server icon indicating copy to clipboard operation
server copied to clipboard

MDEV-34372 Temporary tablespace decryption fails with ER_NOT_KEYFILE

Open Thirunarayanan opened this issue 1 year ago • 1 comments
trafficstars

  • [x] The Jira issue number for this PR is: MDEV-34372

Description

Reason:

Temporary tablespace uses the innodb redo encryption key and key version(v1) to encrypt the temporary tablespace/files. When encryption key rotation happens, InnoDB assigns the new redo encryption key version(v2) during checkpoint. After this, InnoDB encrypts the temporary tablespace pages using key version (v2). This lead to failure of decrypting the temporary tablespace pages which was encrypted using key version (v1).

Fix:

Store the temporary file/tablespace key and key version seperately during redo log initialization. Even though InnoDB does key rotation, it doesn't affect temporary file key and key version.

log_crypt_init(): Assign the temporary file/tablespace key and key version

i_s_dict_fill_temp_tablespaces_encryption(): Adds the temporary tablespace information if innodb_encrypt_temporary_tables is enabled

How can this PR be tested?

./mtr encryption.redo_key_rotation --mem

Basing the PR against the correct MariaDB version

  • [ ] This is a new feature or a refactoring, and the PR is based against the latest MariaDB development branch.
  • [x] This is a bug fix, and the PR is based against the earliest maintained branch in which the bug can be reproduced.

PR quality check

  • [x] I checked the CODING_STANDARDS.md file and my PR conforms to this where appropriate.
  • [x] For any trivial modifications to the PR, I am ok with the reviewer making the changes themselves.

Thirunarayanan avatar Aug 12 '24 17:08 Thirunarayanan

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

CLAassistant avatar Aug 12 '24 17:08 CLAassistant