Skip to content

Commit ada1074

Browse files
Thirunarayanandr-m
Thirunarayanan
authored and
dr-m
committed
MDEV-14398 innodb_encryption_rotate_key_age=0 causes innodb_encrypt_tables to be ignored
The statement SET GLOBAL innodb_encryption_rotate_key_age=0; would have the unwanted side effect that ENCRYPTION=DEFAULT tablespaces would no longer be encrypted or decrypted according to the setting of innodb_encrypt_tables. We implement a trigger, so that whenever one of the following is executed: SET GLOBAL innodb_encrypt_tables=OFF; SET GLOBAL innodb_encrypt_tables=ON; SET GLOBAL innodb_encrypt_tables=FORCE; all wrong-state ENCRYPTION=DEFAULT tablespaces will be added to fil_system_t::rotation_list, so that the encryption will be added or removed. Note: This will *NOT* happen automatically after a server restart. Before reading the first page of a data file, InnoDB cannot know the encryption status of the data file. The statement SET GLOBAL innodb_encrypt_tables will have the side effect that all not-yet-read InnoDB data files will be accessed in order to determine the encryption status. innodb_encrypt_tables_validate(): Stop disallowing SET GLOBAL innodb_encrypt_tables when innodb_encryption_rotate_key_age=0. This reverts part of commit 50eb40a that addressed MDEV-11738 and MDEV-11581. fil_system_t::read_page0(): Trigger a call to fil_node_t::read_page0(). Refactored from fil_space_get_space(). fil_crypt_rotation_list_fill(): If innodb_encryption_rotate_key_age=0, initialize fil_system->rotation_list. This is invoked both on SET GLOBAL innodb_encrypt_tables and on SET GLOBAL innodb_encryption_rotate_key_age=0. fil_space_set_crypt_data(): Remove. fil_parse_write_crypt_data(): Simplify the logic. This is joint work with Marko Mäkelä.
1 parent 2370eeb commit ada1074

File tree

9 files changed

+314
-118
lines changed

9 files changed

+314
-118
lines changed

‎mysql-test/suite/encryption/r/innodb-key-rotation-disable.result

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,6 @@ NAME ENCRYPTION_SCHEME CURRENT_KEY_ID
3737
enctests/t7 0 1
3838
enctests/t8 0 1
3939
enctests/t9 0 1
40-
SET GLOBAL innodb_encrypt_tables=OFF;
41-
ERROR 42000: Variable 'innodb_encrypt_tables' can't be set to the value of 'OFF'
42-
SET GLOBAL innodb_encrypt_tables=ON;
43-
ERROR 42000: Variable 'innodb_encrypt_tables' can't be set to the value of 'ON'
4440
# t1 default on expecting NOT FOUND
4541
NOT FOUND /secred/ in t1.ibd
4642
# t2 default on expecting NOT FOUND

‎mysql-test/suite/encryption/r/innodb_encrypt_key_rotation_age.result

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
CREATE TABLE t1 (f1 INT, f2 VARCHAR(256))engine=innodb;
2+
INSERT INTO t1 VALUES(1, 'MariaDB'), (2, 'Robot'), (3, 'Science');
3+
INSERT INTO t1 SELECT * FROM t1;
4+
CREATE TABLE t2(f1 INT, f2 VARCHAR(256))engine=innodb;
5+
INSERT INTO t2 SELECT * FROM t1;
6+
CREATE TABLE t3(f1 INT, f2 VARCHAR(256))engine=innodb encrypted=yes;
7+
INSERT INTO t3 SELECT * FROM t1;
8+
# Restart the server with encryption
9+
# Wait until encryption threads have encrypted all tablespaces
10+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
11+
NAME
12+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
13+
NAME
14+
innodb_system
15+
mysql/innodb_index_stats
16+
mysql/innodb_table_stats
17+
test/t1
18+
test/t2
19+
test/t3
20+
# Restart the server with innodb_encryption_rotate_key_age= 0
21+
create table t4 (f1 int not null)engine=innodb encrypted=NO;
22+
# Wait until encryption threads have encrypted all tablespaces
23+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
24+
NAME
25+
test/t4
26+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
27+
NAME
28+
innodb_system
29+
mysql/innodb_index_stats
30+
mysql/innodb_table_stats
31+
test/t1
32+
test/t2
33+
test/t3
34+
# Disable encryption when innodb_encryption_rotate_key_age is 0
35+
set global innodb_encrypt_tables = OFF;
36+
# Wait until encryption threads to decrypt all unencrypted tablespaces
37+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
38+
NAME
39+
innodb_system
40+
mysql/innodb_index_stats
41+
mysql/innodb_table_stats
42+
test/t1
43+
test/t2
44+
test/t4
45+
# Display only encrypted create tables (t3)
46+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
47+
NAME
48+
test/t3
49+
# Enable encryption when innodb_encryption_rotate_key_age is 0
50+
set global innodb_encrypt_tables = ON;
51+
# Wait until encryption threads to encrypt all unencrypted tablespaces
52+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
53+
NAME
54+
test/t4
55+
# Display only unencrypted create tables (t4)
56+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
57+
NAME
58+
innodb_system
59+
mysql/innodb_index_stats
60+
mysql/innodb_table_stats
61+
test/t1
62+
test/t2
63+
test/t3
64+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
65+
NAME
66+
test/t4
67+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
68+
NAME
69+
innodb_system
70+
mysql/innodb_index_stats
71+
mysql/innodb_table_stats
72+
test/t1
73+
test/t2
74+
test/t3
75+
DROP TABLE t4, t3, t2, t1;

‎mysql-test/suite/encryption/t/innodb-key-rotation-disable.test

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,6 @@ SELECT NAME,ENCRYPTION_SCHEME,CURRENT_KEY_ID FROM INFORMATION_SCHEMA.INNODB_TABL
4343
--echo # should list tables t7-t9
4444
SELECT NAME,ENCRYPTION_SCHEME,CURRENT_KEY_ID FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 and NAME LIKE 'enctests%';
4545

46-
--error ER_WRONG_VALUE_FOR_VAR
47-
SET GLOBAL innodb_encrypt_tables=OFF;
48-
--error ER_WRONG_VALUE_FOR_VAR
49-
SET GLOBAL innodb_encrypt_tables=ON;
50-
5146
--let $MYSQLD_DATADIR=`select @@datadir`
5247

5348
-- source include/shutdown_mysqld.inc

‎mysql-test/suite/encryption/t/innodb_encrypt_key_rotation_age.opt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
--innodb-tablespaces-encryption
2+
--innodb_encrypt_tables=ON

‎mysql-test/suite/encryption/t/innodb_encrypt_key_rotation_age.test

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
-- source include/have_innodb.inc
2+
-- source include/not_embedded.inc
3+
-- source include/have_example_key_management_plugin.inc
4+
5+
CREATE TABLE t1 (f1 INT, f2 VARCHAR(256))engine=innodb;
6+
INSERT INTO t1 VALUES(1, 'MariaDB'), (2, 'Robot'), (3, 'Science');
7+
INSERT INTO t1 SELECT * FROM t1;
8+
9+
CREATE TABLE t2(f1 INT, f2 VARCHAR(256))engine=innodb;
10+
INSERT INTO t2 SELECT * FROM t1;
11+
12+
CREATE TABLE t3(f1 INT, f2 VARCHAR(256))engine=innodb encrypted=yes;
13+
INSERT INTO t3 SELECT * FROM t1;
14+
15+
--echo # Restart the server with encryption
16+
17+
let $restart_parameters= --innodb_encryption_threads=5 --innodb_encryption_rotate_key_age=16384;
18+
--source include/restart_mysqld.inc
19+
20+
--echo # Wait until encryption threads have encrypted all tablespaces
21+
22+
--let $tables_count= `select count(*) + 1 from information_schema.tables where engine = 'InnoDB'`
23+
--let $wait_timeout= 600
24+
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
25+
--source include/wait_condition.inc
26+
27+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
28+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
29+
30+
--echo # Restart the server with innodb_encryption_rotate_key_age= 0
31+
32+
let $restart_parameters= --innodb_encryption_threads=1 --innodb_encryption_rotate_key_age=0;
33+
34+
--source include/restart_mysqld.inc
35+
36+
create table t4 (f1 int not null)engine=innodb encrypted=NO;
37+
38+
--echo # Wait until encryption threads have encrypted all tablespaces
39+
40+
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
41+
--let $wait_timeout= 600
42+
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
43+
--source include/wait_condition.inc
44+
45+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
46+
47+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
48+
49+
--echo # Disable encryption when innodb_encryption_rotate_key_age is 0
50+
set global innodb_encrypt_tables = OFF;
51+
52+
--echo # Wait until encryption threads to decrypt all unencrypted tablespaces
53+
54+
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
55+
--let $wait_timeout= 600
56+
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND ROTATING_OR_FLUSHING = 0;
57+
--source include/wait_condition.inc
58+
59+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
60+
--echo # Display only encrypted create tables (t3)
61+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
62+
63+
--echo # Enable encryption when innodb_encryption_rotate_key_age is 0
64+
set global innodb_encrypt_tables = ON;
65+
66+
--echo # Wait until encryption threads to encrypt all unencrypted tablespaces
67+
68+
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
69+
--let $wait_timeout= 600
70+
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
71+
--source include/wait_condition.inc
72+
73+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
74+
--echo # Display only unencrypted create tables (t4)
75+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
76+
77+
--let $restart_parameters=
78+
-- source include/restart_mysqld.inc
79+
80+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
81+
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
82+
DROP TABLE t4, t3, t2, t1;

0 commit comments

Comments
 (0)