Is sending and receiving raw encrypted zfs snapshot okay now?

[amano-kenji]

This used to be broken, but it may have been fixed now.

[IvanVolosyuk]

Should be fixed according to #12014 in openfs versions 2.2.8+, 2.3.3+, zfs-2.4.0-rc1+

[amano-kenji]

But, the fix is about non-raw send of encrypted snapshots?

[IvanVolosyuk]

Sorry, confused it. I believe people complained about non-raw sends and raw sends were fine for a while.

[amotin]

To second the Ivan's confusion, I'd like to ask what problem do you mean specifically. Otherwise I tend to answer just "everything is okay".

[amano-kenji]

Specifically, #14709 and #15989

https://sambowman.tech/blog/posts/mind-the-encryptionroot-how-to-save-your-data-when-zfs-loses-its-mind/ discusses issues with encrypted send/recv in 2023.

https://github.com/openzfs/zfs/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22Type%3A%20Defect%22%20label%3A%22Component%3A%20Encryption%22%20label%3A%22Component%3A%20Send%2FRecv%22 has old issues that may have been resolved by now.

[amotin]

I don't have answers for those two. But I am sure there are plenty of still open issues that are either caused by local issues, or too difficult to reproduce or were already fixed at some point.

[amano-kenji]

Many fixes regarding encrypted send/recv have been pushed, but I still want to test encrypted zfs backup to make sure that I can recover. Do you have any tips on testing encrypted ZFS backups? I have terabytes of data which would be slow to test if I just try to recover from scratch for a test.

[amotin]

ZFS has about 70 replication tests, including encrypted, that are executed several times for every new commit. Plus lots of people are using it daily on their systems. So it is impossible say that it does not work. It does. But before deploying any backup system it would be good to make sure you can actually restore it when time come, no matter what technology is used.