database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-13557: Startup failure, unable to decrypt ibdata1

Browse Source 
Fixes also MDEV-13488: InnoDB writes CRYPT_INFO even though
encryption is not enabled.

Fixes also MDEV-13093: Leak of Datafile::m_crypt_info on
shutdown after failed startup.

Problem was that we created encryption metadata (crypt_data) for
system tablespace even when no encryption was enabled and too early.
System tablespace can be encrypted only using key rotation.

Test innodb-key-rotation-disable, innodb_encryption, innodb_lotoftables
require adjustment because INFORMATION_SCHEMA INNODB_TABLESPACES_ENCRYPTION
contain row only if tablespace really has encryption metadata.

xb_load_single_table_tablespace(): Do not call
fil_space_destroy_crypt_data() any more, because Datafile::m_crypt_data
has been removed.

fil_crypt_realloc_iops(): Avoid divide by zero.

fil_crypt_set_thread_cnt(): Set fil_crypt_threads_event if
encryption threads exist. This is required to find tablespaces
requiring key rotation if no other changes happen.

fil_crypt_find_space_to_rotate(): Decrease the amount of time waiting
when nothing happens to better enable key rotation on startup.

fil_ibd_open(), fil_ibd_load(): Load possible crypt_data from first
page.

class Datafile, class SysTablespace : remove m_crypt_info field.

Datafile::get_first_page(): Return a pointer to first page buffer.

fsp_header_init(): Write encryption metadata to page 0 only if
tablespace is encrypted or encryption is disabled by table option.

i_s_dict_fill_tablespaces_encryption(): Skip tablespaces that do not
contain encryption metadata. This is required to avoid too early
wait condition trigger in encrypted -> unencrypted state transfer.
This commit is contained in:
Jan Lindström
2017-08-29 14:23:34 +03:00
committed by Marko Mäkelä
parent 43b262af55
commit eca238aea7
17 changed files with 1330 additions and 380 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
extra/mariabackup/xtrabackup.cc
View File

@ -2598,10 +2598,6 @@ xb_load_single_table_tablespace(
ut_free(name); ut_free(name);
if (fil_space_crypt_t* crypt_info = file->get_crypt_info()) {
fil_space_destroy_crypt_data(&crypt_info);
}
delete file; delete file;
if (err != DB_SUCCESS && err != DB_CORRUPTION && xtrabackup_backup) { if (err != DB_SUCCESS && err != DB_CORRUPTION && xtrabackup_backup) {

61
mysql-test/suite/encryption/r/innodb-first-page-read.result
View File

@ -1,5 +1,6 @@
SET GLOBAL innodb_file_format = `Barracuda`; SET GLOBAL innodb_file_format = `Barracuda`;
SET GLOBAL innodb_file_per_table = ON; SET GLOBAL innodb_file_per_table = ON;
FLUSH STATUS;
create database innodb_test; create database innodb_test;
use innodb_test; use innodb_test;
create table innodb_normal(c1 bigint not null, b char(200)) engine=innodb; create table innodb_normal(c1 bigint not null, b char(200)) engine=innodb;
@ -50,40 +51,48 @@ insert into innodb_datadir1 select * from innodb_normal;
insert into innodb_datadir2 select * from innodb_normal; insert into innodb_datadir2 select * from innodb_normal;
insert into innodb_datadir3 select * from innodb_normal; insert into innodb_datadir3 select * from innodb_normal;
commit; commit;
FLUSH STATUS;
# Restart server and see how many page 0's are read # Restart server and see how many page 0's are read
# result should be less than actual number of tables # result should actual number of tables except remote tables could be read twice
# i.e. < 23 + 3 = 26 # i.e. < 23 + 3*2 = 29
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
use test; use test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
set global innodb_encrypt_tables=OFF; set global innodb_encrypt_tables=OFF;
# wait until tables are decrypted # wait until tables are decrypted
show status like 'innodb_pages0_read%'; # result should be actual number of tables except remote tables could be read twice
Variable_name Value # i.e. < 23 + 3*2 = 29
Innodb_pages0_read 26 SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
VARIABLE_VALUE <= 29
1
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
use test; use test;
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
VARIABLE_VALUE <= 29
1
FLUSH STATUS;
# restart and see number read page 0 # restart and see number read page 0
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
Variable_name Value VARIABLE_VALUE <= 29
Innodb_pages0_read 26 1
use test; use test;
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
VARIABLE_VALUE <= 29
1
drop database innodb_test; drop database innodb_test;
show status like 'innodb_pages0_read%'; FLUSH STATUS;
Variable_name Value
Innodb_pages0_read 26

3
mysql-test/suite/encryption/r/innodb-key-rotation-disable.result
View File

@ -2,9 +2,6 @@ SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_
NAME NAME
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
NAME NAME
mysql/innodb_table_stats
mysql/innodb_index_stats
innodb_system
create database enctests; create database enctests;
use enctests; use enctests;
create table t1(a int not null primary key, b char(200)) engine=innodb; create table t1(a int not null primary key, b char(200)) engine=innodb;

58
mysql-test/suite/encryption/r/innodb_encryption.result
View File

@ -8,25 +8,22 @@ innodb_encrypt_tables ON
innodb_encryption_rotate_key_age 15 innodb_encryption_rotate_key_age 15
innodb_encryption_rotation_iops 100 innodb_encryption_rotation_iops 100
innodb_encryption_threads 4 innodb_encryption_threads 4
DESCRIBE INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION; SET GLOBAL innodb_encrypt_tables = ON;
Field Type Null Key Default Extra # Wait max 10 min for key encryption threads to encrypt all spaces
SPACE int(11) unsigned NO 0 SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
NAME varchar(655) YES NULL NAME
ENCRYPTION_SCHEME int(11) unsigned NO 0 SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
KEYSERVER_REQUESTS int(11) unsigned NO 0 NAME
MIN_KEY_VERSION int(11) unsigned NO 0 innodb_system
CURRENT_KEY_VERSION int(11) unsigned NO 0
KEY_ROTATION_PAGE_NUMBER bigint(21) unsigned YES NULL
KEY_ROTATION_MAX_PAGE_NUMBER bigint(21) unsigned YES NULL
CURRENT_KEY_ID int(11) unsigned NO 0
ROTATING_OR_FLUSHING int(1) unsigned NO 0
# Wait max 5 min for key encryption threads to encrypt one space
# Success!
# Wait max 10 min for key encryption threads to encrypt all space
# Success! # Success!
# Now turn off encryption and wait for threads to decrypt everything # Now turn off encryption and wait for threads to decrypt everything
SET GLOBAL innodb_encrypt_tables = off; SET GLOBAL innodb_encrypt_tables = off;
# Wait max 10 min for key encryption threads to decrypt all space # Wait max 10 min for key encryption threads to encrypt all spaces
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
NAME
innodb_system
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
NAME
# Success! # Success!
# Shutdown innodb_encryption_threads # Shutdown innodb_encryption_threads
SET GLOBAL innodb_encryption_threads=0; SET GLOBAL innodb_encryption_threads=0;
@ -34,16 +31,20 @@ SET GLOBAL innodb_encryption_threads=0;
# since threads are off tables should remain unencrypted # since threads are off tables should remain unencrypted
SET GLOBAL innodb_encrypt_tables = on; SET GLOBAL innodb_encrypt_tables = on;
# Wait 15s to check that nothing gets encrypted # Wait 15s to check that nothing gets encrypted
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
NAME
innodb_system
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
NAME
# Success! # Success!
# Startup innodb_encryption_threads # Startup innodb_encryption_threads
SET GLOBAL innodb_encryption_threads=@start_global_value; SET GLOBAL innodb_encryption_threads=@start_global_value;
# Wait 1 min to check that it start encrypting again # Wait max 10 min for key encryption threads to encrypt all spaces
# Success! SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
# NAME
# Check that restart with encryption turned off works SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
# even if spaces are encrypted NAME
# innodb_system
# First wait max 10 min for key encryption threads to encrypt all spaces
# Success! # Success!
# Restart mysqld --innodb_encrypt_tables=0 --innodb_encryption_threads=0 # Restart mysqld --innodb_encrypt_tables=0 --innodb_encryption_threads=0
SHOW VARIABLES LIKE 'innodb_encrypt%'; SHOW VARIABLES LIKE 'innodb_encrypt%';
@ -53,9 +54,8 @@ innodb_encrypt_tables OFF
innodb_encryption_rotate_key_age 15 innodb_encryption_rotate_key_age 15
innodb_encryption_rotation_iops 100 innodb_encryption_rotation_iops 100
innodb_encryption_threads 0 innodb_encryption_threads 0
SELECT COUNT(*) > 0 as should_be_1 SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION NAME
WHERE MIN_KEY_VERSION <> 0; innodb_system
should_be_1 SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
1 NAME
# Restart mysqld again...with default options

1182
mysql-test/suite/encryption/r/innodb_lotoftables.result
View File

File diff suppressed because it is too large Load Diff

32
mysql-test/suite/encryption/t/innodb-first-page-read.test
View File

@ -7,6 +7,8 @@ SET GLOBAL innodb_file_format = `Barracuda`;
SET GLOBAL innodb_file_per_table = ON; SET GLOBAL innodb_file_per_table = ON;
--enable_warnings --enable_warnings
FLUSH STATUS;
create database innodb_test; create database innodb_test;
use innodb_test; use innodb_test;
create table innodb_normal(c1 bigint not null, b char(200)) engine=innodb; create table innodb_normal(c1 bigint not null, b char(200)) engine=innodb;
@ -63,16 +65,19 @@ insert into innodb_datadir2 select * from innodb_normal;
insert into innodb_datadir3 select * from innodb_normal; insert into innodb_datadir3 select * from innodb_normal;
commit; commit;
FLUSH STATUS;
--echo # Restart server and see how many page 0's are read --echo # Restart server and see how many page 0's are read
--source include/restart_mysqld.inc --source include/restart_mysqld.inc
--echo # result should be less than actual number of tables --echo # result should actual number of tables except remote tables could be read twice
--echo # i.e. < 23 + 3 = 26 --echo # i.e. < 23 + 3*2 = 29
show status like 'innodb_pages0_read%';
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use test; use test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
set global innodb_encrypt_tables=OFF; set global innodb_encrypt_tables=OFF;
@ -80,18 +85,25 @@ set global innodb_encrypt_tables=OFF;
--let $wait_condition=SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 --let $wait_condition=SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0
--source include/wait_condition.inc --source include/wait_condition.inc
show status like 'innodb_pages0_read%'; --echo # result should be actual number of tables except remote tables could be read twice
--echo # i.e. < 23 + 3*2 = 29
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use test; use test;
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
FLUSH STATUS;
--echo # restart and see number read page 0 --echo # restart and see number read page 0
-- source include/restart_mysqld.inc -- source include/restart_mysqld.inc
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use innodb_test; use innodb_test;
show status like 'innodb_pages0_read%'; SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
use test; use test;
SELECT VARIABLE_VALUE <= 29 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'innodb_pages0_read';
drop database innodb_test; drop database innodb_test;
show status like 'innodb_pages0_read%'; FLUSH STATUS;

165
mysql-test/suite/encryption/t/innodb_encryption.test
View File

@ -15,78 +15,29 @@ SET @start_global_value = @@global.innodb_encryption_threads;
SHOW VARIABLES LIKE 'innodb_encrypt%'; SHOW VARIABLES LIKE 'innodb_encrypt%';
DESCRIBE INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION; SET GLOBAL innodb_encrypt_tables = ON;
--echo # Wait max 5 min for key encryption threads to encrypt one space --echo # Wait max 10 min for key encryption threads to encrypt all spaces
let $cnt=300; --let $wait_timeout= 600
while ($cnt) --let $wait_condition=SELECT COUNT(*) >= 1 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
{ --source include/wait_condition.inc
let $success=`SELECT COUNT(*) > 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION > 0`;
if ($success) SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
{ SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # Success!
--echo # Wait max 10 min for key encryption threads to encrypt all space
let $cnt=600;
while ($cnt)
{
let $success=`SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0`;
if ($success)
{
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # Success! --echo # Success!
--echo # Now turn off encryption and wait for threads to decrypt everything --echo # Now turn off encryption and wait for threads to decrypt everything
SET GLOBAL innodb_encrypt_tables = off; SET GLOBAL innodb_encrypt_tables = off;
--echo # Wait max 10 min for key encryption threads to decrypt all space --echo # Wait max 10 min for key encryption threads to encrypt all spaces
let $cnt=600; --let $wait_timeout= 600
while ($cnt) --let $wait_condition=SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
{ --source include/wait_condition.inc
let $success=`SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0`;
if ($success) SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
{ SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # Success! --echo # Success!
--echo # Shutdown innodb_encryption_threads --echo # Shutdown innodb_encryption_threads
@ -97,84 +48,32 @@ SET GLOBAL innodb_encryption_threads=0;
SET GLOBAL innodb_encrypt_tables = on; SET GLOBAL innodb_encrypt_tables = on;
--echo # Wait 15s to check that nothing gets encrypted --echo # Wait 15s to check that nothing gets encrypted
let $cnt=15; --let $wait_timeout= 15
while ($cnt) --let $wait_condition=SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
{ --source include/wait_condition.inc
let $success=`SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0`;
if ($success) SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
{ SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
real_sleep 1;
dec $cnt;
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
-- die Failure, tablespace getting encrypted even if innodb_encryption_threads=0
}
}
--echo # Success! --echo # Success!
--echo # Startup innodb_encryption_threads --echo # Startup innodb_encryption_threads
SET GLOBAL innodb_encryption_threads=@start_global_value; SET GLOBAL innodb_encryption_threads=@start_global_value;
--echo # Wait 1 min to check that it start encrypting again --echo # Wait max 10 min for key encryption threads to encrypt all spaces
let $cnt=60; --let $wait_timeout= 600
while ($cnt) --let $wait_condition=SELECT COUNT(*) >=1 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
{ --source include/wait_condition.inc
let $success=`SELECT COUNT(*) > 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 OR KEY_ROTATION_PAGE_NUMBER IS NOT NULL`;
if ($success) SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
{ SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # Success!
--echo #
--echo # Check that restart with encryption turned off works
--echo # even if spaces are encrypted
--echo #
--echo # First wait max 10 min for key encryption threads to encrypt all spaces
let $cnt=600;
while ($cnt)
{
let $success=`SELECT COUNT(*) = 0 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0`;
if ($success)
{
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT * FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # Success! --echo # Success!
--echo # Restart mysqld --innodb_encrypt_tables=0 --innodb_encryption_threads=0 --echo # Restart mysqld --innodb_encrypt_tables=0 --innodb_encryption_threads=0
-- let $restart_parameters=--innodb_encrypt_tables=0 --innodb_encryption_threads=0 -- let $restart_parameters=--innodb_encrypt_tables=0 --innodb_encryption_threads=0
-- source include/restart_mysqld.inc -- source include/restart_mysqld.inc
SHOW VARIABLES LIKE 'innodb_encrypt%'; SHOW VARIABLES LIKE 'innodb_encrypt%';
SELECT COUNT(*) > 0 as should_be_1
FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION
WHERE MIN_KEY_VERSION <> 0;
--echo # Restart mysqld again...with default options SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
-- let $restart_parameters= SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
-- source include/restart_mysqld.inc

91
mysql-test/suite/encryption/t/innodb_lotoftables.test
View File

@ -48,9 +48,8 @@ show status like 'innodb_pages0_read%';
# #
# Verify # Verify
# #
--echo # should be 100 --echo # should be empty
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE NAME LIKE 'innodb_encrypted%';
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE NAME LIKE 'innodb_encrypted%';
# #
# This will create 100 tables that are encrypted always # This will create 100 tables that are encrypted always
@ -84,10 +83,10 @@ show status like 'innodb_pages0_read%';
# #
# Verify # Verify
# #
--echo # should be 100 --echo # should contain 100 tables
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
--echo # should be 100 --echo # should contain 0 tables
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
# #
# This will create 100 tables that are not encrypted # This will create 100 tables that are not encrypted
@ -121,45 +120,26 @@ show status like 'innodb_pages0_read%';
# #
# Verify # Verify
# #
--echo # should be 100 --echo # should contain 100 tables
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
--echo # should be 200 --echo # should contain 100 tables
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
use test; use test;
show status like 'innodb_pages0_read%'; show status like 'innodb_pages0_read%';
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SET GLOBAL innodb_encrypt_tables = on; SET GLOBAL innodb_encrypt_tables = on;
SET GLOBAL innodb_encryption_threads=4; SET GLOBAL innodb_encryption_threads=4;
--echo # Wait until all encrypted tables have been encrypted --let $wait_timeout= 600
let $cnt=600; --let $wait_condition=SELECT COUNT(*) = 100 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
while ($cnt) --source include/wait_condition.inc
{
let $success=`SELECT COUNT(*) = 100 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0`;
if ($success)
{
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
show status like 'innodb_pages0_read%'; show status like 'innodb_pages0_read%';
--echo # Success! --echo # Success!
@ -226,40 +206,19 @@ while ($tables)
show status like 'innodb_pages0_read%'; show status like 'innodb_pages0_read%';
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SET GLOBAL innodb_encrypt_tables = off; SET GLOBAL innodb_encrypt_tables = off;
SET GLOBAL innodb_encryption_threads=4; SET GLOBAL innodb_encryption_threads=4;
--echo # Wait until all default encrypted tables have been decrypted --let $wait_timeout= 600
let $cnt=600; --let $wait_condition=SELECT COUNT(*) = 100 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
while ($cnt) --source include/wait_condition.inc
{
let $success=`SELECT COUNT(*) = 100 FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0`;
if ($success)
{
let $cnt=0;
}
if (!$success)
{
real_sleep 1;
dec $cnt;
}
}
if (!$success)
{
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
SHOW STATUS LIKE 'innodb_encryption%';
-- die Timeout waiting for encryption threads
}
--echo # should be 100
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%'; SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
--echo # should be 200 SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%' ORDER BY NAME;
SELECT COUNT(*) FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND NAME LIKE 'innodb_encrypted%';
show status like 'innodb_pages0_read%';
# #
# Cleanup # Cleanup

23
storage/innobase/fil/fil0crypt.cc
View File

@ -1340,12 +1340,12 @@ fil_crypt_realloc_iops(
state->cnt_waited = 0; state->cnt_waited = 0;
state->sum_waited_us = 0; state->sum_waited_us = 0;
} else { } else {
DBUG_PRINT("ib_crypt", DBUG_PRINT("ib_crypt",
("thr_no: %u only waited " ULINTPF ("thr_no: %u only waited " ULINTPF
"%% skip re-estimate.", "%% skip re-estimate.",
state->thread_no, state->thread_no,
(100 * state->cnt_waited) / state->batch)); (100 * state->cnt_waited)
/ (state->batch ? state->batch : 1)));
} }
if (state->estimated_max_iops <= state->allocated_iops) { if (state->estimated_max_iops <= state->allocated_iops) {
@ -1448,7 +1448,7 @@ fil_crypt_find_space_to_rotate(
/* we need iops to start rotating */ /* we need iops to start rotating */
while (!state->should_shutdown() && !fil_crypt_alloc_iops(state)) { while (!state->should_shutdown() && !fil_crypt_alloc_iops(state)) {
os_event_reset(fil_crypt_threads_event); os_event_reset(fil_crypt_threads_event);
os_event_wait_time(fil_crypt_threads_event, 1000000); os_event_wait_time(fil_crypt_threads_event, 100000);
} }
if (state->should_shutdown()) { if (state->should_shutdown()) {
@ -2271,7 +2271,13 @@ fil_crypt_set_thread_cnt(
while(srv_n_fil_crypt_threads_started != srv_n_fil_crypt_threads) { while(srv_n_fil_crypt_threads_started != srv_n_fil_crypt_threads) {
os_event_reset(fil_crypt_event); os_event_reset(fil_crypt_event);
os_event_wait_time(fil_crypt_event, 1000000); os_event_wait_time(fil_crypt_event, 100000);
}
/* Send a message to encryption threads that there could be
something to do. */
if (srv_n_fil_crypt_threads) {
os_event_set(fil_crypt_threads_event);
} }
} }
@ -2424,10 +2430,11 @@ fil_space_crypt_get_status(
fil_crypt_read_crypt_data(const_cast<fil_space_t*>(space)); fil_crypt_read_crypt_data(const_cast<fil_space_t*>(space));
} }
status->space = ULINT_UNDEFINED;
fil_space_crypt_t* crypt_data = space->crypt_data; fil_space_crypt_t* crypt_data = space->crypt_data;
status->space = space->id;
if (crypt_data != NULL) { if (crypt_data != NULL) {
status->space = space->id;
mutex_enter(&crypt_data->mutex); mutex_enter(&crypt_data->mutex);
status->scheme = crypt_data->type; status->scheme = crypt_data->type;
status->keyserver_requests = crypt_data->keyserver_requests; status->keyserver_requests = crypt_data->keyserver_requests;

24
storage/innobase/fil/fil0fil.cc
View File

@ -4341,11 +4341,18 @@ fil_ibd_open(
skip_validate: skip_validate:
if (err == DB_SUCCESS) { if (err == DB_SUCCESS) {
fil_space_t* space = fil_space_create( const byte* first_page =
space_name, id, flags, purpose, df_default.is_open() ? df_default.get_first_page() :
df_remote.is_open() ? df_remote.get_crypt_info() : df_dict.is_open() ? df_dict.get_first_page() :
df_dict.is_open() ? df_dict.get_crypt_info() : df_remote.get_first_page();
df_default.get_crypt_info());
fil_space_crypt_t* crypt_data = first_page
? fil_space_read_crypt_data(page_size_t(flags),
first_page)
: NULL;
fil_space_t* space = fil_space_create(
space_name, id, flags, purpose, crypt_data);
/* We do not measure the size of the file, that is why /* We do not measure the size of the file, that is why
we pass the 0 below */ we pass the 0 below */
@ -4663,9 +4670,12 @@ fil_ibd_load(
<< FSP_FLAGS_MEM_COMPRESSION_LEVEL; << FSP_FLAGS_MEM_COMPRESSION_LEVEL;
} }
const byte* first_page = file.get_first_page();
fil_space_crypt_t* crypt_data = first_page
? fil_space_read_crypt_data(page_size_t(flags), first_page)
: NULL;
space = fil_space_create( space = fil_space_create(
file.name(), space_id, flags, FIL_TYPE_TABLESPACE, file.name(), space_id, flags, FIL_TYPE_TABLESPACE, crypt_data);
file.get_crypt_info());
if (space == NULL) { if (space == NULL) {
return(FIL_LOAD_INVALID); return(FIL_LOAD_INVALID);

7
storage/innobase/fsp/fsp0file.cc
View File

@ -58,11 +58,6 @@ Datafile::shutdown()
ut_free(m_name); ut_free(m_name);
m_name = NULL; m_name = NULL;
/* The fil_space_t::crypt_data was freed in
fil_space_free_low(). Invalidate our redundant pointer. */
m_crypt_info = NULL;
free_filepath(); free_filepath();
free_first_page(); free_first_page();
} }
@ -374,8 +369,6 @@ Datafile::read_first_page(bool read_only_mode)
return(DB_CORRUPTION); return(DB_CORRUPTION);
} }
m_crypt_info = fil_space_read_crypt_data(ps, m_first_page);
return(err); return(err);
} }

8
storage/innobase/fsp/fsp0fsp.cc
View File

@ -799,8 +799,12 @@ fsp_header_init(ulint space_id, ulint size, mtr_t* mtr)
fsp_fill_free_list(!is_system_tablespace(space_id), fsp_fill_free_list(!is_system_tablespace(space_id),
space, header, mtr); space, header, mtr);
if (space->crypt_data) { /* Write encryption metadata to page 0 if tablespace is
space->crypt_data->write_page0(space, page, mtr); encrypted or encryption is disabled by table option. */
if (space->crypt_data &&
(space->crypt_data->should_encrypt() ||
space->crypt_data->not_encrypted())) {
space->crypt_data->write_page0(space, page, mtr);
} }
} }

2
storage/innobase/fsp/fsp0space.cc
View File

@ -125,7 +125,7 @@ Tablespace::open_or_create(bool is_temp)
m_name, m_space_id, FSP_FLAGS_PAGE_SSIZE(), m_name, m_space_id, FSP_FLAGS_PAGE_SSIZE(),
is_temp is_temp
? FIL_TYPE_TEMPORARY : FIL_TYPE_TABLESPACE, ? FIL_TYPE_TEMPORARY : FIL_TYPE_TABLESPACE,
it->m_crypt_info); NULL);
} }
ut_a(fil_validate()); ut_a(fil_validate());

13
storage/innobase/fsp/fsp0sysspace.cc
View File

@ -562,8 +562,6 @@ SysTablespace::read_lsn_and_check_flags(lsn_t* flushed_lsn)
err = it->read_first_page( err = it->read_first_page(
m_ignore_read_only ? false : srv_read_only_mode); m_ignore_read_only ? false : srv_read_only_mode);
m_crypt_info = it->m_crypt_info;
if (err != DB_SUCCESS) { if (err != DB_SUCCESS) {
return(err); return(err);
} }
@ -919,19 +917,10 @@ SysTablespace::open_or_create(
/* Create the tablespace entry for the multi-file /* Create the tablespace entry for the multi-file
tablespace in the tablespace manager. */ tablespace in the tablespace manager. */
if (!m_crypt_info) {
/* Create default crypt info for system
tablespace if it does not yet exists. */
m_crypt_info = fil_space_create_crypt_data(
FIL_ENCRYPTION_DEFAULT,
FIL_DEFAULT_ENCRYPTION_KEY);
}
space = fil_space_create( space = fil_space_create(
name(), space_id(), flags(), is_temp name(), space_id(), flags(), is_temp
? FIL_TYPE_TEMPORARY : FIL_TYPE_TABLESPACE, ? FIL_TYPE_TEMPORARY : FIL_TYPE_TABLESPACE,
m_crypt_info); NULL);
} }
ut_a(fil_validate()); ut_a(fil_validate());

7
storage/innobase/handler/i_s.cc
View File

@ -8606,6 +8606,12 @@ i_s_dict_fill_tablespaces_encryption(
fil_space_crypt_get_status(space, &status); fil_space_crypt_get_status(space, &status);
/* If tablespace id does not match, we did not find
encryption information for this tablespace. */
if (!space->crypt_data || space->id != status.space) {
goto skip;
}
OK(fields[TABLESPACES_ENCRYPTION_SPACE]->store(space->id, true)); OK(fields[TABLESPACES_ENCRYPTION_SPACE]->store(space->id, true));
OK(field_store_string(fields[TABLESPACES_ENCRYPTION_NAME], OK(field_store_string(fields[TABLESPACES_ENCRYPTION_NAME],
@ -8640,6 +8646,7 @@ i_s_dict_fill_tablespaces_encryption(
OK(schema_table_store_record(thd, table_to_fill)); OK(schema_table_store_record(thd, table_to_fill));
skip:
DBUG_RETURN(0); DBUG_RETURN(0);
} }
/*******************************************************************//** /*******************************************************************//**

24
storage/innobase/include/fsp0file.h
View File

@ -66,8 +66,7 @@ public:
m_first_page_buf(), m_first_page_buf(),
m_first_page(), m_first_page(),
m_last_os_error(), m_last_os_error(),
m_file_info(), m_file_info()
m_crypt_info()
{ {
/* No op */ /* No op */
} }
@ -89,8 +88,7 @@ public:
m_first_page_buf(), m_first_page_buf(),
m_first_page(), m_first_page(),
m_last_os_error(), m_last_os_error(),
m_file_info(), m_file_info()
m_crypt_info()
{ {
ut_ad(m_name != NULL); ut_ad(m_name != NULL);
/* No op */ /* No op */
@ -110,8 +108,7 @@ public:
m_first_page_buf(), m_first_page_buf(),
m_first_page(), m_first_page(),
m_last_os_error(), m_last_os_error(),
m_file_info(), m_file_info()
m_crypt_info()
{ {
m_name = mem_strdup(file.m_name); m_name = mem_strdup(file.m_name);
ut_ad(m_name != NULL); ut_ad(m_name != NULL);
@ -169,8 +166,6 @@ public:
it should be reread if needed */ it should be reread if needed */
m_first_page_buf = NULL; m_first_page_buf = NULL;
m_first_page = NULL; m_first_page = NULL;
/* Do not copy crypt info it is read from first page */
m_crypt_info = NULL;
return(*this); return(*this);
} }
@ -321,11 +316,6 @@ public:
return(m_last_os_error); return(m_last_os_error);
} }
fil_space_crypt_t* get_crypt_info() const
{
return(m_crypt_info);
}
/** Test if the filepath provided looks the same as this filepath /** Test if the filepath provided looks the same as this filepath
by string comparison. If they are two different paths to the same by string comparison. If they are two different paths to the same
file, same_as() will be used to show that after the files are opened. file, same_as() will be used to show that after the files are opened.
@ -339,6 +329,11 @@ public:
@return true if it is the same file, else false */ @return true if it is the same file, else false */
bool same_as(const Datafile& other) const; bool same_as(const Datafile& other) const;
/** Get access to the first data page.
It is valid after open_read_only() succeeded.
@return the first data page */
const byte* get_first_page() const { return(m_first_page); }
private: private:
/** Free the filepath buffer. */ /** Free the filepath buffer. */
void free_filepath(); void free_filepath();
@ -465,9 +460,6 @@ public:
/* Use field st_ino. */ /* Use field st_ino. */
struct stat m_file_info; struct stat m_file_info;
#endif /* WIN32 */ #endif /* WIN32 */
/** Encryption information */
fil_space_crypt_t* m_crypt_info;
}; };

6
storage/innobase/include/fsp0sysspace.h
View File

@ -53,8 +53,7 @@ public:
m_last_file_size_max(), m_last_file_size_max(),
m_created_new_raw(), m_created_new_raw(),
m_is_tablespace_full(false), m_is_tablespace_full(false),
m_sanity_checks_done(false), m_sanity_checks_done(false)
m_crypt_info()
{ {
/* No op */ /* No op */
} }
@ -264,9 +263,6 @@ private:
/** if false, then sanity checks are still pending */ /** if false, then sanity checks are still pending */
bool m_sanity_checks_done; bool m_sanity_checks_done;
/** Encryption information */
fil_space_crypt_t* m_crypt_info;
}; };
/* GLOBAL OBJECTS */ /* GLOBAL OBJECTS */