Skip to content

Commit 97d5de4

Browse files
vuvovavuvova
committed
Add encryption key id to the API as a distinct concept
which is separate from the encryption key version
1 parent 5dffda3 commit 97d5de4

27 files changed

+196
-143
lines changed

‎include/mysql/plugin_audit.h.pp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,13 @@
202202
unsigned char* dst, unsigned int* dlen,
203203
const unsigned char* key, unsigned int klen,
204204
const unsigned char* iv, unsigned int ivlen,
205-
int no_padding, unsigned int key_version);
205+
int no_padding, unsigned int key_id,
206+
unsigned int key_version);
206207
struct encryption_service_st {
207-
unsigned int (*encryption_key_get_latest_version_func)();
208-
unsigned int (*encryption_key_exists_func)(unsigned int);
209-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
208+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
209+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
210+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
211+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
210212
encrypt_decrypt_func encryption_encrypt_func;
211213
encrypt_decrypt_func encryption_decrypt_func;
212214
};

‎include/mysql/plugin_auth.h.pp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,13 @@
202202
unsigned char* dst, unsigned int* dlen,
203203
const unsigned char* key, unsigned int klen,
204204
const unsigned char* iv, unsigned int ivlen,
205-
int no_padding, unsigned int key_version);
205+
int no_padding, unsigned int key_id,
206+
unsigned int key_version);
206207
struct encryption_service_st {
207-
unsigned int (*encryption_key_get_latest_version_func)();
208-
unsigned int (*encryption_key_exists_func)(unsigned int);
209-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
208+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
209+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
210+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
211+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
210212
encrypt_decrypt_func encryption_encrypt_func;
211213
encrypt_decrypt_func encryption_decrypt_func;
212214
};

‎include/mysql/plugin_encryption.h‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ struct st_mariadb_encryption
3737
int interface_version; /**< version plugin uses */
3838

3939
/**
40-
function returning latest key version.
40+
function returning latest key version for a given key id
4141
42-
@return a version or BAD_ENCRYPTION_KEY_VERSION to indicate an error.
42+
@return a version or ENCRYPTION_KEY_VERSION_INVALID to indicate an error.
4343
*/
44-
unsigned int (*get_latest_key_version)();
44+
unsigned int (*get_latest_key_version)(unsigned int key_id);
4545

4646
/**
4747
function returning a key for a key version
@@ -60,11 +60,11 @@ struct st_mariadb_encryption
6060
the key data or leave it untouched).
6161
6262
@return 0 on success, or
63-
BAD_ENCRYPTION_KEY_VERSION, KEY_BUFFER_TOO_SMALL,
63+
ENCRYPTION_KEY_VERSION_INVALID, ENCRYPTION_KEY_BUFFER_TOO_SMALL
6464
or any other non-zero number for errors
6565
*/
66-
unsigned int (*get_key)(unsigned int version, unsigned char *key,
67-
unsigned int *key_length);
66+
unsigned int (*get_key)(unsigned int key_id, unsigned int version,
67+
unsigned char *key, unsigned int *key_length);
6868

6969
encrypt_decrypt_func encrypt;
7070
encrypt_decrypt_func decrypt;

‎include/mysql/plugin_encryption.h.pp‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,13 @@
202202
unsigned char* dst, unsigned int* dlen,
203203
const unsigned char* key, unsigned int klen,
204204
const unsigned char* iv, unsigned int ivlen,
205-
int no_padding, unsigned int key_version);
205+
int no_padding, unsigned int key_id,
206+
unsigned int key_version);
206207
struct encryption_service_st {
207-
unsigned int (*encryption_key_get_latest_version_func)();
208-
unsigned int (*encryption_key_exists_func)(unsigned int);
209-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
208+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
209+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
210+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
211+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
210212
encrypt_decrypt_func encryption_encrypt_func;
211213
encrypt_decrypt_func encryption_decrypt_func;
212214
};
@@ -370,9 +372,9 @@
370372
struct st_mariadb_encryption
371373
{
372374
int interface_version;
373-
unsigned int (*get_latest_key_version)();
374-
unsigned int (*get_key)(unsigned int version, unsigned char *key,
375-
unsigned int *key_length);
375+
unsigned int (*get_latest_key_version)(unsigned int key_id);
376+
unsigned int (*get_key)(unsigned int key_id, unsigned int version,
377+
unsigned char *key, unsigned int *key_length);
376378
encrypt_decrypt_func encrypt;
377379
encrypt_decrypt_func decrypt;
378380
};

‎include/mysql/plugin_ftparser.h.pp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,13 @@
202202
unsigned char* dst, unsigned int* dlen,
203203
const unsigned char* key, unsigned int klen,
204204
const unsigned char* iv, unsigned int ivlen,
205-
int no_padding, unsigned int key_version);
205+
int no_padding, unsigned int key_id,
206+
unsigned int key_version);
206207
struct encryption_service_st {
207-
unsigned int (*encryption_key_get_latest_version_func)();
208-
unsigned int (*encryption_key_exists_func)(unsigned int);
209-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
208+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
209+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
210+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
211+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
210212
encrypt_decrypt_func encryption_encrypt_func;
211213
encrypt_decrypt_func encryption_decrypt_func;
212214
};

‎include/mysql/plugin_password_validation.h.pp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,13 @@
202202
unsigned char* dst, unsigned int* dlen,
203203
const unsigned char* key, unsigned int klen,
204204
const unsigned char* iv, unsigned int ivlen,
205-
int no_padding, unsigned int key_version);
205+
int no_padding, unsigned int key_id,
206+
unsigned int key_version);
206207
struct encryption_service_st {
207-
unsigned int (*encryption_key_get_latest_version_func)();
208-
unsigned int (*encryption_key_exists_func)(unsigned int);
209-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
208+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
209+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
210+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
211+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
210212
encrypt_decrypt_func encryption_encrypt_func;
211213
encrypt_decrypt_func encryption_decrypt_func;
212214
};

‎include/mysql/service_encryption.h‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ extern "C" {
3030

3131
/* returned from encryption_key_get_latest_version() */
3232
#define ENCRYPTION_KEY_VERSION_INVALID (~(unsigned int)0)
33-
#define ENCRYPTION_KEY_VERSION_NOT_ENCRYPTED (0)
33+
#define ENCRYPTION_KEY_NOT_ENCRYPTED (0)
3434

3535
/* returned from encryption_key_get() */
3636
#define ENCRYPTION_KEY_BUFFER_TOO_SMALL (100)
@@ -39,12 +39,14 @@ typedef int (*encrypt_decrypt_func)(const unsigned char* src, unsigned int slen,
3939
unsigned char* dst, unsigned int* dlen,
4040
const unsigned char* key, unsigned int klen,
4141
const unsigned char* iv, unsigned int ivlen,
42-
int no_padding, unsigned int key_version);
42+
int no_padding, unsigned int key_id,
43+
unsigned int key_version);
4344

4445
struct encryption_service_st {
45-
unsigned int (*encryption_key_get_latest_version_func)();
46-
unsigned int (*encryption_key_exists_func)(unsigned int);
47-
unsigned int (*encryption_key_get_func)(unsigned int, unsigned char*, unsigned int*);
46+
unsigned int (*encryption_key_get_latest_version_func)(unsigned int);
47+
unsigned int (*encryption_key_id_exists_func)(unsigned int);
48+
unsigned int (*encryption_key_version_exists_func)(unsigned int, unsigned int);
49+
unsigned int (*encryption_key_get_func)(unsigned int, unsigned int, unsigned char*, unsigned int*);
4850
encrypt_decrypt_func encryption_encrypt_func;
4951
encrypt_decrypt_func encryption_decrypt_func;
5052
};
@@ -53,20 +55,22 @@ struct encryption_service_st {
5355

5456
extern struct encryption_service_st *encryption_service;
5557

56-
#define encryption_key_get_latest_version() encryption_service->encryption_key_get_latest_version_func()
57-
#define encryption_key_exists(V) encryption_service->encryption_key_exists_func(V)
58-
#define encryption_key_get(V,K,S) encryption_service->encryption_key_get_func((V), (K), (S))
59-
#define encryption_encrypt(S,SL,D,DL,K,KL,I,IL,NP,KV) encryption_service->encryption_encrypt_func(S,SL,D,DL,K,KL,I,IL,NP,KV)
60-
#define encryption_decrypt(S,SL,D,DL,K,KL,I,IL,NP,KV) encryption_service->encryption_decrypt_func(S,SL,D,DL,K,KL,I,IL,NP,KV)
58+
#define encryption_key_get_latest_version(KI) encryption_service->encryption_key_get_latest_version_func(KI)
59+
#define encryption_key_id_exists(KI) encryption_service->encryption_key_id_exists_func((KI))
60+
#define encryption_key_version_exists(KI,KV) encryption_service->encryption_key_version_exists_func((KI),(KV))
61+
#define encryption_key_get(KI,KV,K,S) encryption_service->encryption_key_get_func((KI),(KV),(K),(S))
62+
#define encryption_encrypt(S,SL,D,DL,K,KL,I,IL,NP,KI,KV) encryption_service->encryption_encrypt_func((S),(SL),(D),(DL),(K),(KL),(I),(IL),(NP),(KI),(KV))
63+
#define encryption_decrypt(S,SL,D,DL,K,KL,I,IL,NP,KI,KV) encryption_service->encryption_decrypt_func((S),(SL),(D),(DL),(K),(KL),(I),(IL),(NP),(KI),(KV))
6164
#else
6265

6366
extern struct encryption_service_st encryption_handler;
6467

65-
#define encryption_key_get_latest_version() encryption_handler.encryption_key_get_latest_version_func()
66-
#define encryption_key_exists(V) encryption_handler.encryption_key_exists_func(V)
67-
#define encryption_key_get(V,K,S) encryption_handler.encryption_key_get_func((V), (K), (S))
68-
#define encryption_encrypt(S,SL,D,DL,K,KL,I,IL,NP,KV) encryption_handler.encryption_encrypt_func(S,SL,D,DL,K,KL,I,IL,NP,KV)
69-
#define encryption_decrypt(S,SL,D,DL,K,KL,I,IL,NP,KV) encryption_handler.encryption_decrypt_func(S,SL,D,DL,K,KL,I,IL,NP,KV)
68+
#define encryption_key_get_latest_version(KI) encryption_handler.encryption_key_get_latest_version_func(KI)
69+
#define encryption_key_id_exists(KI) encryption_handler.encryption_key_id_exists_func((KI))
70+
#define encryption_key_version_exists(KI,KV) encryption_handler.encryption_key_version_exists_func((KI),(KV))
71+
#define encryption_key_get(KI,KV,K,S) encryption_handler.encryption_key_get_func((KI),(KV),(K),(S))
72+
#define encryption_encrypt(S,SL,D,DL,K,KL,I,IL,NP,KI,KV) encryption_handler.encryption_encrypt_func((S),(SL),(D),(DL),(K),(KL),(I),(IL),(NP),(KI),(KV))
73+
#define encryption_decrypt(S,SL,D,DL,K,KL,I,IL,NP,KI,KV) encryption_handler.encryption_decrypt_func((S),(SL),(D),(DL),(K),(KL),(I),(IL),(NP),(KI),(KV))
7074
#endif
7175

7276
#ifdef __cplusplus

‎plugin/debug_key_management/debug_key_management_plugin.cc‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
It's used to debug the encryption code with a fixed keys that change
2020
only on user request.
2121
22+
It does not support different key ids, the only valid key id is 1.
23+
2224
THIS IS AN EXAMPLE ONLY! ENCRYPTION KEYS ARE HARD-CODED AND *NOT* SECRET!
2325
DO NOT USE THIS PLUGIN IN PRODUCTION! EVER!
2426
*/
@@ -40,13 +42,20 @@ static struct st_mysql_sys_var* sysvars[] = {
4042
NULL
4143
};
4244

43-
static unsigned int get_latest_key_version()
45+
static unsigned int get_latest_key_version(unsigned int keyid)
4446
{
47+
if (keyid != 1)
48+
return ENCRYPTION_KEY_VERSION_INVALID;
49+
4550
return key_version;
4651
}
4752

48-
static unsigned int get_key(unsigned int version, unsigned char* dstbuf, unsigned *buflen)
53+
static unsigned int get_key(unsigned int keyid, unsigned int version,
54+
unsigned char* dstbuf, unsigned *buflen)
4955
{
56+
if (keyid != 1)
57+
return ENCRYPTION_KEY_VERSION_INVALID;
58+
5059
if (*buflen < KEY_SIZE)
5160
{
5261
*buflen= KEY_SIZE;

‎plugin/example_key_management/example_key_management_plugin.cc‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@
2121
different pages in the same tablespace encrypted with different keys
2222
and what the background re-encryption thread does.
2323
24+
It does not support different key ids, for all ids the key will be the same.
25+
2426
THIS IS AN EXAMPLE ONLY! ENCRYPTION KEYS ARE HARD-CODED AND *NOT* SECRET!
2527
DO NOT USE THIS PLUGIN IN PRODUCTION! EVER!
2628
*/
@@ -41,7 +43,7 @@ static unsigned int next_key_version = 0;
4143
static pthread_mutex_t mutex;
4244

4345
static unsigned int
44-
get_latest_key_version()
46+
get_latest_key_version(unsigned int key_id)
4547
{
4648
uint now = time(0);
4749
pthread_mutex_lock(&mutex);
@@ -57,7 +59,8 @@ get_latest_key_version()
5759
}
5860

5961
static unsigned int
60-
get_key(unsigned int version, unsigned char* dstbuf, unsigned *buflen)
62+
get_key(unsigned int key_id, unsigned int version,
63+
unsigned char* dstbuf, unsigned *buflen)
6164
{
6265
if (*buflen < MY_MD5_HASH_SIZE)
6366
{
@@ -81,7 +84,7 @@ int encrypt(const unsigned char* src, unsigned int slen,
8184
unsigned char* dst, unsigned int* dlen,
8285
const unsigned char* key, unsigned int klen,
8386
const unsigned char* iv, unsigned int ivlen,
84-
int no_padding, unsigned int key_version)
87+
int no_padding, unsigned int keyid, unsigned int key_version)
8588
{
8689
return ((key_version & 1) ? my_aes_encrypt_cbc : my_aes_encrypt_ecb)
8790
(src, slen, dst, dlen, key, klen, iv, ivlen, no_padding);
@@ -91,7 +94,7 @@ int decrypt(const unsigned char* src, unsigned int slen,
9194
unsigned char* dst, unsigned int* dlen,
9295
const unsigned char* key, unsigned int klen,
9396
const unsigned char* iv, unsigned int ivlen,
94-
int no_padding, unsigned int key_version)
97+
int no_padding, unsigned int keyid, unsigned int key_version)
9598
{
9699
return ((key_version & 1) ? my_aes_decrypt_cbc : my_aes_decrypt_ecb)
97100
(src, slen, dst, dlen, key, klen, iv, ivlen, no_padding);
@@ -101,7 +104,7 @@ static int example_key_management_plugin_init(void *p)
101104
{
102105
/* init */
103106
my_rnd_init(&seed, time(0), 0);
104-
get_latest_key_version();
107+
get_latest_key_version(1);
105108
pthread_mutex_init(&mutex, NULL);
106109

107110
return 0;

‎plugin/file_key_management/file_key_management_plugin.cc‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -78,20 +78,18 @@ static keyentry *get_key(unsigned int key_id)
7878
return a->id == key_id ? a : 0;
7979
}
8080

81-
/**
82-
This method is using with the id 0 if exists.
83-
This method is used by innobase/xtradb for the key
84-
rotation feature of encrypting log files.
85-
*/
86-
87-
static unsigned int get_highest_key_used_in_key_file()
81+
/* the version is always the same, no automatic key rotation */
82+
static unsigned int get_latest_version(uint key_id)
8883
{
89-
return 0;
84+
return get_key(key_id) ? 1 : ENCRYPTION_KEY_VERSION_INVALID;
9085
}
9186

9287
static unsigned int get_key_from_key_file(unsigned int key_id,
93-
unsigned char* dstbuf, unsigned *buflen)
88+
unsigned int key_version, unsigned char* dstbuf, unsigned *buflen)
9489
{
90+
if (key_version != 1)
91+
return ENCRYPTION_KEY_VERSION_INVALID;
92+
9593
keyentry* entry = get_key(key_id);
9694

9795
if (entry == NULL)
@@ -112,7 +110,7 @@ static unsigned int get_key_from_key_file(unsigned int key_id,
112110

113111
struct st_mariadb_encryption file_key_management_plugin= {
114112
MariaDB_ENCRYPTION_INTERFACE_VERSION,
115-
get_highest_key_used_in_key_file,
113+
get_latest_version,
116114
get_key_from_key_file,
117115
0,0
118116
};

0 commit comments

Comments
 (0)