Skip to content

Commit 180c44e

Browse files
janlindstromjanlindstrom
committed
MDEV-8817: Failing assertion: new_state->key_version != ENCRYPTION_KEY_VERSION_INVALID
Folloup: Made encryption rules too strict (and incorrect). Allow creating table with ENCRYPTED=OFF with all values of ENCRYPTION_KEY_ID but create warning that nondefault values are ignored. Allow creating table with ENCRYPTED=DEFAULT if used key_id is found from key file (there was bug on this) and give error if key_id is not found.
1 parent 7cbecad commit 180c44e

File tree

4 files changed

+107
-22
lines changed

4 files changed

+107
-22
lines changed

‎mysql-test/suite/encryption/r/innodb-encryption-alter.result‎

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,51 @@ SET GLOBAL innodb_file_per_table = ON;
33
SET GLOBAL innodb_encrypt_tables = ON;
44
SET GLOBAL innodb_encryption_threads = 4;
55
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=4;
6+
Warnings:
7+
Warning 140 InnoDB: Ignored ENCRYPTION_KEY_ID 4 when encryption is disabled
8+
DROP TABLE t1;
9+
set innodb_default_encryption_key_id = 99;
10+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
611
ERROR HY000: Can't create table `test`.`t1` (errno: 140 "Wrong create options")
12+
SHOW WARNINGS;
13+
Level Code Message
14+
Warning 140 InnoDB: ENCRYPTION_KEY_ID 99 not available
15+
Error 1005 Can't create table `test`.`t1` (errno: 140 "Wrong create options")
16+
Warning 1030 Got error 140 "Wrong create options" from storage engine InnoDB
17+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
18+
ERROR HY000: Can't create table `test`.`t1` (errno: 140 "Wrong create options")
19+
SHOW WARNINGS;
20+
Level Code Message
21+
Warning 140 InnoDB: ENCRYPTION_KEY_ID 99 not available
22+
Error 1005 Can't create table `test`.`t1` (errno: 140 "Wrong create options")
23+
Warning 1030 Got error 140 "Wrong create options" from storage engine InnoDB
24+
set innodb_default_encryption_key_id = 4;
25+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
26+
SHOW CREATE TABLE t1;
27+
Table Create Table
28+
t1 CREATE TABLE `t1` (
29+
`pk` int(11) NOT NULL AUTO_INCREMENT,
30+
`c` varchar(256) DEFAULT NULL,
31+
PRIMARY KEY (`pk`)
32+
) ENGINE=InnoDB DEFAULT CHARSET=latin1 `ENCRYPTED`=YES `ENCRYPTION_KEY_ID`=4
33+
DROP TABLE t1;
34+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
35+
SHOW CREATE TABLE t1;
36+
Table Create Table
37+
t1 CREATE TABLE `t1` (
38+
`pk` int(11) NOT NULL AUTO_INCREMENT,
39+
`c` varchar(256) DEFAULT NULL,
40+
PRIMARY KEY (`pk`)
41+
) ENGINE=InnoDB DEFAULT CHARSET=latin1 `ENCRYPTION_KEY_ID`=4
742
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
8-
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
9-
ALTER TABLE t2 ENCRYPTION_KEY_ID=4;
10-
ERROR HY000: Can't create table `test`.`#sql-temporary` (errno: 140 "Wrong create options")
43+
Warnings:
44+
Warning 140 InnoDB: Ignored ENCRYPTION_KEY_ID 1 when encryption is disabled
1145
ALTER TABLE t1 ENCRYPTION_KEY_ID=99;
1246
ERROR HY000: Can't create table `test`.`#sql-temporary` (errno: 140 "Wrong create options")
47+
SHOW WARNINGS;
48+
Level Code Message
49+
Warning 140 InnoDB: ENCRYPTION_KEY_ID 99 not available
50+
Error 1005 Can't create table `test`.`#sql-temporary` (errno: 140 "Wrong create options")
51+
Warning 1030 Got error 140 "Wrong create options" from storage engine InnoDB
52+
set innodb_default_encryption_key_id = 1;
1353
drop table t1,t2;

‎mysql-test/suite/encryption/t/innodb-encryption-alter.test‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,29 @@ SET GLOBAL innodb_file_per_table = ON;
1717
SET GLOBAL innodb_encrypt_tables = ON;
1818
SET GLOBAL innodb_encryption_threads = 4;
1919

20-
--error 1005
2120
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=4;
22-
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
23-
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
24-
--replace_regex /#sql-[0-9a-f_]*/#sql-temporary/
21+
DROP TABLE t1;
22+
set innodb_default_encryption_key_id = 99;
23+
--error 1005
24+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
25+
SHOW WARNINGS;
2526
--error 1005
26-
ALTER TABLE t2 ENCRYPTION_KEY_ID=4;
27+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
28+
SHOW WARNINGS;
29+
set innodb_default_encryption_key_id = 4;
30+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
31+
SHOW CREATE TABLE t1;
32+
DROP TABLE t1;
33+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
34+
SHOW CREATE TABLE t1;
35+
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
2736
--replace_regex /#sql-[0-9a-f_]*/#sql-temporary/
2837
--error 1005
2938
ALTER TABLE t1 ENCRYPTION_KEY_ID=99;
39+
--replace_regex /#sql-[0-9a-f_]*/#sql-temporary/
40+
SHOW WARNINGS;
41+
set innodb_default_encryption_key_id = 1;
42+
3043

3144
--disable_warnings
3245
--disable_query_log

‎storage/innobase/handler/ha_innodb.cc‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11491,6 +11491,7 @@ ha_innobase::check_table_options(
1149111491
}
1149211492
}
1149311493

11494+
/* If encryption is set up make sure that used key_id is found */
1149411495
if (encrypt == FIL_SPACE_ENCRYPTION_ON ||
1149511496
(encrypt == FIL_SPACE_ENCRYPTION_DEFAULT && srv_encrypt_tables)) {
1149611497
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
@@ -11504,18 +11505,33 @@ ha_innobase::check_table_options(
1150411505
}
1150511506
}
1150611507

11507-
/* Do not allow creating unencrypted table with nondefault
11508-
encryption key */
11509-
if ((encrypt == FIL_SPACE_ENCRYPTION_OFF ||
11510-
(encrypt == FIL_SPACE_ENCRYPTION_DEFAULT && !srv_encrypt_tables)) &&
11511-
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
11508+
/* Ignore nondefault key_id if encryption is set off */
11509+
if (encrypt == FIL_SPACE_ENCRYPTION_OFF &&
11510+
options->encryption_key_id != THDVAR(thd, default_encryption_key_id)) {
1151211511
push_warning_printf(
1151311512
thd, Sql_condition::WARN_LEVEL_WARN,
1151411513
HA_WRONG_CREATE_OPTION,
11515-
"InnoDB: Incorrect ENCRYPTION_KEY_ID %u when encryption is disabled",
11514+
"InnoDB: Ignored ENCRYPTION_KEY_ID %u when encryption is disabled",
1151611515
(uint)options->encryption_key_id
1151711516
);
11518-
return "ENCRYPTION_KEY_ID";
11517+
options->encryption_key_id = FIL_DEFAULT_ENCRYPTION_KEY;
11518+
}
11519+
11520+
/* If default encryption is used make sure that used kay is found
11521+
from key file. */
11522+
if (encrypt == FIL_SPACE_ENCRYPTION_DEFAULT &&
11523+
!srv_encrypt_tables &&
11524+
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
11525+
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
11526+
push_warning_printf(
11527+
thd, Sql_condition::WARN_LEVEL_WARN,
11528+
HA_WRONG_CREATE_OPTION,
11529+
"InnoDB: ENCRYPTION_KEY_ID %u not available",
11530+
(uint)options->encryption_key_id
11531+
);
11532+
return "ENCRYPTION_KEY_ID";
11533+
11534+
}
1151911535
}
1152011536

1152111537
/* Check atomic writes requirements */

‎storage/xtradb/handler/ha_innodb.cc‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11973,6 +11973,7 @@ ha_innobase::check_table_options(
1197311973
}
1197411974
}
1197511975

11976+
/* If encryption is set up make sure that used key_id is found */
1197611977
if (encrypt == FIL_SPACE_ENCRYPTION_ON ||
1197711978
(encrypt == FIL_SPACE_ENCRYPTION_DEFAULT && srv_encrypt_tables)) {
1197811979
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
@@ -11987,18 +11988,33 @@ ha_innobase::check_table_options(
1198711988
}
1198811989
}
1198911990

11990-
/* Do not allow creating unencrypted table with nondefault
11991-
encryption key */
11992-
if ((encrypt == FIL_SPACE_ENCRYPTION_OFF ||
11993-
(encrypt == FIL_SPACE_ENCRYPTION_DEFAULT && !srv_encrypt_tables)) &&
11994-
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
11991+
/* Ignore nondefault key_id if encryption is set off */
11992+
if (encrypt == FIL_SPACE_ENCRYPTION_OFF &&
11993+
options->encryption_key_id != THDVAR(thd, default_encryption_key_id)) {
1199511994
push_warning_printf(
1199611995
thd, Sql_condition::WARN_LEVEL_WARN,
1199711996
HA_WRONG_CREATE_OPTION,
11998-
"InnoDB: Incorrect ENCRYPTION_KEY_ID %u when encryption is disabled",
11997+
"InnoDB: Ignored ENCRYPTION_KEY_ID %u when encryption is disabled",
1199911998
(uint)options->encryption_key_id
1200011999
);
12001-
return "ENCRYPTION_KEY_ID";
12000+
options->encryption_key_id = FIL_DEFAULT_ENCRYPTION_KEY;
12001+
}
12002+
12003+
/* If default encryption is used make sure that used kay is found
12004+
from key file. */
12005+
if (encrypt == FIL_SPACE_ENCRYPTION_DEFAULT &&
12006+
!srv_encrypt_tables &&
12007+
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
12008+
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
12009+
push_warning_printf(
12010+
thd, Sql_condition::WARN_LEVEL_WARN,
12011+
HA_WRONG_CREATE_OPTION,
12012+
"InnoDB: ENCRYPTION_KEY_ID %u not available",
12013+
(uint)options->encryption_key_id
12014+
);
12015+
return "ENCRYPTION_KEY_ID";
12016+
12017+
}
1200212018
}
1200312019

1200412020
/* Check atomic writes requirements */

0 commit comments

Comments
 (0)