_op->csum, 8, true))
+            return done;
+    }
+    cl->write_op = NULL;
+    cl->write_op_pos = 0;
+    return done;
+}
+
+void osd_messenger_t::op_get_write_buffers(osd_client_t *cl, std::vector<iovec> & lst)
+{
+    size_t from = cl->write_op_pos;
+    auto op_write_buf = [&](uint8_t *src, size_t src_len, bool skip_csum = false)
+    {
+        if (lst.size() >= IOV_MAX)
+            return false;
+        if (from < src_len)
+        {
+            if (cl->write_csum_state && !skip_csum)
+                XXH3_64bits_update(cl->write_csum_state, src+from, src_len-from);
+            lst.push_back((iovec){ .iov_base = src+from, .iov_len = src_len-from });
+            cl->write_op_pos += src_len-from;
+            from = 0;
+        }
+        else
+            from -= src_len;
+        return true;
+    };
+    if (cl->proto_csum_status == (MSGR_PEER_CSUM_IN|MSGR_PEER_CSUM_OUT) && !from)
+    {
+        if (!cl->write_csum_state)
+            cl->write_csum_state = XXH3_createState();
+        XXH3_64bits_reset(cl->write_csum_state);
+    }
+    if (!op_write_headers(cl->write_op, op_write_buf))
+    {
+        return;
+    }
+    // Operation data
+    if (op_has_data(cl->write_op))
+    {
+        if (cl->write_op->enc)
+        {
+            if (lst.size() >= IOV_MAX)
+                return;
+            // No way except to allocate a temporary buffer and encrypt data to it
+            assert(cl->write_op->req.hdr.opcode == OSD_OP_WRITE);
+            size_t remsize = cl->write_op->req.rw.len - from + (from % 16);
+            assert(remsize > 0);
+            assert(!cl->write_op->enc_buf);
+            cl->write_op->enc_buf = (uint8_t*)malloc_or_die(remsize);
+            size_t done = 0;
+            bool end = op_encrypted_copy_data_to(cl, cl->write_op->enc_buf, remsize, from, done);
+            assert(end);
+            lst.push_back((iovec){ .iov_base = cl->write_op->enc_buf, .iov_len = remsize });
+        }
+        else
+        {
+            for (int i = 0; i < cl->write_op->iov.count; i++)
+            {
+                if (!op_write_buf((uint8_t*)cl->write_op->iov.buf[i].iov_base, cl->write_op->iov.buf[i].iov_len))
+                    return;
+            }
+        }
+    }
+    if (cl->write_csum_state)
+    {
+        if (!from)
+            cl->write_op->csum = XXH3_64bits_digest(cl->write_csum_state);
+        if (!op_write_buf((uint8_t*)&cl->write_op->csum, 8, true))
+            return;
+    }
+    cl->write_op = NULL;
+    cl->write_op_pos = 0;
+}
@@ -5,6 +5,7 @@
 #include <assert.h>

 #include "messenger.h"
+#include "../util/xxh_x86dispatch.h"
 #ifdef WITH_RDMA
 #include "msgr_rdma.h"
 #endif
@@ -43,47 +44,69 @@ void osd_op_t::cancel()
    }
 }

-void osd_messenger_t::stop_client(int peer_fd, bool force, bool force_delete)
+// force_delete means stop the client anyway, even if there are refs to it in the event loop.
+// the flag should be used in the destructor.
+// why? - because yes, we could close the FD first and let it fail all requests in the event loop,
+// but in that case it can be quickly reopened and we can get old failed responses for the new FD.
+void osd_messenger_t::stop_client(uint64_t client_id, bool force_delete)
 {
-    assert(peer_fd != 0);
-    auto it = clients.find(peer_fd);
-    if (it == clients.end())
+    auto it = clients.find(client_id);
+    if (!client_id || it == clients.end())
    {
        return;
    }
    osd_client_t *cl = it->second;
-    // FIXME: This 'force' flag is probably an ugly reenterability hack - check its logic and maybe remove it
-    if (cl->peer_state == PEER_CONNECTING && !force || cl->peer_state == PEER_STOPPED)
+    if (cl->peer_state == PEER_STOPPED)
    {
+        if (force_delete)
+        {
+            destroy_client(cl);
+        }
        return;
    }
-    clear_immediate_ops(peer_fd);
+    cl->received_ops.clear();
    if (log_level > 0)
    {
        if (cl->osd_num)
        {
-            fprintf(stderr, "[OSD %ju] Stopping client %d (OSD peer %ju)\n", osd_num, peer_fd, cl->osd_num);
+            fprintf(stderr, "[OSD %ju] Stopping client %ju (OSD peer %ju)\n", osd_num, client_id, cl->osd_num);
        }
        else if (cl->in_osd_num)
        {
-            fprintf(stderr, "[OSD %ju] Stopping client %d (incoming OSD peer %ju)\n", osd_num, peer_fd, cl->in_osd_num);
+            fprintf(stderr, "[OSD %ju] Stopping client %ju (incoming OSD peer %ju)\n", osd_num, client_id, cl->in_osd_num);
        }
        else
        {
-            fprintf(stderr, "[OSD %ju] Stopping client %d (regular client)\n", osd_num, peer_fd);
+            fprintf(stderr, "[OSD %ju] Stopping client %ju (regular client)\n", osd_num, client_id);
        }
    }
+    if (cl->encrypt_ctx)
+    {
+        if (encrypt_ctx_pool.size() > max_aes_xts_pool_size)
+            destroy_aes_xts_encrypt(cl->encrypt_ctx);
+        else
+            encrypt_ctx_pool.push_back(cl->encrypt_ctx);
+        cl->encrypt_ctx = NULL;
+    }
+    if (cl->decrypt_ctx)
+    {
+        if (decrypt_ctx_pool.size() > max_aes_xts_pool_size)
+            destroy_aes_xts_decrypt(cl->decrypt_ctx);
+        else
+            decrypt_ctx_pool.push_back(cl->decrypt_ctx);
+        cl->decrypt_ctx = NULL;
+    }
    // First set state to STOPPED so another stop_client() call doesn't try to free it again
    cl->refs++;
    int prev_state = cl->peer_state;
    cl->peer_state = PEER_STOPPED;
    if (cl->osd_num)
    {
-        auto osd_it = osd_peer_fds.find(cl->osd_num);
-        if (osd_it != osd_peer_fds.end() && osd_it->second == cl->peer_fd)
+        auto osd_it = osd_peers.find(cl->osd_num);
+        if (osd_it != osd_peers.end() && osd_it->second == cl)
        {
            // ...and forget OSD peer
-            osd_peer_fds.erase(osd_it);
+            osd_peers.erase(osd_it);
        }
    }
 #ifdef WITH_RDMA
@@ -97,29 +120,11 @@ void osd_messenger_t::stop_client(int peer_fd, bool force, bool force_delete)
    }
 #endif
 #ifndef __MOCK__
-    // Then remove FD from the eventloop so we don't accidentally read something
-    tfd->set_fd_handler(peer_fd, false, NULL);
    if (cl->connect_timeout_id >= 0)
    {
        tfd->clear_timer(cl->connect_timeout_id);
        cl->connect_timeout_id = -1;
    }
-    for (auto rit = read_ready_clients.begin(); rit != read_ready_clients.end(); rit++)
-    {
-        if (*rit == peer_fd)
-        {
-            read_ready_clients.erase(rit);
-            break;
-        }
-    }
-    for (auto wit = write_ready_clients.begin(); wit != write_ready_clients.end(); wit++)
-    {
-        if (*wit == peer_fd)
-        {
-            write_ready_clients.erase(wit);
-            break;
-        }
-    }
 #endif
    if (cl->in_osd_num && break_pg_locks)
    {
@@ -134,19 +139,51 @@ void osd_messenger_t::stop_client(int peer_fd, bool force, bool force_delete)
        // so do not repeer on it.
        repeer_pgs(cl->osd_num);
    }
-    // Find the item again because it can be invalidated at this point
-    it = clients.find(peer_fd);
-    if (it != clients.end())
+    if (cl->peer_fd >= 0)
    {
-        clients.erase(it);
+        int r = shutdown(cl->peer_fd, SHUT_RDWR);
+        if (r != 0 && errno != ENOTCONN)
+        {
+            fprintf(stderr, "[OSD %ju] failed to shutdown a socket: %s (code %d)\n", osd_num, strerror(errno), errno);
+        }
    }
    cl->refs--;
    if (cl->refs <= 0 || force_delete)
    {
-        delete cl;
+        destroy_client(cl);
    }
 }

+void osd_messenger_t::destroy_client(osd_client_t *cl)
+{
+    // Find the item again because it can be invalidated at this point
+    clients.erase(cl->client_id);
+    if (cl->peer_fd >= 0)
+    {
+#ifndef __MOCK__
+        tfd->set_fd_handler(cl->peer_fd, false, NULL);
+#endif
+        for (auto rit = read_ready_clients.begin(); rit != read_ready_clients.end(); rit++)
+        {
+            if (*rit == cl->client_id)
+            {
+                read_ready_clients.erase(rit);
+                break;
+            }
+        }
+        for (auto wit = write_ready_clients.begin(); wit != write_ready_clients.end(); wit++)
+        {
+            if (*wit == cl->client_id)
+            {
+                write_ready_clients.erase(wit);
+                break;
+            }
+        }
+        clients_by_fd.erase(cl->peer_fd);
+    }
+    delete cl;
+}
+
 osd_client_t::~osd_client_t()
 {
    free(in_buf);
@@ -169,6 +206,13 @@ osd_client_t::~osd_client_t()
    }
    // Cancel outbound ops
    cancel_ops();
+    for (osd_op_t *op: send_free_ops)
+    {
+        if (op)
+        {
+            delete op;
+        }
+    }
    for (osd_op_t *op: zc_free_list)
    {
        if (op)
@@ -185,4 +229,14 @@ osd_client_t::~osd_client_t()
    }
 #endif
 #endif
+    if (read_csum_state)
+    {
+        XXH3_freeState(read_csum_state);
+        read_csum_state = NULL;
+    }
+    if (write_csum_state)
+    {
+        XXH3_freeState(write_csum_state);
+        write_csum_state = NULL;
+    }
 }
@@ -37,6 +37,7 @@

 #define OSD_OP_RECOVERY_RELATED     (uint32_t)1
 #define OSD_OP_IGNORE_PG_LOCK       (uint32_t)2
+#define OSD_OP_RETURN_CHAIN         (uint32_t)4

 // Memory alignment for direct I/O (usually 512 bytes)
 #ifndef DIRECT_IO_ALIGNMENT
@@ -228,9 +229,10 @@ struct __attribute__((__packed__)) osd_op_rw_t
    uint64_t offset;
    // length. 0 means to read all bitmaps of the specified range, but no data.
    uint32_t len;
-    // flags (for future)
+    // flags
+    // OSD_OP_RETURN_CHAIN for chained reads: return parent number in chain for each block
    uint32_t flags;
-    // inode metadata revision
+    // inode metadata revision for chained reads
    uint64_t meta_revision;
    // object version for atomic "CAS" (compare-and-set) writes
    // writes and deletes fail with -EINTR if object version differs from (version-1)
@@ -6,7 +6,7 @@ includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@

 Name: Vitastor
 Description: Vitastor client library
-Version: 3.0.5
+Version: 3.0.8
 Libs: -L${libdir} -lvitastor_client
 Cflags: -I${includedir}

@@ -1,12 +1,20 @@
-cmake_minimum_required(VERSION 2.8.12)
+cmake_minimum_required(VERSION 2.8...3.30)

 project(vitastor)

+set(OPENAPI_JSON_H "${CMAKE_CURRENT_BINARY_DIR}/openapi.json.h")
+add_custom_command(
+	OUTPUT ${OPENAPI_JSON_H}
+	COMMAND ${CMAKE_COMMAND} -E echo const char* openapi_description = R\\\"json\\\( > ${OPENAPI_JSON_H}
+	COMMAND ${CMAKE_COMMAND} -E cat ${CMAKE_CURRENT_SOURCE_DIR}/openapi.json >> ${OPENAPI_JSON_H}
+	COMMAND ${CMAKE_COMMAND} -E echo "\\)json\\\"\\;" >> ${OPENAPI_JSON_H}
+	DEPENDS openapi.json
+)
+
 # libvitastor_cli.a
 add_library(vitastor_cli STATIC
 	cli_common.cpp
 	cli_alloc_osd.cpp
-	cli_status.cpp
 	cli_describe.cpp
 	cli_fix.cpp
 	cli_ls.cpp
@@ -14,6 +22,7 @@ add_library(vitastor_cli STATIC
 	cli_dd.cpp
 	cli_modify.cpp
 	cli_modify_osd.cpp
+	cli_modify_user.cpp
 	cli_osd_tree.cpp
 	cli_pg_ls.cpp
 	cli_flatten.cpp
@@ -27,8 +36,13 @@ add_library(vitastor_cli STATIC
 	cli_pool_ls.cpp
 	cli_pool_modify.cpp
 	cli_pool_rm.cpp
+	cli_serve.cpp
+	cli_status.cpp
+	cli_user_ls.cpp
+	${OPENAPI_JSON_H}
 )
 target_compile_options(vitastor_cli PUBLIC -fPIC)
+target_include_directories(vitastor_cli PRIVATE ${CMAKE_CURRENT_BINARY_DIR})

 # vitastor-cli
 add_executable(vitastor-cli
@@ -37,24 +37,42 @@ static const char* help_text =
    "  --sort FIELD    Sort by specified field (name, size, used_size, <read|write|delete>_<iops|bps|lat|queue>)\n"
    "  -r|--reverse    Sort in descending order\n"
    "  -n|--count N    Only list first N items\n"
+    "  --ids ID1,ID2   Only list images with specified full IDs\n"
    "  --tree          Show image snapshot/clone tree\n"
    "\n"
-    "vitastor-cli create -s|--size <size> [-p|--pool <id|name>] [--parent <parent_name>[@<snapshot>]] <name>\n"
-    "  Create an image. You may use K/M/G/T suffixes for <size>. If --parent is specified,\n"
-    "  a copy-on-write image clone is created. Parent must be a snapshot (readonly image).\n"
-    "  Pool must be specified if there is more than one pool.\n"
+    "vitastor-cli create -s|--size SIZE [OPTIONS] <name>\n"
+    "  Create an image. Options:\n"
+    "  -s|--size SIZE      New image size in bytes or with a K/M/G/T unit suffix.\n"
+    "  -p|--pool POOL      Specify pool for the new image (may be omitted if there is only 1 pool).\n"
+    "  --parent PARENT     Create a copy-on-write image clone based on PARENT (or PARENT@SNAPSHOT).\n"
+    "                      If parent is not a snapshot, it must be a read-only image.\n"
+    "  --enc-key random    Generate a new random AES-256-XTS encryption key for the new image.\n"
+    "  --enc-key HEX       Set a specified AES-256-XTS key (64 bytes in hex) for the new image.\n"
+    "  --enc-key vault:ID  Use an encryption key from an external Vault secret with specified ID.\n"
+    "  --owner username    Set owner (default is the current user from TLS certificate).\n"
+    "  --owner_group name  Set owner group name.\n"
+    "  --reader_group rdr  Set reader group name.\n"
    "\n"
-    "vitastor-cli create --snapshot <snapshot> [-p|--pool <id|name>] <image>\n"
-    "vitastor-cli snap-create [-p|--pool <id|name>] <image>@<snapshot>\n"
-    "  Create a snapshot of image <name>. May be used live if only a single writer is active.\n"
+    "vitastor-cli create --snapshot <snapshot> [OPTIONS] <image>\n"
+    "vitastor-cli snap-create [OPTIONS] <image>@<snapshot>\n"
+    "  Create a snapshot of image <image>. May be used live if only a single writer is active.\n"
+    "  Options:\n"
+    "  -p|--pool POOL    Move image to pool POOL, leaving the snapshot in the old pool.\n"
+    "  --enc-key random  Change image encryption key to a new random AES-256-XTS key.\n"
+    "  --enc-key KEY     Change image encryption key to a specified key, Vault key or to an empty key.\n"
+    "                    By default, the image retains its old key when taking a snapshot.\n"
    "\n"
    "vitastor-cli modify <name> [--rename <new-name>] [--resize <size>] [--readonly | --readwrite] [-f|--force] [--down-ok]\n"
    "  Rename, resize image or change its readonly status. Images with children can't be made read-write.\n"
    "  If the new size is smaller than the old size, extra data will be purged.\n"
    "  You should resize file system in the image, if present, before shrinking it.\n"
-    "  --deleted 1|0  Set/clear 'deleted image' flag (set automatically during unfinished deletes).\n"
-    "  -f|--force     Proceed with shrinking or setting readwrite flag even if the image has children.\n"
-    "  --down-ok      Proceed with shrinking even if some data will be left on unavailable OSDs.\n"
+    "  --deleted 1|0       Set/clear 'deleted image' flag (set automatically during unfinished deletes).\n"
+    "  -f|--force          Proceed with shrinking or setting readwrite flag even if the image has children.\n"
+    "  --down-ok           Proceed with shrinking even if some data will be left on unavailable OSDs.\n"
+    "  --enc-key HEX       Change image encryption key (allowed only with --force).\n"
+    "  --owner username    Change image owner.\n"
+    "  --owner_group name  Change image owner group name.\n"
+    "  --reader_group rdr  Change image reader group name.\n"
    "\n"
    "vitastor-cli dd [iimg=<image> | if=<file>] [oimg=<image> | of=<file>] [bs=1M]\n"
    "    [count=N] [seek/oseek=N] [skip/iseek=M] [iodepth=N] [status=progress]\n"
@@ -193,6 +211,7 @@ static const char* help_text =
    "    --used_for_app s3:<name>      Mark pool as used for S3 location with name <name>\n"
    "    --pg_stripe_size <number>     Increase object grouping stripe\n"
    "    --max_osd_combinations 10000  Maximum number of random combinations for LP solver input\n"
+    "    --creator_group <group>       User group allowed to create images in this pool.\n"
    "    --wait                        Wait for the new pool to come online\n"
    "    -f|--force                    Do not check that cluster has enough OSDs to create the pool\n"
    "  Examples:\n"
@@ -204,7 +223,7 @@ static const char* help_text =
    "    [-s|--pg_size <number>] [--pg_minsize <number>] [-n|--pg_count <count>]\n"
    "    [--failure_domain <level>] [--root_node <node>] [--osd_tags <tags>] [--used_for_app <type>:<name>]\n"
    "    [--max_osd_combinations <number>] [--primary_affinity_tags <tags>] [--scrub_interval <time>]\n"
-    "    [--level_placement <rules>] [--raw_placement <rules>]\n"
+    "    [--level_placement <rules>] [--raw_placement <rules>] [--creator_group <group>]\n"
    "  Non-modifiable parameters (changing them WILL lead to data loss):\n"
    "    [--block_size <size>] [--bitmap_granularity <size>]\n"
    "    [--immediate_commit <all|small|none>] [--pg_stripe_size <size>]\n"
@@ -217,7 +236,7 @@ static const char* help_text =
    "vitastor-cli rm-pool|pool-rm [--force] <id|name>\n"
    "  Remove a pool. Refuses to remove pools with images without --force.\n"
    "\n"
-    "vitastor-cli ls-pools|pool-ls|ls-pool|pools [-l] [--detail] [--sort FIELD] [-r] [-n N] [--stats] [<glob> ...]\n"
+    "vitastor-cli ls-pools|pool-ls|ls-pool|pools [-l] [--detail] [--sort FIELD] [-r] [-n N] [<glob> ...]\n"
    "  List pools (only matching <glob> patterns if passed).\n"
    "  -l|--long       Also report I/O statistics\n"
    "  --detail        Use list format (not table), show all details\n"
@@ -225,6 +244,25 @@ static const char* help_text =
    "  -r|--reverse    Sort in descending order\n"
    "  -n|--count N    Only list first N items\n"
    "\n"
+    "vitastor-cli ls-users|user-ls|ls-user|list-users [<name> ...]\n"
+    "  List users (only with specified names if passed).\n"
+    "\n"
+    "vitastor-cli modify-user --type <type> --groups group1,group2,... <username>\n"
+    "  Create or update user permissions. User names match CN of their certificates.\n"
+    "  --type TYPE      Set user type: client, admin, mon or osd. Default is client.\n"
+    "  --groups GROUPS  Set user's groups.\n"
+    "\n"
+    "vitastor-cli rm-user|remove-user|delete-user <username>\n"
+    "  Remove a user.\n"
+    "\n"
+    "vitastor-cli serve\n"
+    "  Start HTTP server able to handle CLI commands over a REST API. Options:\n"
+    "  --bind_address ADDR  Specify server IP address or addresses, separated by space. Default is 127.0.0.1.\n"
+    "  --port 8080          Specify server port.\n"
+    "  --ssl_cert FILE      Path to server SSL certificate file (PEM format).\n"
+    "  --ssl_key FILE       Path to server SSL private key file.\n"
+    "  --ssl_ca FILE        Path to file with SSL CA certificates used to validate client connections.\n"
+    "\n"
    "Use vitastor-cli --help <command> for command details or vitastor-cli --help --all for all details.\n"
    "\n"
    "GLOBAL OPTIONS:\n"
@@ -319,27 +357,24 @@ static json11::Json::object parse_args(int narg, const char *args[])
    return cfg;
 }

-static int run(cli_tool_t *p, json11::Json::object cfg)
+std::function<bool(cli_result_t &)> cli_tool_t::start(json11::Json::object cfg, cli_result_t & result)
 {
-    cli_result_t result = {};
-    p->is_command_line = true;
-    p->parse_config(cfg);
    json11::Json::array cmd = cfg["command"].array_items();
    cfg.erase("command");
    std::function<bool(cli_result_t &)> action_cb;
    if (!cmd.size())
    {
-        result = { .err = EINVAL, .text = "command is missing" };
+        result = { .err = EOPNOTSUPP, .text = "command is missing" };
    }
    else if (cmd[0] == "status")
    {
        // Show cluster status
-        action_cb = p->start_status(cfg);
+        action_cb = start_status(cfg);
    }
    else if (cmd[0] == "df")
    {
        // Show pool space stats
-        action_cb = p->start_pool_ls(cfg);
+        action_cb = start_pool_ls(cfg);
    }
    else if (cmd[0] == "ls")
    {
@@ -349,7 +384,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
            cmd.erase(cmd.begin(), cmd.begin()+1);
            cfg["names"] = cmd;
        }
-        action_cb = p->start_ls(cfg);
+        action_cb = start_ls(cfg);
    }
    else if (cmd[0] == "snap-create")
    {
@@ -364,7 +399,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["image"] = name.substr(0, pos);
            cfg["snapshot"] = name.substr(pos + 1);
-            action_cb = p->start_create(cfg);
+            action_cb = start_create(cfg);
        }
    }
    else if (cmd[0] == "create")
@@ -374,7 +409,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["image"] = cmd[1];
        }
-        action_cb = p->start_create(cfg);
+        action_cb = start_create(cfg);
    }
    else if (cmd[0] == "modify")
    {
@@ -383,12 +418,12 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["image"] = cmd[1];
        }
-        action_cb = p->start_modify(cfg);
+        action_cb = start_modify(cfg);
    }
    else if (cmd[0] == "rm-data")
    {
        // Delete inode data
-        action_cb = p->start_rm_data(cfg);
+        action_cb = start_rm_data(cfg);
    }
    else if (cmd[0] == "rm-osd")
    {
@@ -398,7 +433,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
            cmd.erase(cmd.begin(), cmd.begin()+1);
            cfg["osd_id"] = cmd;
        }
-        action_cb = p->start_rm_osd(cfg);
+        action_cb = start_rm_osd(cfg);
    }
    else if (cmd[0] == "merge-data")
    {
@@ -409,7 +444,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
            if (cmd.size() > 2)
                cfg["to"] = cmd[2];
        }
-        action_cb = p->start_merge(cfg);
+        action_cb = start_merge(cfg);
    }
    else if (cmd[0] == "flatten")
    {
@@ -418,7 +453,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["image"] = cmd[1];
        }
-        action_cb = p->start_flatten(cfg);
+        action_cb = start_flatten(cfg);
    }
    else if (cmd[0] == "dd")
    {
@@ -432,16 +467,31 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
                cfg[arg.substr(0, p)] = arg.substr(p+1);
            }
        }
-        action_cb = p->start_dd(cfg);
+        action_cb = start_dd(cfg);
    }
    else if (cmd[0] == "rm")
    {
        // Remove multiple snapshots and rebase their children
-        if (cfg["exact"].bool_value() || cfg["matching"].bool_value())
+        if (cfg["names"].is_array())
+        {
+            cfg["globs"] = cfg["names"];
+            cfg.erase("names");
+            cfg["exact"] = true;
+            cfg["matching"] = false;
+            action_cb = start_rm_wildcard(cfg);
+        }
+        else if (cfg["matching"].is_array())
+        {
+            cfg["globs"] = cfg["matching"];
+            cfg["exact"] = false;
+            cfg["matching"] = true;
+            action_cb = start_rm_wildcard(cfg);
+        }
+        else if (cfg["exact"].bool_value() || cfg["matching"].bool_value())
        {
            cmd.erase(cmd.begin(), cmd.begin()+1);
            cfg["globs"] = cmd;
-            action_cb = p->start_rm_wildcard(cfg);
+            action_cb = start_rm_wildcard(cfg);
        }
        else
        {
@@ -451,41 +501,41 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
                if (cmd.size() > 2)
                    cfg["to"] = cmd[2];
            }
-            action_cb = p->start_rm(cfg);
+            action_cb = start_rm(cfg);
        }
    }
    else if (cmd[0] == "describe")
    {
        // Describe unclean objects
-        action_cb = p->start_describe(cfg);
+        action_cb = start_describe(cfg);
    }
    else if (cmd[0] == "fix")
    {
        // Fix inconsistent objects (by deleting some copies)
-        action_cb = p->start_fix(cfg);
+        action_cb = start_fix(cfg);
    }
    else if (cmd[0] == "alloc-osd")
    {
        // Allocate a new OSD number
-        action_cb = p->start_alloc_osd(cfg);
+        action_cb = start_alloc_osd(cfg);
    }
    else if (cmd[0] == "osd-tree")
    {
        // Print OSD tree
-        action_cb = p->start_osd_tree(cfg);
+        cfg["as_tree"] = true;
+        action_cb = start_osd_tree(cfg);
    }
    else if (cmd[0] == "osds" || cmd[0] == "ls-osds" || cmd[0] == "ls-osd" || cmd[0] == "osd-ls")
    {
        // Print OSD list
-        cfg["flat"] = true;
-        action_cb = p->start_osd_tree(cfg);
+        action_cb = start_osd_tree(cfg);
    }
    else if (cmd[0] == "modify-osd")
    {
        // Modify OSD configuration
        if (cmd.size() > 1)
            cfg["osd_num"] = cmd[1];
-        action_cb = p->start_modify_osd(cfg);
+        action_cb = start_modify_osd(cfg);
    }
    else if (cmd[0] == "pg-list" || cmd[0] == "pg-ls" || cmd[0] == "list-pg" || cmd[0] == "ls-pg" || cmd[0] == "ls-pgs" || cmd[0] == "pgs")
    {
@@ -495,7 +545,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
            cmd.erase(cmd.begin(), cmd.begin()+1);
            cfg["pg_state"] = cmd;
        }
-        action_cb = p->start_pg_list(cfg);
+        action_cb = start_pg_list(cfg);
    }
    else if (cmd[0] == "create-pool" || cmd[0] == "pool-create")
    {
@@ -504,16 +554,16 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["name"] = cmd[1];
        }
-        action_cb = p->start_pool_create(cfg);
+        action_cb = start_pool_create(cfg);
    }
    else if (cmd[0] == "modify-pool" || cmd[0] == "pool-modify")
    {
        // Modify existing pool
        if (cmd.size() > 1)
        {
-            cfg["old_name"] = cmd[1];
+            cfg["pool"] = cmd[1];
        }
-        action_cb = p->start_pool_modify(cfg);
+        action_cb = start_pool_modify(cfg);
    }
    else if (cmd[0] == "rm-pool" || cmd[0] == "pool-rm")
    {
@@ -522,7 +572,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            cfg["pool"] = cmd[1];
        }
-        action_cb = p->start_pool_rm(cfg);
+        action_cb = start_pool_rm(cfg);
    }
    else if (cmd[0] == "ls-pool" || cmd[0] == "pool-ls" || cmd[0] == "ls-pools" || cmd[0] == "pools")
    {
@@ -533,12 +583,55 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
            cmd.erase(cmd.begin(), cmd.begin()+1);
            cfg["names"] = cmd;
        }
-        action_cb = p->start_pool_ls(cfg);
+        action_cb = start_pool_ls(cfg);
+    }
+    else if (cmd[0] == "user-ls" || cmd[0] == "ls-user" || cmd[0] == "ls-users" || cmd[0] == "list-users")
+    {
+        // List users
+        if (cmd.size() > 1)
+        {
+            cmd.erase(cmd.begin(), cmd.begin()+1);
+            cfg["names"] = cmd;
+        }
+        action_cb = start_user_ls(cfg);
+    }
+    else if (cmd[0] == "modify-user" || cmd[0] == "user-modify")
+    {
+        // Create/update user
+        if (cmd.size() > 1)
+        {
+            cfg["name"] = cmd[1];
+        }
+        action_cb = start_modify_user(cfg);
+    }
+    else if (cmd[0] == "rm-user" || cmd[0] == "remove-user" || cmd[0] == "delete-user")
+    {
+        // Remove user
+        if (cmd.size() > 1)
+        {
+            cfg["name"] = cmd[1];
+        }
+        cfg["remove"] = true;
+        action_cb = start_modify_user(cfg);
+    }
+    else if (cmd[0] == "serve")
+    {
+        // Start HTTP server
+        action_cb = start_serve(cfg);
    }
    else
    {
-        result = { .err = EINVAL, .text = "unknown command: "+cmd[0].string_value() };
+        result = { .err = EOPNOTSUPP, .text = "unknown command: "+cmd[0].string_value() };
    }
+    return action_cb;
+}
+
+static int run(cli_tool_t *p, json11::Json::object cfg)
+{
+    cli_result_t result = {};
+    p->is_command_line = true;
+    p->parse_config(cfg);
+    auto action_cb = p->start(cfg, result);
    if (action_cb != NULL)
    {
        // Create client
@@ -550,6 +643,7 @@ static int run(cli_tool_t *p, json11::Json::object cfg)
        {
            result = r;
            action_cb = NULL;
+            p->ringloop->submit();
        });
        // Loop until it completes
        while (action_cb != NULL)
@@ -9,6 +9,7 @@
 #include "object_id.h"
 #include "ringloop.h"
 #include <functional>
+#include <set>

 struct rm_inode_t;
 struct snap_merger_t;
@@ -26,6 +27,13 @@ struct cli_result_t
    json11::Json data;
 };

+struct cli_user_t
+{
+    std::string name;
+    std::string type;
+    std::set<std::string> groups;
+};
+
 class cli_tool_t
 {
 public:
@@ -37,6 +45,8 @@ public:
    bool is_command_line = false;
    bool color = false;

+    std::unique_ptr<cli_user_t> user; // for http mode
+
    ring_loop_t *ringloop = NULL;
    epoll_manager_t *epmgr = NULL;
    cluster_client_t *cli = NULL;
@@ -46,18 +56,24 @@ public:
    json11::Json etcd_result;

    void parse_config(json11::Json::object & cfg);
+    void parse_api_opts(json11::Json::object & cfg);
    json11::Json parse_tags(std::string tags);

+    json11::Json::object format_image(const inode_config_t & cfg);
    void change_parent(inode_t cur, inode_t new_parent, cli_result_t *result);
    inode_config_t* get_inode_cfg(const std::string & name);

+    bool check_image_perm(const inode_config_t & cfg, bool write);
+
    friend struct rm_inode_t;
    friend struct snap_merger_t;
    friend struct snap_flattener_t;
    friend struct snap_remover_t;

+    std::function<bool(cli_result_t &)> start(json11::Json::object cfg, cli_result_t & result);
    std::function<bool(cli_result_t &)> start_alloc_osd(json11::Json);
    std::function<bool(cli_result_t &)> start_create(json11::Json);
+    std::function<bool(cli_result_t &)> start_dd(json11::Json);
    std::function<bool(cli_result_t &)> start_describe(json11::Json);
    std::function<bool(cli_result_t &)> start_fix(json11::Json);
    std::function<bool(cli_result_t &)> start_flatten(json11::Json);
@@ -65,6 +81,7 @@ public:
    std::function<bool(cli_result_t &)> start_merge(json11::Json);
    std::function<bool(cli_result_t &)> start_modify(json11::Json);
    std::function<bool(cli_result_t &)> start_modify_osd(json11::Json);
+    std::function<bool(cli_result_t &)> start_modify_user(json11::Json);
    std::function<bool(cli_result_t &)> start_osd_tree(json11::Json);
    std::function<bool(cli_result_t &)> start_pg_list(json11::Json);
    std::function<bool(cli_result_t &)> start_pool_create(json11::Json);
@@ -75,8 +92,9 @@ public:
    std::function<bool(cli_result_t &)> start_rm_data(json11::Json);
    std::function<bool(cli_result_t &)> start_rm_osd(json11::Json);
    std::function<bool(cli_result_t &)> start_rm_wildcard(json11::Json);
+    std::function<bool(cli_result_t &)> start_serve(json11::Json);
    std::function<bool(cli_result_t &)> start_status(json11::Json);
-    std::function<bool(cli_result_t &)> start_dd(json11::Json);
+    std::function<bool(cli_result_t &)> start_user_ls(json11::Json);

    // Should be called like loop_and_wait(start_status(), <completion callback>)
    void loop_and_wait(std::function<bool(cli_result_t &)> loop_cb, std::function<void(const cli_result_t &)> complete_cb);
@@ -6,6 +6,62 @@
 #include "cluster_client.h"
 #include "cli.h"

+bool cli_tool_t::check_image_perm(const inode_config_t & cfg, bool write)
+{
+    return !user ||
+        user->type == "admin" ||
+        user->name == cfg.owner ||
+        cfg.owner_group != "" && user->groups.find(cfg.owner_group) != user->groups.end() ||
+        !write && cfg.reader_group != "" && user->groups.find(cfg.reader_group) != user->groups.end();
+}
+
+json11::Json::object cli_tool_t::format_image(const inode_config_t & cfg)
+{
+    auto pool_it = cli->st_cli.pool_config.find(INODE_POOL(cfg.num));
+    bool good_pool = pool_it != cli->st_cli.pool_config.end();
+    auto img = json11::Json::object {
+        { "name", cfg.name },
+        { "size", cfg.size },
+        { "inode_id", cfg.num },
+        { "inode_num", INODE_NO_POOL(cfg.num) },
+        { "pool_id", (uint64_t)INODE_POOL(cfg.num) },
+        { "pool_name", good_pool ? pool_it->second.name : "? (ID:"+std::to_string(INODE_POOL(cfg.num))+")" },
+        { "readonly", cfg.readonly },
+        { "deleted", cfg.deleted },
+    };
+    if (cfg.owner != "")
+    {
+        img["owner"] = cfg.owner;
+    }
+    if (cfg.owner_group != "")
+    {
+        img["owner_group"] = cfg.owner_group;
+    }
+    if (cfg.reader_group != "")
+    {
+        img["reader_group"] = cfg.reader_group;
+    }
+    if (!cfg.enc_key.empty())
+    {
+        img["encrypted"] = true;
+        // Only show Vault key IDs
+        if (cfg.enc_key.substr(0, strlen(VAULT_KEY_PREFIX)) == VAULT_KEY_PREFIX)
+            img["enc_key_id"] = cfg.enc_key;
+    }
+    if (cfg.parent_id)
+    {
+        auto parent_it = cli->st_cli.inode_config.find(cfg.parent_id);
+        if (parent_it != cli->st_cli.inode_config.end())
+        {
+            img["parent_name"] = parent_it->second.name;
+        }
+        img["parent_inode_id"] = cfg.parent_id;
+        img["parent_inode_num"] = INODE_NO_POOL(cfg.parent_id);
+        img["parent_pool_id"] = (uint64_t)INODE_POOL(cfg.parent_id);
+    }
+    return img;
+}
+
 void cli_tool_t::change_parent(inode_t cur, inode_t new_parent, cli_result_t *result)
 {
    auto cur_cfg_it = cli->st_cli.inode_config.find(cur);
@@ -101,6 +157,16 @@ inode_config_t* cli_tool_t::get_inode_cfg(const std::string & name)
    return NULL;
 }

+void cli_tool_t::parse_api_opts(json11::Json::object & cfg)
+{
+    iodepth = cfg["iodepth"].uint64_value();
+    if (!iodepth)
+        iodepth = 32;
+    parallel_osds = cfg["parallel_osds"].uint64_value();
+    if (!parallel_osds)
+        parallel_osds = 4;
+}
+
 void cli_tool_t::parse_config(json11::Json::object & cfg)
 {
    for (auto kv_it = cfg.begin(); kv_it != cfg.end();)
@@ -121,15 +187,10 @@ void cli_tool_t::parse_config(json11::Json::object & cfg)
    else
        color = isatty(1);
    json_output = cfg["json"].bool_value();
-    iodepth = cfg["iodepth"].uint64_value();
-    if (!iodepth)
-        iodepth = 32;
-    parallel_osds = cfg["parallel_osds"].uint64_value();
-    if (!parallel_osds)
-        parallel_osds = 4;
    log_level = cfg["log_level"].int64_value();
    progress = cfg["progress"].uint64_value() ? true : false;
    list_first = cfg["wait_list"].uint64_value() ? true : false;
+    parse_api_opts(cfg);
 }

 struct cli_result_looper_t
@@ -153,7 +214,6 @@ void cli_tool_t::loop_and_wait(std::function<bool(cli_result_t &)> loop_cb, std:
            ringloop->unregister_consumer(&looper->consumer);
            looper->loop_cb = NULL;
            looper->complete_cb(looper->result);
-            ringloop->submit();
            delete looper;
            return;
        }
@@ -1,8 +1,13 @@
 // Copyright (c) Vitaliy Filippov, 2019+
 // License: VNPL-1.1 (see README.md for details)

+#ifdef WITH_OPENSSL
+#include <openssl/rand.h>
+#endif
+
 #include <ctype.h>
 #include "cli.h"
+#include "http_client.h"
 #include "cluster_client.h"
 #include "str_util.h"

@@ -29,11 +34,15 @@ struct image_creator_t
    uint64_t size = 0;
    bool force = false;
    bool force_size = false;
+    std::string enc_key;
+    bool set_key = false;
+    std::string new_owner, new_owner_group, new_reader_group;

    pool_id_t old_pool_id = 0;
    inode_t new_parent_id = 0;
    inode_t new_id = 0, old_id = 0;
-    uint64_t max_id_mod_rev = 0, cfg_mod_rev = 0, idx_mod_rev = 0;
+    uint64_t max_id_mod_rev = 0, idx_mod_rev = 0;
+    inode_config_t cur_cfg;
    inode_config_t new_cfg;

    int state = 0;
@@ -64,7 +73,8 @@ struct image_creator_t
        }
        if (new_pool_id)
        {
-            if (pools.find(new_pool_id) == pools.end())
+            auto pool_it = pools.find(new_pool_id);
+            if (pool_it == pools.end())
            {
                result = (cli_result_t){ .err = ENOENT, .text = "Pool "+std::to_string(new_pool_id)+" does not exist" };
                state = 100;
@@ -111,6 +121,23 @@ struct image_creator_t
            create_snapshot();
    }

+    bool check_pool_permission()
+    {
+        if (!parent->user || parent->user->type == "admin")
+        {
+            return true;
+        }
+        auto pool_it = parent->cli->st_cli.pool_config.find(new_pool_id);
+        if (pool_it == parent->cli->st_cli.pool_config.end() ||
+            (pool_it->second.creator_group == "" || parent->user->groups.find(pool_it->second.creator_group) == parent->user->groups.end()))
+        {
+            result = (cli_result_t){ .err = EACCES, .text = "Pool image create permission denied" };
+            state = 100;
+            return false;
+        }
+        return true;
+    }
+
    void create_image()
    {
        if (state == 2)
@@ -150,6 +177,10 @@ struct image_creator_t
            state = 100;
            return;
        }
+        if (!check_pool_permission())
+        {
+            return;
+        }
        if (!size && !force_size)
        {
            result = (cli_result_t){ .err = EINVAL, .text = "Image size is missing" };
@@ -194,15 +225,11 @@ resume_3:
        // Save into inode_config for library users to be able to take it from there immediately
        new_cfg.mod_revision = parent->etcd_result["header"]["revision"].uint64_value();
        parent->cli->st_cli.insert_inode_config(new_cfg);
+        auto img = parent->format_image(new_cfg);
        result = (cli_result_t){
            .err = 0,
            .text = "Image "+image_name+" created",
-            .data = json11::Json::object {
-                { "name", image_name },
-                { "pool", new_pool_name },
-                { "parent", new_parent },
-                { "size", size },
-            }
+            .data = img,
        };
        state = 100;
    }
@@ -233,7 +260,7 @@ resume_3:
        }
        do
        {
-            // In addition to next_id, get: size, old_id, old_pool_id, new_parent, cfg_mod_rev, idx_mod_rev
+            // In addition to next_id, get: cur_cfg, old_id, old_pool_id, size, idx_mod_rev
 resume_2:
 resume_3:
            get_image_details();
@@ -245,11 +272,22 @@ resume_3:
                state = 100;
                return;
            }
+            if (!parent->check_image_perm(cur_cfg, true))
+            {
+                result = (cli_result_t){ .err = EACCES, .text = "Image permission denied" };
+                state = 100;
+                return;
+            }
            if (!new_pool_id)
            {
                // Create snapshot in the same pool by default
                new_pool_id = old_pool_id;
            }
+            // Verify pool permissions if the pool is different from the original
+            if (new_pool_id != old_pool_id && !check_pool_permission())
+            {
+                return;
+            }
            attempt_create();
            state = 4;
 resume_4:
@@ -272,13 +310,23 @@ resume_4:
        // Save into inode_config for library users to be able to take it from there immediately
        new_cfg.mod_revision = parent->etcd_result["header"]["revision"].uint64_value();
        parent->cli->st_cli.insert_inode_config(new_cfg);
+        {
+            auto new_pool_it = parent->cli->st_cli.pool_config.find(new_pool_id);
+            new_pool_name = new_pool_it != parent->cli->st_cli.pool_config.end() ? new_pool_it->second.name : "";
+        }
        result = (cli_result_t){
            .err = 0,
            .text = "Snapshot "+image_name+"@"+new_snap+" created",
            .data = json11::Json::object {
-                { "name", image_name+"@"+new_snap },
-                { "pool", (uint64_t)new_pool_id },
-                { "parent", new_parent },
+                { "inode_id", INODE_WITH_POOL(new_pool_id, new_id) },
+                { "inode_num", new_id },
+                { "name", image_name },
+                { "pool_id", (uint64_t)new_pool_id },
+                { "pool_name", new_pool_name },
+                { "parent_name", image_name+"@"+new_snap },
+                { "parent_inode_id", INODE_WITH_POOL(old_pool_id, old_id) },
+                { "parent_inode_num", old_id },
+                { "parent_pool_id", (uint64_t)old_pool_id },
                { "size", size },
            }
        };
@@ -323,17 +371,6 @@ resume_4:
            goto resume_2;
        else if (state == 3)
            goto resume_3;
-        if (!new_pool_id)
-        {
-            for (auto & ic: parent->cli->st_cli.inode_config)
-            {
-                if (ic.second.name == image_name)
-                {
-                    new_pool_id = INODE_POOL(ic.first);
-                    break;
-                }
-            }
-        }
        parent->etcd_txn(json11::Json::object { { "success", json11::Json::array {
            get_next_id(),
            json11::Json::object {
@@ -357,7 +394,7 @@ resume_2:
        extract_next_id(parent->etcd_result["responses"][0]);
        old_id = 0;
        old_pool_id = 0;
-        cfg_mod_rev = idx_mod_rev = 0;
+        idx_mod_rev = 0;
        if (parent->etcd_result["responses"][1]["response_range"]["kvs"].array_items().size() == 0)
        {
            for (auto & ic: parent->cli->st_cli.inode_config)
@@ -366,9 +403,8 @@ resume_2:
                {
                    old_id = INODE_NO_POOL(ic.first);
                    old_pool_id = INODE_POOL(ic.first);
+                    cur_cfg = ic.second;
                    size = ic.second.size;
-                    new_parent_id = ic.second.parent_id;
-                    cfg_mod_rev = ic.second.mod_revision;
                    break;
                }
            }
@@ -412,16 +448,14 @@ resume_3:
            }
            {
                auto kv = parent->cli->st_cli.parse_etcd_kv(parent->etcd_result["responses"][0]["response_range"]["kvs"][0]);
-                size = kv.value["size"].uint64_value();
-                new_parent_id = kv.value["parent_id"].uint64_value();
-                uint64_t parent_pool_id = kv.value["parent_pool"].uint64_value();
-                if (new_parent_id)
-                {
-                    new_parent_id = INODE_WITH_POOL(parent_pool_id ? parent_pool_id : old_pool_id, new_parent_id);
-                }
-                cfg_mod_rev = kv.mod_revision;
+                cur_cfg = parent->cli->st_cli.deserialize_inode_cfg(INODE_WITH_POOL(old_pool_id, old_id), kv.value, kv.mod_revision);
+                size = cur_cfg.size;
            }
        }
+        if (!new_pool_id)
+        {
+            new_pool_id = old_pool_id;
+        }
    }

    void attempt_create()
@@ -434,6 +468,27 @@ resume_3:
            .readonly = false,
            .meta = new_meta,
        };
+        if (set_key)
+        {
+            new_cfg.enc_key = enc_key;
+        }
+        else if (new_snap != "")
+        {
+            new_cfg.enc_key = cur_cfg.enc_key;
+        }
+        new_cfg.owner = http_context_get_ssl_cn(parent->cli->st_cli.get_http_ctx());
+        if (!new_owner.empty())
+        {
+            new_cfg.owner = new_owner;
+        }
+        if (!new_owner_group.empty())
+        {
+            new_cfg.owner_group = new_owner_group;
+        }
+        if (!new_reader_group.empty())
+        {
+            new_cfg.reader_group = new_reader_group;
+        }
        json11::Json::array checks = json11::Json::array {
            json11::Json::object {
                { "target", "VERSION" },
@@ -500,16 +555,12 @@ resume_3:
        };
        if (new_snap != "")
        {
-            inode_config_t snap_cfg = {
-                .num = INODE_WITH_POOL(old_pool_id, old_id),
-                .name = image_name+"@"+new_snap,
-                .size = size,
-                .parent_id = new_parent_id,
-                .readonly = true,
-            };
+            inode_config_t snap_cfg = cur_cfg;
+            snap_cfg.name = image_name+"@"+new_snap;
+            snap_cfg.readonly = true;
            checks.push_back(json11::Json::object {
                { "target", "MOD" },
-                { "mod_revision", cfg_mod_rev },
+                { "mod_revision", cur_cfg.mod_revision },
                { "key", base64_encode(
                    parent->cli->st_cli.etcd_prefix+"/config/inode/"+
                    std::to_string(old_pool_id)+"/"+std::to_string(old_id)
@@ -554,8 +605,16 @@ std::function<bool(cli_result_t &)> cli_tool_t::start_create(json11::Json cfg)
    auto image_creator = new image_creator_t();
    image_creator->parent = this;
    image_creator->image_name = cfg["image"].string_value();
-    image_creator->new_pool_id = cfg["pool"].uint64_value();
-    image_creator->new_pool_name = cfg["pool"].string_value();
+    if (!cfg["pool"].is_null())
+    {
+        image_creator->new_pool_id = cfg["pool"].uint64_value();
+        image_creator->new_pool_name = cfg["pool"].string_value();
+    }
+    else
+    {
+        image_creator->new_pool_id = cfg["pool_id"].uint64_value();
+        image_creator->new_pool_name = cfg["pool_name"].string_value();
+    }
    image_creator->force = cfg["force"].bool_value();
    image_creator->force_size = cfg["force_size"].bool_value();
    if (cfg["image_meta"].is_object())
@@ -566,6 +625,35 @@ std::function<bool(cli_result_t &)> cli_tool_t::start_create(json11::Json cfg)
    {
        image_creator->new_snap = cfg["snapshot"].string_value();
    }
+    if (!cfg["enc_key"].is_null())
+    {
+        image_creator->set_key = true;
+#ifdef WITH_OPENSSL
+        if (image_creator->enc_key == "random")
+        {
+            uint8_t newkey[64];
+            RAND_bytes(newkey, 64);
+            image_creator->enc_key = tohexstr(newkey, 64);
+        }
+#endif
+        else
+        {
+            image_creator->enc_key = cfg["enc_key"].string_value();
+            if (image_creator->enc_key != "" &&
+                image_creator->enc_key.substr(0, strlen(VAULT_KEY_PREFIX)) != VAULT_KEY_PREFIX &&
+                (!ishexstr(image_creator->enc_key) || image_creator->enc_key.size() != 128))
+            {
+                return [](cli_result_t & result)
+                {
+                    result = (cli_result_t){ .err = EINVAL, .text = "Encryption key is not a 512-bit hex string, not \"\" and not \"random\"" };
+                    return true;
+                };
+            }
+        }
+    }
+    image_creator->new_owner = cfg["owner"].string_value();
+    image_creator->new_owner_group = cfg["owner_group"].string_value();
+    image_creator->new_reader_group = cfg["reader_group"].string_value();
    image_creator->new_parent = cfg["parent"].string_value();
    if (!cfg["size"].is_null())
    {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vitaliy Filippov	55e2c65848	xxhash3 bench	2026-04-04 13:47:40 +03:00
Vitaliy Filippov	7eb8a66d0e	Include xxhash3 x86dispatch	2026-04-04 13:42:05 +03:00
Vitaliy Filippov	e14231e263	Implement protocol-level checksums (xxhash3)	2026-04-03 21:26:25 +03:00
Vitaliy Filippov	435c43e4c8	Do not use scrap_buffer in the client (it would block protocol checksum support)	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	3d6e804437	Support TLS CN authentication and per-image permissions in vitastor-cli serve	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	3fa75dfa6a	Add VitastorAuthFilter	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	231d18438e	Implement vitastor-cli ls-user, modify-user, remove-user commands	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	7be6fcd27e	Add image owner/owner_group/reader_group support (for antietcd VitastorAuthFilter)	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	9101ec1754	Add security parameter documentation	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	8966cac272	Support inline (string PEM) certificates and pkeys	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	8e5592cd24	Show encryption keys (only IDs) in the listing	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	a83687ea1d	Support storing image encryption keys in Vault	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	9825606fde	Prefer local etcd addresses and correctly cycle over them even when they need resolving Seems slightly overcomplicated...	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	4accce43d8	Support DNS resolving via libc-ares	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	1eec28bc65	Batch handle_immediate_ops more	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	ea280609ce	Add vitastor-cli create & modify --enc-key parameter	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	2e2ae066b2	Support reading from snapshots encrypted with different keys	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	2ba4be470f	Support decryption with multiple keys	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	23463ec4cd	Allow to return chain_info in response to reads	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	1f5a832e28	Add basic AES-XTS client-side encryption support	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	73e9de5143	Rework msgr send/receive to allow encryption support	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	9cf30f286e	Move fromhexstr() to str_util	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	264b9dbfa9	Add openapi description	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	0ee005bf23	Slightly fix API return and input types	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	227c4c3bcf	Implement vitastor-cli serve command to serve simple HTTP API	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	85b762db2c	Implement HTTP server support O_o	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	aaecf332f1	Rename http_response_t to http_message_t	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	1dc8e82f37	Extract common HTTP context	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	afa9fe92ff	Support xxhash 32-bit checksums (data_csum_type=xxh3_32)	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	32d0e474ec	Detect block checksums using csum_block_size, not data_csum_type	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	ff225534f1	Add client certificate support	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	7d9124b63a	Do not re-initialize TLS context every connection	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	b09b48c061	Add https support to antietcd	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	e896b2ed30	Implement etcd SSL support via OpenSSL Maybe I should remove all of this and use libwebsockets :)	2026-04-03 21:22:42 +03:00
Vitaliy Filippov	e5c505eaf4	Write 1 entry to blocks to collect garbage	2026-04-03 18:08:12 +00:00
Vitaliy Filippov	c1d244d4f0	Fix init metadata entry loading logging	2026-04-03 18:08:12 +00:00
Vitaliy Filippov	9b264a212f	Do full metadata GC on start (new store)	2026-04-03 18:08:12 +00:00
Vitaliy Filippov	ff7f5cb4f4	Report live & garbage entry count / memory with log_level > 1	2026-04-02 23:45:13 +00:00
Vitaliy Filippov	25ecca7625	Fix use-after-free in OSD ops (ooops)	2026-04-02 13:48:17 +00:00
Vitaliy Filippov	99c4244004	Try to write into blocks with more garbage first	2026-04-02 13:48:17 +00:00
Vitaliy Filippov	9949b9fb4e	Fix incorrect reads from snapshots on retries	2026-03-31 02:06:53 +03:00
Vitaliy Filippov	e6881ad1d5	Fix read_bitmap from deleted objects with the new store	2026-03-31 01:59:53 +03:00
Vitaliy Filippov	b30635b932	Release 3.0.8 - Surrogate increment-only peer IDs are now used instead of file descriptor numbers, and client cleanup sequence is reworked in another attempt to fix a possible PG hang in 'peering' states. The history of this bug is still unclear and it still hasn't been reproduced in tests, but several users have reported it since 3.0.4 (only with enabled RDMA). - Fix a minor bug where an OSD could skip reporting misplaced PG state when moving an object in non-immediate_commit mode. - Add Ubuntu 26.04 (Resolute Raccoon) support and patches for qemu 10.2 and libvirt 12.0	2026-03-30 02:09:02 +03:00
Vitaliy Filippov	0c1154833c	Add Ubuntu 26.04 support	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	c227bb05b6	Fix incorrect patch contents for qemu 10.1, add patch for qemu 10.2	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	dd85315f22	Update CMake supported versions	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	47d2f4e0be	Add patch for libvirt 12.0	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	2a5028d17f	Use robin_hood_map in messenger	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	07915c2881	Use surrogate peer IDs instead of FDs	2026-03-30 02:06:10 +03:00
Vitaliy Filippov	79141eb383	Fix commented out //this->pg_state_dirty.insert	2026-03-28 20:08:52 +03:00
Vitaliy Filippov	f7cbb6ed56	Remove FD from the event loop in destroy_client, not in stop_client	2026-03-28 14:18:20 +03:00
Vitaliy Filippov	8f8172db99	clear_immediate_ops is now done by stop_client	2026-03-26 01:08:23 +03:00
Vitaliy Filippov	94be147e80	Clear received_ops - they are already freed	2026-03-26 01:08:02 +03:00
Vitaliy Filippov	538620b400	Release 3.0.6 - Fix one more bug in old store checksums O_o - checksum verification wasn't working correctly on reads quickly after small initial offsetted writes (when a BIG_WRITE was read from the journal). - Fix clients possibly not destroyed after being switched to RDMA. Not 100% verified, but in theory it could rarely lead to PGs hanging in peering/stopping states with RDMA enabled. - Use vitastor-cli in the Cinder driver for modifications instead of direct etcd interaction. - Fix mon_https_ca parsing. - Fix Docker install.sh, add instructions for Podman.	2026-03-22 22:49:51 +03:00