Skip to content

Commit ef40018

Browse files
author
Jan Lindström
committed
MDEV-17230: encryption_key_id from alter is ignored by encryption threads
Background: Used encryption key_id is stored to encryption metadata i.e. crypt_data that is stored on page 0 of the tablespace of the table. crypt_data is created only if implicit encryption/not encryption is requested i.e. ENCRYPTED=[YES|NO] table option is used fil_create_new_single_table_tablespace on fil0fil.cc. Later if encryption is enabled all tables that use default encryption mode (i.e. no encryption table option is set) are encrypted with default encryption key_id that is 1. See fil_crypt_start_encrypting_space on fil0crypt.cc. ha_innobase::check_table_options() If default encryption is used and encryption is disabled, you may not use nondefault encryption_key_id as it is not stored anywhere.
1 parent bae21bf commit ef40018

File tree

4 files changed

+83
-28
lines changed

4 files changed

+83
-28
lines changed

‎mysql-test/suite/encryption/r/innodb-encryption-alter.result

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,40 @@ Warning 140 InnoDB: ENCRYPTION_KEY_ID 99 not available
5050
Error 1478 Table storage engine 'InnoDB' does not support the create option 'ENCRYPTION_KEY_ID'
5151
set innodb_default_encryption_key_id = 1;
5252
drop table t1,t2;
53+
SET GLOBAL innodb_encrypt_tables=OFF;
54+
CREATE TABLE t1 (a int not null primary key) engine=innodb;
55+
ALTER TABLE t1 ENCRYPTION_KEY_ID=4;
56+
ERROR HY000: Table storage engine 'InnoDB' does not support the create option 'ENCRYPTION_KEY_ID'
57+
SHOW WARNINGS;
58+
Level Code Message
59+
Warning 140 InnoDB: innodb_encrypt_tables=OFF only allows ENCRYPTION_KEY_ID=1
60+
Error 1478 Table storage engine 'InnoDB' does not support the create option 'ENCRYPTION_KEY_ID'
61+
SHOW CREATE TABLE t1;
62+
Table Create Table
63+
t1 CREATE TABLE `t1` (
64+
`a` int(11) NOT NULL,
65+
PRIMARY KEY (`a`)
66+
) ENGINE=InnoDB DEFAULT CHARSET=latin1
67+
DROP TABLE t1;
68+
CREATE TABLE t2 (a int not null primary key) engine=innodb;
69+
ALTER TABLE t2 ENCRYPTION_KEY_ID=4, ALGORITHM=COPY;
70+
ERROR HY000: Can't create table `test`.`#sql-temporary` (errno: 140 "Wrong create options")
71+
SHOW WARNINGS;
72+
Level Code Message
73+
Warning 140 InnoDB: innodb_encrypt_tables=OFF only allows ENCRYPTION_KEY_ID=1
74+
Error 1005 Can't create table `test`.`#sql-temporary` (errno: 140 "Wrong create options")
75+
Warning 1030 Got error 140 "Wrong create options" from storage engine InnoDB
76+
SHOW CREATE TABLE t2;
77+
Table Create Table
78+
t2 CREATE TABLE `t2` (
79+
`a` int(11) NOT NULL,
80+
PRIMARY KEY (`a`)
81+
) ENGINE=InnoDB DEFAULT CHARSET=latin1
82+
DROP TABLE t2;
83+
CREATE TABLE t3 (a int not null primary key) engine=innodb ENCRYPTION_KEY_ID=4;
84+
ERROR HY000: Can't create table `test`.`t3` (errno: 140 "Wrong create options")
85+
SHOW WARNINGS;
86+
Level Code Message
87+
Warning 140 InnoDB: innodb_encrypt_tables=OFF only allows ENCRYPTION_KEY_ID=1
88+
Error 1005 Can't create table `test`.`t3` (errno: 140 "Wrong create options")
89+
Warning 1030 Got error 140 "Wrong create options" from storage engine InnoDB

‎mysql-test/suite/encryption/t/innodb-encryption-alter.test

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,30 @@ connection default;
8787

8888
drop table t1,t2;
8989

90+
#
91+
# MDEV-17230: encryption_key_id from alter is ignored by encryption threads
92+
#
93+
SET GLOBAL innodb_encrypt_tables=OFF;
94+
CREATE TABLE t1 (a int not null primary key) engine=innodb;
95+
--error ER_ILLEGAL_HA_CREATE_OPTION
96+
ALTER TABLE t1 ENCRYPTION_KEY_ID=4;
97+
SHOW WARNINGS;
98+
SHOW CREATE TABLE t1;
99+
DROP TABLE t1;
100+
101+
CREATE TABLE t2 (a int not null primary key) engine=innodb;
102+
--replace_regex /#sql-[0-9a-f_]*`/#sql-temporary`/
103+
--error ER_CANT_CREATE_TABLE
104+
ALTER TABLE t2 ENCRYPTION_KEY_ID=4, ALGORITHM=COPY;
105+
--replace_regex /#sql-[0-9a-f_]*`/#sql-temporary`/
106+
SHOW WARNINGS;
107+
SHOW CREATE TABLE t2;
108+
DROP TABLE t2;
109+
110+
--error ER_CANT_CREATE_TABLE
111+
CREATE TABLE t3 (a int not null primary key) engine=innodb ENCRYPTION_KEY_ID=4;
112+
SHOW WARNINGS;
113+
90114
# reset system
91115
--disable_query_log
92116
EVAL SET GLOBAL innodb_file_per_table = $innodb_file_per_table_orig;

‎storage/innobase/handler/ha_innodb.cc

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11958,21 +11958,18 @@ ha_innobase::check_table_options(
1195811958
options->encryption_key_id = FIL_DEFAULT_ENCRYPTION_KEY;
1195911959
}
1196011960

11961-
/* If default encryption is used make sure that used kay is found
11962-
from key file. */
11963-
if (encrypt == FIL_ENCRYPTION_DEFAULT &&
11964-
!srv_encrypt_tables &&
11965-
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
11966-
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
11967-
push_warning_printf(
11968-
thd, Sql_condition::WARN_LEVEL_WARN,
11969-
HA_WRONG_CREATE_OPTION,
11970-
"InnoDB: ENCRYPTION_KEY_ID %u not available",
11971-
(uint)options->encryption_key_id
11961+
/* If default encryption is used and encryption is disabled, you may
11962+
not use nondefault encryption_key_id as it is not stored anywhere. */
11963+
if (encrypt == FIL_ENCRYPTION_DEFAULT
11964+
&& !srv_encrypt_tables
11965+
&& options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
11966+
compile_time_assert(FIL_DEFAULT_ENCRYPTION_KEY == 1);
11967+
push_warning_printf(
11968+
thd, Sql_condition::WARN_LEVEL_WARN,
11969+
HA_WRONG_CREATE_OPTION,
11970+
"InnoDB: innodb_encrypt_tables=OFF only allows ENCRYPTION_KEY_ID=1"
1197211971
);
11973-
return "ENCRYPTION_KEY_ID";
11974-
11975-
}
11972+
return "ENCRYPTION_KEY_ID";
1197611973
}
1197711974

1197811975
/* Check atomic writes requirements */

‎storage/xtradb/handler/ha_innodb.cc

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12525,21 +12525,18 @@ ha_innobase::check_table_options(
1252512525
options->encryption_key_id = FIL_DEFAULT_ENCRYPTION_KEY;
1252612526
}
1252712527

12528-
/* If default encryption is used make sure that used kay is found
12529-
from key file. */
12530-
if (encrypt == FIL_ENCRYPTION_DEFAULT &&
12531-
!srv_encrypt_tables &&
12532-
options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
12533-
if (!encryption_key_id_exists((unsigned int)options->encryption_key_id)) {
12534-
push_warning_printf(
12535-
thd, Sql_condition::WARN_LEVEL_WARN,
12536-
HA_WRONG_CREATE_OPTION,
12537-
"InnoDB: ENCRYPTION_KEY_ID %u not available",
12538-
(uint)options->encryption_key_id
12528+
/* If default encryption is used and encryption is disabled, you may
12529+
not use nondefault encryption_key_id as it is not stored anywhere. */
12530+
if (encrypt == FIL_ENCRYPTION_DEFAULT
12531+
&& !srv_encrypt_tables
12532+
&& options->encryption_key_id != FIL_DEFAULT_ENCRYPTION_KEY) {
12533+
compile_time_assert(FIL_DEFAULT_ENCRYPTION_KEY == 1);
12534+
push_warning_printf(
12535+
thd, Sql_condition::WARN_LEVEL_WARN,
12536+
HA_WRONG_CREATE_OPTION,
12537+
"InnoDB: innodb_encrypt_tables=OFF only allows ENCRYPTION_KEY_ID=1"
1253912538
);
12540-
return "ENCRYPTION_KEY_ID";
12541-
12542-
}
12539+
return "ENCRYPTION_KEY_ID";
1254312540
}
1254412541

1254512542
/* Check atomic writes requirements */

0 commit comments

Comments
 (0)