-
Notifications
You must be signed in to change notification settings - Fork 484
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bug#22740362 ENCRYPTED INNODB DATA FILES ARE NOT PORTABLE BETWEEN 32-…
…BIT AND 64-BIT Problem: Encrypted files are not portable across 32bit and 64bit platforms. ie. encrypted tablespace files created by 32bit mysqld are not readable by 64bit mysqld and encrypted tablespace files created by 64bit mysqld are not readable by 32bit mysqld The reason is, when writing encryption header in page 0, after writing 4-byte master key, we moved by sizeof(ulint) bytes to write the next header member. sizeof(ulint) is 4bytes on 32bit machines and 8bytes on 64bit machines. In V2, UUID and rest of header is at different position for 32bit vs 64bit In V1, tablespace key and rest of header is at different position for 32bit vs 64bit So, the header can be decoded properly and the tablespaces cannot be read. Fix: For versions v1 & v2, after reading the 4-byte master key, we check if next 4-bytes are all 0x00. If it is, then it is created by 64bit server, then we can move to the position after these bytes to read next field. Introduce v3, which doesn't use ulint at all. There are no guesses in parsing in v3. Any rewrite of encryption header (like rotation etc), writes always in v3. (even if the header is in v1 or v2). Misc code cleanup (remove unused paramters, variables etc) Reviewed-By: Ingo Struewing [email protected] Satya Bodapati [email protected] RB:17312
- Loading branch information
Allen Lai
committed
Dec 25, 2017
1 parent
6cf1ccf
commit f565013
Showing
21 changed files
with
464 additions
and
165 deletions.
There are no files selected for viewing
Binary file not shown.
Binary file not shown.
46 changes: 46 additions & 0 deletions
46
mysql-test/suite/innodb/r/table_encrypt_portable_32.result
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| ALTER TABLE test.t1 DISCARD TABLESPACE; | ||
| ALTER TABLE test.t1 IMPORT TABLESPACE; | ||
| SELECT * FROM t1; | ||
| c1 c2 | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| DROP TABLE t1; |
46 changes: 46 additions & 0 deletions
46
mysql-test/suite/innodb/r/table_encrypt_portable_64.result
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| ALTER TABLE test.t1 DISCARD TABLESPACE; | ||
| ALTER TABLE test.t1 IMPORT TABLESPACE; | ||
| SELECT * FROM t1; | ||
| c1 c2 | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| 0 aaaaa | ||
| 1 bbbbb | ||
| 2 ccccc | ||
| 3 ddddd | ||
| 4 eeeee | ||
| 5 fffff | ||
| 6 ggggg | ||
| 7 hhhhh | ||
| 8 iiiii | ||
| 9 jjjjj | ||
| DROP TABLE t1; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| # InnoDB transparent tablespace data encryption | ||
| # This test case will test portability of encrypted table support feature. | ||
| # This test try to port an encrypted table which created by 64bits server to 32bits server. | ||
| # The data files of source table is in mysql-test/std_data/table_encrypted_64.zip. | ||
| # For update the table_encrypted_64.zip, you have to run the test case table_encrypt_portable_64 in | ||
| # record mode. | ||
|
|
||
| --source include/have_innodb_max_16k.inc | ||
| --source include/have_debug.inc | ||
| --source include/have_32bit.inc | ||
| --source include/not_windows.inc | ||
|
|
||
| ######################### | ||
| # how to record test result for 64bit test case table_encrypt_portable_64 content mismatch | ||
| # 1) change the record value from 0 to 1. it should be "--let $RECORD=1" | ||
| # 2) run the test, it will fail (this is expected). The zip files are updated | ||
| # 3) change the line to "--let $RECORD=0" and run test | ||
| ######################### | ||
| --let $RECORD=0 | ||
|
|
||
| let $restart_parameters = restart: --early-plugin-load="keyring_file=$KEYRING_PLUGIN" --loose-keyring_file_data=$MYSQL_TMP_DIR/mysecret_keyring $KEYRING_PLUGIN_OPT; | ||
| --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR $KEYRING_PLUGIN_OPT --plugin-dir=KEYRING_PLUGIN_PATH $KEYRING_PLUGIN keyring_file.so | ||
| --replace_regex /\.dll/.so/ | ||
| --source include/restart_mysqld_no_echo.inc | ||
|
|
||
| let $MYSQLD_DATADIR = `SELECT @@datadir`; | ||
|
|
||
| let $source_db = test; | ||
|
|
||
| let $dest_db = test; | ||
|
|
||
| if ($RECORD == 1) { | ||
| # Create a table with encryption | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| INSERT INTO t1 VALUES(0, "aaaaa"); | ||
| INSERT INTO t1 VALUES(1, "bbbbb"); | ||
| INSERT INTO t1 VALUES(2, "ccccc"); | ||
| INSERT INTO t1 VALUES(3, "ddddd"); | ||
| INSERT INTO t1 VALUES(4, "eeeee"); | ||
| INSERT INTO t1 VALUES(5, "fffff"); | ||
| INSERT INTO t1 VALUES(6, "ggggg"); | ||
| INSERT INTO t1 VALUES(7, "hhhhh"); | ||
| INSERT INTO t1 VALUES(8, "iiiii"); | ||
| INSERT INTO t1 VALUES(9, "jjjjj"); | ||
| INSERT INTO t1 select * from t1; | ||
| INSERT INTO t1 select * from t1; | ||
|
|
||
| eval FLUSH TABLES $source_db.t1 FOR EXPORT; | ||
|
|
||
| --exec zip -j $MYSQL_TMP_DIR/table_encrypted.zip $MYSQLD_DATADIR/$source_db/t1.* 2>&1 > /dev/null | ||
| --move_file $MYSQL_TMP_DIR/table_encrypted.zip $MYSQL_TEST_DIR/std_data/table_encrypted_32.zip | ||
|
|
||
| UNLOCK TABLES; | ||
|
|
||
| DROP TABLE t1; | ||
| } | ||
|
|
||
| if ($RECORD == 0) { | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| eval ALTER TABLE $dest_db.t1 DISCARD TABLESPACE; | ||
|
|
||
| --exec unzip -qo $MYSQL_TEST_DIR/std_data/table_encrypted_64.zip -d $MYSQLD_DATADIR/$dest_db | ||
|
|
||
| eval ALTER TABLE $dest_db.t1 IMPORT TABLESPACE; | ||
|
|
||
| SELECT * FROM t1; | ||
|
|
||
| # Cleanup | ||
| DROP TABLE t1; | ||
|
|
||
| --remove_file $MYSQL_TMP_DIR/mysecret_keyring | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| # InnoDB transparent tablespace data encryption | ||
| # This test case will test portability of encrypted table support features. | ||
| # This test try to port an encrypted table which created by 32bits server to 64bits server. | ||
| # The data files of source table is in mysql-test/std_data/table_encrypted_32.zip. | ||
| # For update the table_encrypted_32.zip, you have to run the test case table_encrypt_portable_32 in | ||
| # record mode. | ||
|
|
||
| --source include/have_innodb_max_16k.inc | ||
| --source include/have_debug.inc | ||
| --source include/have_64bit.inc | ||
| --source include/not_windows.inc | ||
|
|
||
| ######################### | ||
| # how to record test result for 32bit test case table_encrypt_portable_32 content mismatch | ||
| # 1) change the record value from 0 to 1. it should be "--let $RECORD=1" | ||
| # 2) run the test, it will fail (this is expected). The zip files are updated | ||
| # 3) change the line to "--let $RECORD=0" and run test | ||
| ######################### | ||
| --let $RECORD=0 | ||
|
|
||
| let $restart_parameters = restart: --early-plugin-load="keyring_file=$KEYRING_PLUGIN" --loose-keyring_file_data=$MYSQL_TMP_DIR/mysecret_keyring $KEYRING_PLUGIN_OPT; | ||
| --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR $KEYRING_PLUGIN_OPT --plugin-dir=KEYRING_PLUGIN_PATH $KEYRING_PLUGIN keyring_file.so | ||
| --replace_regex /\.dll/.so/ | ||
| --source include/restart_mysqld_no_echo.inc | ||
|
|
||
| let $MYSQLD_DATADIR = `SELECT @@datadir`; | ||
|
|
||
| let $source_db = test; | ||
|
|
||
| let $dest_db = test; | ||
|
|
||
| if ($RECORD == 1) { | ||
| # Create a table with encryption | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| INSERT INTO t1 VALUES(0, "aaaaa"); | ||
| INSERT INTO t1 VALUES(1, "bbbbb"); | ||
| INSERT INTO t1 VALUES(2, "ccccc"); | ||
| INSERT INTO t1 VALUES(3, "ddddd"); | ||
| INSERT INTO t1 VALUES(4, "eeeee"); | ||
| INSERT INTO t1 VALUES(5, "fffff"); | ||
| INSERT INTO t1 VALUES(6, "ggggg"); | ||
| INSERT INTO t1 VALUES(7, "hhhhh"); | ||
| INSERT INTO t1 VALUES(8, "iiiii"); | ||
| INSERT INTO t1 VALUES(9, "jjjjj"); | ||
| INSERT INTO t1 select * from t1; | ||
| INSERT INTO t1 select * from t1; | ||
|
|
||
| eval FLUSH TABLES $source_db.t1 FOR EXPORT; | ||
|
|
||
| --exec zip -j $MYSQL_TMP_DIR/table_encrypted.zip $MYSQLD_DATADIR/$source_db/t1.* 2>&1 > /dev/null | ||
| --move_file $MYSQL_TMP_DIR/table_encrypted.zip $MYSQL_TEST_DIR/std_data/table_encrypted_64.zip | ||
|
|
||
| UNLOCK TABLES; | ||
|
|
||
| DROP TABLE t1; | ||
| } | ||
|
|
||
| if ($RECORD == 0) { | ||
| CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB; | ||
| eval ALTER TABLE $dest_db.t1 DISCARD TABLESPACE; | ||
|
|
||
| --exec unzip -qo $MYSQL_TEST_DIR/std_data/table_encrypted_32.zip -d $MYSQLD_DATADIR/$dest_db | ||
|
|
||
| eval ALTER TABLE $dest_db.t1 IMPORT TABLESPACE; | ||
|
|
||
| SELECT * FROM t1; | ||
|
|
||
| # Cleanup | ||
| DROP TABLE t1; | ||
|
|
||
| --remove_file $MYSQL_TMP_DIR/mysecret_keyring | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.