Skip to content

Commit 5c62dd2

Browse files
janlindstromjanlindstrom
committed
MDEV-8832: Encryption meta data should not be stored when ENCRYPTED=DEFAULT and innodb-encrypt-tables=OFF
1 parent 212698b commit 5c62dd2

File tree

5 files changed

+228
-4
lines changed

5 files changed

+228
-4
lines changed

‎mysql-test/suite/encryption/r/innodb_encryption_filekeys.result‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
SET GLOBAL innodb_file_format = `Barracuda`;
2+
SET GLOBAL innodb_file_per_table = ON;
3+
SET GLOBAL innodb_encrypt_tables = OFF;
4+
SET GLOBAL innodb_encryption_threads = 4;
5+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
6+
SHOW CREATE TABLE t1;
7+
Table Create Table
8+
t1 CREATE TABLE `t1` (
9+
`pk` int(11) NOT NULL AUTO_INCREMENT,
10+
`c` varchar(256) DEFAULT NULL,
11+
PRIMARY KEY (`pk`)
12+
) ENGINE=InnoDB DEFAULT CHARSET=latin1
13+
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
14+
CREATE TABLE t3 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO;
15+
CREATE TABLE t4 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
16+
INSERT INTO t2 select * from t1;
17+
INSERT INTO t3 select * from t1;
18+
INSERT INTO t4 select * from t1;
19+
SET GLOBAL innodb_encrypt_tables = on;
20+
# Wait max 10 min for key encryption threads to encrypt required all spaces
21+
# Success!
22+
SELECT COUNT(1) FROM t1;
23+
COUNT(1)
24+
400
25+
SELECT COUNT(1) FROM t2;
26+
COUNT(1)
27+
400
28+
SELECT COUNT(1) FROM t3;
29+
COUNT(1)
30+
400
31+
SELECT COUNT(1) FROM t4;
32+
COUNT(1)
33+
400
34+
SET GLOBAL innodb_encrypt_tables = off;
35+
# Wait max 10 min for key encryption threads to decrypt all required spaces
36+
# Success!
37+
SET GLOBAL innodb_encrypt_tables = ON;
38+
set GLOBAL innodb_default_encryption_key_id=4;
39+
CREATE TABLE t5 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
40+
SHOW CREATE TABLE t5;
41+
Table Create Table
42+
t5 CREATE TABLE `t5` (
43+
`pk` int(11) NOT NULL AUTO_INCREMENT,
44+
`c` varchar(256) DEFAULT NULL,
45+
PRIMARY KEY (`pk`)
46+
) ENGINE=InnoDB DEFAULT CHARSET=latin1
47+
INSERT INTO t5 select * from t1;
48+
# Wait max 10 min for key encryption threads to encrypt required all spaces
49+
# Success!
50+
SELECT COUNT(1) FROM t1;
51+
COUNT(1)
52+
400
53+
SELECT COUNT(1) FROM t2;
54+
COUNT(1)
55+
400
56+
SELECT COUNT(1) FROM t3;
57+
COUNT(1)
58+
400
59+
SELECT COUNT(1) FROM t4;
60+
COUNT(1)
61+
400
62+
SELECT COUNT(1) FROM t5;
63+
COUNT(1)
64+
400
65+
drop table t1,t2,t3,t4, t5;
66+
set GLOBAL innodb_default_encryption_key_id=1;

‎mysql-test/suite/encryption/t/innodb_encryption_filekeys.opt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
--innodb-tablespaces-encryption

‎mysql-test/suite/encryption/t/innodb_encryption_filekeys.test‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
-- source include/have_innodb.inc
2+
-- source include/have_file_key_management_plugin.inc
3+
# embedded does not support restart
4+
-- source include/not_embedded.inc
5+
6+
--disable_query_log
7+
let $innodb_file_format_orig = `SELECT @@innodb_file_format`;
8+
let $innodb_file_per_table_orig = `SELECT @@innodb_file_per_table`;
9+
let $encrypt_tables = `SELECT @@innodb_encrypt_tables`;
10+
let $threads = `SELECT @@innodb_encryption_threads`;
11+
--enable_query_log
12+
13+
SET GLOBAL innodb_file_format = `Barracuda`;
14+
SET GLOBAL innodb_file_per_table = ON;
15+
SET GLOBAL innodb_encrypt_tables = OFF;
16+
SET GLOBAL innodb_encryption_threads = 4;
17+
18+
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
19+
SHOW CREATE TABLE t1;
20+
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
21+
CREATE TABLE t3 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO;
22+
CREATE TABLE t4 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
23+
24+
--disable_warnings
25+
--disable_query_log
26+
set autocommit=0;
27+
let $i = 400;
28+
while ($i)
29+
{
30+
INSERT INTO t1 values(NULL, substring(MD5(RAND()), -128));
31+
dec $i;
32+
}
33+
commit;
34+
set autocommit=1;
35+
--enable_warnings
36+
--enable_query_log
37+
38+
INSERT INTO t2 select * from t1;
39+
INSERT INTO t3 select * from t1;
40+
INSERT INTO t4 select * from t1;
41+
42+
SET GLOBAL innodb_encrypt_tables = on;
43+
44+
--echo # Wait max 10 min for key encryption threads to encrypt required all spaces
45+
let $cnt=600;
46+
while ($cnt)
47+
{
48+
let $success=`SELECT COUNT(*) = 1 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0`;
49+
if ($success)
50+
{
51+
let $cnt=0;
52+
}
53+
if (!$success)
54+
{
55+
real_sleep 1;
56+
dec $cnt;
57+
}
58+
}
59+
if (!$success)
60+
{
61+
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
62+
SHOW STATUS LIKE 'innodb_encryption%';
63+
-- die Timeout waiting for encryption threads
64+
}
65+
--echo # Success!
66+
67+
SELECT COUNT(1) FROM t1;
68+
SELECT COUNT(1) FROM t2;
69+
SELECT COUNT(1) FROM t3;
70+
SELECT COUNT(1) FROM t4;
71+
72+
SET GLOBAL innodb_encrypt_tables = off;
73+
74+
--echo # Wait max 10 min for key encryption threads to decrypt all required spaces
75+
let $cnt=600;
76+
while ($cnt)
77+
{
78+
let $success=`SELECT COUNT(*) = 2 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0`;
79+
if ($success)
80+
{
81+
let $cnt=0;
82+
}
83+
if (!$success)
84+
{
85+
real_sleep 1;
86+
dec $cnt;
87+
}
88+
}
89+
if (!$success)
90+
{
91+
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
92+
SHOW STATUS LIKE 'innodb_encryption%';
93+
-- die Timeout waiting for encryption threads
94+
}
95+
--echo # Success!
96+
97+
SET GLOBAL innodb_encrypt_tables = ON;
98+
set GLOBAL innodb_default_encryption_key_id=4;
99+
CREATE TABLE t5 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
100+
SHOW CREATE TABLE t5;
101+
INSERT INTO t5 select * from t1;
102+
103+
--echo # Wait max 10 min for key encryption threads to encrypt required all spaces
104+
let $cnt=600;
105+
while ($cnt)
106+
{
107+
let $success=`SELECT COUNT(*) = 1 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0`;
108+
if ($success)
109+
{
110+
let $cnt=0;
111+
}
112+
if (!$success)
113+
{
114+
real_sleep 1;
115+
dec $cnt;
116+
}
117+
}
118+
if (!$success)
119+
{
120+
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
121+
SHOW STATUS LIKE 'innodb_encryption%';
122+
-- die Timeout waiting for encryption threads
123+
}
124+
--echo # Success!
125+
126+
SELECT COUNT(1) FROM t1;
127+
SELECT COUNT(1) FROM t2;
128+
SELECT COUNT(1) FROM t3;
129+
SELECT COUNT(1) FROM t4;
130+
SELECT COUNT(1) FROM t5;
131+
132+
drop table t1,t2,t3,t4, t5;
133+
set GLOBAL innodb_default_encryption_key_id=1;
134+
135+
# reset system
136+
--disable_query_log
137+
EVAL SET GLOBAL innodb_file_per_table = $innodb_file_per_table_orig;
138+
EVAL SET GLOBAL innodb_file_format = $innodb_file_format_orig;
139+
EVAL SET GLOBAL innodb_encrypt_tables = $encrypt_tables;
140+
EVAL SET GLOBAL innodb_encryption_threads = $threads;
141+
--enable_query_log

‎storage/innobase/fil/fil0fil.cc‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3353,6 +3353,7 @@ fil_create_new_single_table_tablespace(
33533353
boolis_temp = !!(flags2 & DICT_TF2_TEMPORARY);
33543354
boolhas_data_dir = FSP_FLAGS_HAS_DATA_DIR(flags);
33553355
ulint atomic_writes = FSP_FLAGS_GET_ATOMIC_WRITES(flags);
3356+
fil_space_crypt_t *crypt_data = NULL;
33563357

33573358
ut_a(space_id > 0);
33583359
ut_ad(!srv_read_only_mode);
@@ -3506,8 +3507,15 @@ fil_create_new_single_table_tablespace(
35063507
}
35073508
}
35083509

3510+
/* Create crypt data if the tablespace is either encrypted or user has
3511+
requested it to remain unencrypted. */
3512+
if (mode == FIL_SPACE_ENCRYPTION_ON || mode == FIL_SPACE_ENCRYPTION_OFF ||
3513+
srv_encrypt_tables) {
3514+
crypt_data = fil_space_create_crypt_data(mode, key_id);
3515+
}
3516+
35093517
success = fil_space_create(tablename, space_id, flags, FIL_TABLESPACE,
3510-
fil_space_create_crypt_data(mode, key_id));
3518+
crypt_data);
35113519

35123520
if (!success || !fil_node_create(path, size, space_id, FALSE)) {
35133521
err = DB_ERROR;
@@ -6501,7 +6509,7 @@ fil_iterate(
65016509

65026510
if (page_compressed) {
65036511
ulint len = 0;
6504-
byte* res = fil_compress_page(space_id,
6512+
fil_compress_page(space_id,
65056513
src,
65066514
NULL,
65076515
size,

‎storage/xtradb/fil/fil0fil.cc‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3387,6 +3387,7 @@ fil_create_new_single_table_tablespace(
33873387
boolis_temp = !!(flags2 & DICT_TF2_TEMPORARY);
33883388
boolhas_data_dir = FSP_FLAGS_HAS_DATA_DIR(flags);
33893389
ulint atomic_writes = FSP_FLAGS_GET_ATOMIC_WRITES(flags);
3390+
fil_space_crypt_t *crypt_data = NULL;
33903391

33913392
ut_a(space_id > 0);
33923393
ut_ad(!srv_read_only_mode);
@@ -3540,8 +3541,15 @@ fil_create_new_single_table_tablespace(
35403541
}
35413542
}
35423543

3544+
/* Create crypt data if the tablespace is either encrypted or user has
3545+
requested it to remain unencrypted. */
3546+
if (mode == FIL_SPACE_ENCRYPTION_ON || mode == FIL_SPACE_ENCRYPTION_OFF ||
3547+
srv_encrypt_tables) {
3548+
crypt_data = fil_space_create_crypt_data(mode, key_id);
3549+
}
3550+
35433551
success = fil_space_create(tablename, space_id, flags, FIL_TABLESPACE,
3544-
fil_space_create_crypt_data(mode, key_id));
3552+
crypt_data);
35453553

35463554
if (!success || !fil_node_create(path, size, space_id, FALSE)) {
35473555
err = DB_ERROR;
@@ -6558,7 +6566,7 @@ fil_iterate(
65586566

65596567
if (page_compressed) {
65606568
ulint len = 0;
6561-
byte* res = fil_compress_page(space_id,
6569+
fil_compress_page(space_id,
65626570
src,
65636571
NULL,
65646572
size,

0 commit comments

Comments
 (0)