mirror of
https://github.com/MariaDB/server.git
synced 2025-11-27 05:41:41 +03:00
8c7d8b716c
Problem: ======= - InnoDB iterates the fil_system space list to encrypt the tablespace in case of key rotation. But it is not necessary for any encryption plugin which doesn't do key version rotation. Solution: ========= - Introduce a new variable called srv_encrypt_rotate to indicate whether encryption plugin does key rotation fil_space_crypt_t::key_get_latest_version(): Enable the srv_encrypt_rotate only once if current key version is higher than innodb_encyrption_rotate_key_age fil_crypt_must_default_encrypt(): Default encryption tables should be added to default_encryp_tables list if innodb_encyrption_rotate_key_age is zero and encryption plugin doesn't do key version rotation fil_space_create(): Add the newly created space to default_encrypt_tables list if fil_crypt_must_default_encrypt() returns true Removed the nondeterministic select from innodb-key-rotation-disable test. By default, InnoDB adds the tablespace to the rotation list and background crypt thread does encryption of tablespace. So these select doesn't give reliable results.
55 lines
2.5 KiB
Plaintext
55 lines
2.5 KiB
Plaintext
create database enctests;
|
|
use enctests;
|
|
create table t1(a int not null primary key, b char(200)) engine=innodb;
|
|
create table t2(a int not null primary key, b char(200)) engine=innodb row_format=compressed;
|
|
create table t3(a int not null primary key, b char(200)) engine=innodb page_compressed=yes;
|
|
create table t4(a int not null primary key, b char(200)) engine=innodb encrypted=yes;
|
|
create table t5(a int not null primary key, b char(200)) engine=innodb encrypted=yes row_format=compressed;
|
|
create table t6(a int not null primary key, b char(200)) engine=innodb encrypted=yes page_compressed=yes;
|
|
create table t7(a int not null primary key, b char(200)) engine=innodb encrypted=no;
|
|
create table t8(a int not null primary key, b char(200)) engine=innodb encrypted=no row_format=compressed;
|
|
create table t9(a int not null primary key, b char(200)) engine=innodb encrypted=no page_compressed=yes;
|
|
insert into t1 values (1, 'secredmessage');
|
|
insert into t2 values (1, 'secredmessage');
|
|
insert into t3 values (1, 'secredmessagecompressedaaaaaaaaabbbbbbbbbbbbbbccccccccccccccc');
|
|
insert into t4 values (1, 'secredmessage');
|
|
insert into t5 values (1, 'secredmessage');
|
|
insert into t6 values (1, 'secredmessagecompressedaaaaaaaaabbbbbbbbbbbbbbccccccccccccccc');
|
|
insert into t7 values (1, 'publicmessage');
|
|
insert into t8 values (1, 'publicmessage');
|
|
insert into t9 values (1, 'pugliccompressedaaaaaaaaabbbbbbbbbbbbbbccccccccccccccc');
|
|
# should list tables t1-t6
|
|
SELECT NAME,ENCRYPTION_SCHEME,CURRENT_KEY_ID FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION <> 0 AND NAME LIKE 'enctests%';
|
|
NAME ENCRYPTION_SCHEME CURRENT_KEY_ID
|
|
enctests/t1 1 1
|
|
enctests/t2 1 1
|
|
enctests/t3 1 1
|
|
enctests/t4 1 1
|
|
enctests/t5 1 1
|
|
enctests/t6 1 1
|
|
# should list tables t7-t9
|
|
SELECT NAME,ENCRYPTION_SCHEME,CURRENT_KEY_ID FROM INFORMATION_SCHEMA.INNODB_TABLESPACES_ENCRYPTION WHERE MIN_KEY_VERSION = 0 and NAME LIKE 'enctests%';
|
|
NAME ENCRYPTION_SCHEME CURRENT_KEY_ID
|
|
enctests/t7 0 1
|
|
enctests/t8 0 1
|
|
enctests/t9 0 1
|
|
# t1 default on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t1.ibd
|
|
# t2 default on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t2.ibd
|
|
# t3 default on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t3.ibd
|
|
# t4 on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t4.ibd
|
|
# t5 on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t5.ibd
|
|
# t6 on expecting NOT FOUND
|
|
NOT FOUND /secred/ in t6.ibd
|
|
# t7 off expecting FOUND
|
|
FOUND 1 /public/ in t7.ibd
|
|
# t8 row compressed expecting NOT FOUND
|
|
FOUND 1 /public/ in t8.ibd
|
|
# t9 page compressed expecting NOT FOUND
|
|
NOT FOUND /public/ in t9.ibd
|
|
drop database enctests;
|