mirror of
https://github.com/MariaDB/server.git
synced 2025-05-01 08:45:04 +03:00
ada1074bb1
The statement SET GLOBAL innodb_encryption_rotate_key_age=0; would have the unwanted side effect that ENCRYPTION=DEFAULT tablespaces would no longer be encrypted or decrypted according to the setting of innodb_encrypt_tables. We implement a trigger, so that whenever one of the following is executed: SET GLOBAL innodb_encrypt_tables=OFF; SET GLOBAL innodb_encrypt_tables=ON; SET GLOBAL innodb_encrypt_tables=FORCE; all wrong-state ENCRYPTION=DEFAULT tablespaces will be added to fil_system_t::rotation_list, so that the encryption will be added or removed. Note: This will *NOT* happen automatically after a server restart. Before reading the first page of a data file, InnoDB cannot know the encryption status of the data file. The statement SET GLOBAL innodb_encrypt_tables will have the side effect that all not-yet-read InnoDB data files will be accessed in order to determine the encryption status. innodb_encrypt_tables_validate(): Stop disallowing SET GLOBAL innodb_encrypt_tables when innodb_encryption_rotate_key_age=0. This reverts part of commit 50eb40a2a8aa3af6cc271f6028f4d6d74301d030 that addressed MDEV-11738 and MDEV-11581. fil_system_t::read_page0(): Trigger a call to fil_node_t::read_page0(). Refactored from fil_space_get_space(). fil_crypt_rotation_list_fill(): If innodb_encryption_rotate_key_age=0, initialize fil_system->rotation_list. This is invoked both on SET GLOBAL innodb_encrypt_tables and on SET GLOBAL innodb_encryption_rotate_key_age=0. fil_space_set_crypt_data(): Remove. fil_parse_write_crypt_data(): Simplify the logic. This is joint work with Marko Mäkelä.
83 lines
3.7 KiB
Plaintext
83 lines
3.7 KiB
Plaintext
-- source include/have_innodb.inc
|
|
-- source include/not_embedded.inc
|
|
-- source include/have_example_key_management_plugin.inc
|
|
|
|
CREATE TABLE t1 (f1 INT, f2 VARCHAR(256))engine=innodb;
|
|
INSERT INTO t1 VALUES(1, 'MariaDB'), (2, 'Robot'), (3, 'Science');
|
|
INSERT INTO t1 SELECT * FROM t1;
|
|
|
|
CREATE TABLE t2(f1 INT, f2 VARCHAR(256))engine=innodb;
|
|
INSERT INTO t2 SELECT * FROM t1;
|
|
|
|
CREATE TABLE t3(f1 INT, f2 VARCHAR(256))engine=innodb encrypted=yes;
|
|
INSERT INTO t3 SELECT * FROM t1;
|
|
|
|
--echo # Restart the server with encryption
|
|
|
|
let $restart_parameters= --innodb_encryption_threads=5 --innodb_encryption_rotate_key_age=16384;
|
|
--source include/restart_mysqld.inc
|
|
|
|
--echo # Wait until encryption threads have encrypted all tablespaces
|
|
|
|
--let $tables_count= `select count(*) + 1 from information_schema.tables where engine = 'InnoDB'`
|
|
--let $wait_timeout= 600
|
|
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
--source include/wait_condition.inc
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
|
|
--echo # Restart the server with innodb_encryption_rotate_key_age= 0
|
|
|
|
let $restart_parameters= --innodb_encryption_threads=1 --innodb_encryption_rotate_key_age=0;
|
|
|
|
--source include/restart_mysqld.inc
|
|
|
|
create table t4 (f1 int not null)engine=innodb encrypted=NO;
|
|
|
|
--echo # Wait until encryption threads have encrypted all tablespaces
|
|
|
|
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
|
|
--let $wait_timeout= 600
|
|
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
--source include/wait_condition.inc
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
|
|
--echo # Disable encryption when innodb_encryption_rotate_key_age is 0
|
|
set global innodb_encrypt_tables = OFF;
|
|
|
|
--echo # Wait until encryption threads to decrypt all unencrypted tablespaces
|
|
|
|
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
|
|
--let $wait_timeout= 600
|
|
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 AND ROTATING_OR_FLUSHING = 0;
|
|
--source include/wait_condition.inc
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
|
|
--echo # Display only encrypted create tables (t3)
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
|
|
--echo # Enable encryption when innodb_encryption_rotate_key_age is 0
|
|
set global innodb_encrypt_tables = ON;
|
|
|
|
--echo # Wait until encryption threads to encrypt all unencrypted tablespaces
|
|
|
|
--let $tables_count= `select count(*) from information_schema.tables where engine = 'InnoDB'`
|
|
--let $wait_timeout= 600
|
|
--let $wait_condition=SELECT COUNT(*) >= $tables_count FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
--source include/wait_condition.inc
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
|
|
--echo # Display only unencrypted create tables (t4)
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
|
|
--let $restart_parameters=
|
|
-- source include/restart_mysqld.inc
|
|
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0;
|
|
SELECT NAME FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0;
|
|
DROP TABLE t4, t3, t2, t1;
|