mirror of
https://github.com/MariaDB/server.git
synced 2025-08-14 08:03:06 +03:00
e39d6e0c53
The problem with the InnoDB table attribute encryption_key_id is that it is not being persisted anywhere in InnoDB except if the table attribute encryption is specified and is something else than encryption=default. MDEV-17320 made it a hard error if encryption_key_id is specified to be anything else than 1 in that case. Ideally, we would always persist encryption_key_id in InnoDB. But, then we would have to be prepared for the case that when encryption is being enabled for a table whose encryption_key_id attribute refers to a non-existing key. In MariaDB Server 10.1, our best option remains to not store anything inside InnoDB. But, instead of returning the error that MDEV-17320 introduced, we should merely issue a warning that the specified encryption_key_id is going to be ignored if encryption=default. To improve the situation a little more, we will issue a warning if SET [GLOBAL|SESSION] innodb_default_encryption_key_id is being set to something that does not refer to an available encryption key. Starting with MariaDB Server 10.2, thanks to MDEV-5800, we could open the table definition from InnoDB side when the encryption is being enabled, and actually fix the root cause of what was reported in MDEV-17320.
125 lines
3.7 KiB
Plaintext
125 lines
3.7 KiB
Plaintext
-- source include/have_innodb.inc
|
|
-- source include/have_file_key_management_plugin.inc
|
|
|
|
#
|
|
# MDEV-8817: Failing assertion: new_state->key_version != ENCRYPTION_KEY_VERSION_INVALID
|
|
#
|
|
|
|
--disable_query_log
|
|
let $innodb_file_format_orig = `SELECT @@innodb_file_format`;
|
|
let $innodb_file_per_table_orig = `SELECT @@innodb_file_per_table`;
|
|
let $encrypt_tables = `SELECT @@innodb_encrypt_tables`;
|
|
let $threads = `SELECT @@innodb_encryption_threads`;
|
|
--enable_query_log
|
|
|
|
SET GLOBAL innodb_file_format = `Barracuda`;
|
|
SET GLOBAL innodb_file_per_table = ON;
|
|
SET GLOBAL innodb_encrypt_tables = ON;
|
|
SET GLOBAL innodb_encryption_threads = 4;
|
|
|
|
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=4;
|
|
DROP TABLE t1;
|
|
set @save_global = @@GLOBAL.innodb_default_encryption_key_id;
|
|
set innodb_default_encryption_key_id = 99;
|
|
set global innodb_default_encryption_key_id = 99;
|
|
set global innodb_default_encryption_key_id = @save_global;
|
|
--error 1005
|
|
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
|
|
SHOW WARNINGS;
|
|
--error 1005
|
|
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
|
|
SHOW WARNINGS;
|
|
set innodb_default_encryption_key_id = 4;
|
|
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=YES;
|
|
SHOW CREATE TABLE t1;
|
|
DROP TABLE t1;
|
|
CREATE TABLE t1 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB;
|
|
SHOW CREATE TABLE t1;
|
|
CREATE TABLE t2 (pk INT PRIMARY KEY AUTO_INCREMENT, c VARCHAR(256)) ENGINE=INNODB ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
|
|
--error ER_ILLEGAL_HA_CREATE_OPTION
|
|
ALTER TABLE t1 ENCRYPTION_KEY_ID=99;
|
|
SHOW WARNINGS;
|
|
set innodb_default_encryption_key_id = 1;
|
|
|
|
|
|
--disable_warnings
|
|
--disable_query_log
|
|
let $i = 400;
|
|
while ($i)
|
|
{
|
|
INSERT INTO t1 values(NULL, substring(MD5(RAND()), -128));
|
|
dec $i;
|
|
}
|
|
commit;
|
|
INSERT INTO t2 select * from t1;
|
|
|
|
--disable_abort_on_error
|
|
|
|
--connect (con1,localhost,root,,test)
|
|
--connect (con2,localhost,root,,test)
|
|
|
|
let $i = 50;
|
|
while ($i)
|
|
{
|
|
connection con1;
|
|
send ALTER TABLE t1 ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
|
|
connection con2;
|
|
send ALTER TABLE t1 ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
|
|
connection default;
|
|
send ALTER TABLE t2 ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
|
|
connection con1;
|
|
--reap;
|
|
ALTER TABLE t1 ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
|
|
connection con2;
|
|
--reap
|
|
ALTER TABLE t1 ENCRYPTED=YES ENCRYPTION_KEY_ID=4;
|
|
connection default;
|
|
--reap
|
|
ALTER TABLE t2 ENCRYPTED=YES ENCRYPTION_KEY_ID=1;
|
|
ALTER TABLE t1 ENCRYPTED=NO ENCRYPTION_KEY_ID=1;
|
|
dec $i;
|
|
}
|
|
|
|
connection default;
|
|
--disconnect con1
|
|
--disconnect con2
|
|
|
|
--enable_abort_on_error
|
|
--enable_warnings
|
|
--enable_query_log
|
|
|
|
drop table t1,t2;
|
|
|
|
#
|
|
# MDEV-17230: encryption_key_id from alter is ignored by encryption threads
|
|
#
|
|
--enable_warnings
|
|
SET GLOBAL innodb_encrypt_tables=OFF;
|
|
CREATE TABLE t1 (a int not null primary key) engine=innodb;
|
|
ALTER TABLE t1 ENCRYPTION_KEY_ID=4;
|
|
SHOW CREATE TABLE t1;
|
|
DROP TABLE t1;
|
|
|
|
CREATE TABLE t2 (a int not null primary key) engine=innodb;
|
|
--replace_regex /#sql-[0-9a-f_]*`/#sql-temporary`/
|
|
ALTER TABLE t2 ENCRYPTION_KEY_ID=4, ALGORITHM=COPY;
|
|
--replace_regex /#sql-[0-9a-f_]*`/#sql-temporary`/
|
|
SHOW CREATE TABLE t2;
|
|
DROP TABLE t2;
|
|
|
|
CREATE TABLE t3 (a int not null primary key) engine=innodb ENCRYPTION_KEY_ID=4;
|
|
DROP TABLE t3;
|
|
|
|
SET GLOBAL innodb_encrypt_tables='FORCE';
|
|
--error ER_CANT_CREATE_TABLE
|
|
CREATE TABLE t1 (a int primary key) engine=innodb encrypted=no;
|
|
SHOW WARNINGS;
|
|
|
|
# reset system
|
|
--disable_query_log
|
|
EVAL SET GLOBAL innodb_file_per_table = $innodb_file_per_table_orig;
|
|
EVAL SET GLOBAL innodb_file_format = $innodb_file_format_orig;
|
|
EVAL SET GLOBAL innodb_encrypt_tables = $encrypt_tables;
|
|
EVAL SET GLOBAL innodb_encryption_threads = $threads;
|
|
--enable_query_log
|