Fixed bug#22538749 IMPORT OF ENCRYPTED DBSPACE FAILS WITH MASTER KEY ERROR

Allen Lai · bjornmu · commit 1e6e19904722 · 2016-01-18T13:08:55.000+01:00
In importing, we need to skip getting key information from data file. The
key information should be acheived from .cfp file.

Reviewed-by: Jimmy Yang&lt;jimmy.yang@oracle.com&gt;
RB: 11492
(cherry picked from commit 2091b92ff866f0109e8bd4801e827473d5dfa955)
diff --git a/storage/innobase/fil/fil0fil.cc b/storage/innobase/fil/fil0fil.cc
@@ -3785,6 +3785,7 @@ fil_ibd_open(
 	RemoteDatafile	df_remote;	/* remote location */
 	ulint		tablespaces_found = 0;
 	ulint		valid_tablespaces_found = 0;
+	bool		for_import = (purpose == FIL_TYPE_IMPORT);
 
 	ut_ad(!fix_dict || rw_lock_own(dict_operation_lock, RW_LOCK_X));
 
@@ -3910,13 +3911,16 @@ fil_ibd_open(
 	/* Read and validate the first page of these three tablespace
 	locations, if found. */
 	valid_tablespaces_found +=
-		(df_remote.validate_to_dd(id, flags) == DB_SUCCESS) ? 1 : 0;
+		(df_remote.validate_to_dd(id, flags, for_import)
+			== DB_SUCCESS) ? 1 : 0;
 
 	valid_tablespaces_found +=
-		(df_default.validate_to_dd(id, flags) == DB_SUCCESS) ? 1 : 0;
+		(df_default.validate_to_dd(id, flags, for_import)
+			== DB_SUCCESS) ? 1 : 0;
 
 	valid_tablespaces_found +=
-		(df_dict.validate_to_dd(id, flags) == DB_SUCCESS) ? 1 : 0;
+		(df_dict.validate_to_dd(id, flags, for_import)
+			== DB_SUCCESS) ? 1 : 0;
 
 	/* Make sense of these three possible locations.
 	First, bail out if no tablespace files were found. */
@@ -4103,7 +4107,7 @@ fil_ibd_open(
 
 		/* For encryption tablespace, initialize encryption
 		information.*/
-		if (err == DB_SUCCESS && is_encrypted) {
+		if (err == DB_SUCCESS && is_encrypted && !for_import) {
 			Datafile& df_current = df_remote.is_open() ?
 				df_remote: df_dict.is_open() ?
 				df_dict : df_default;
diff --git a/storage/innobase/fsp/fsp0file.cc b/storage/innobase/fsp/fsp0file.cc
@@ -387,12 +387,14 @@ space ID and flags.  The file should exist and be successfully opened
 in order for this function to validate it.
 @param[in]	space_id	The expected tablespace ID.
 @param[in]	flags		The expected tablespace flags.
+@param[in]	for_import	if it is for importing
 @retval DB_SUCCESS if tablespace is valid, DB_ERROR if not.
 m_is_valid is also set true on success, else false. */
 dberr_t
 Datafile::validate_to_dd(
-	ulint	space_id,
-	ulint	flags)
+	ulint		space_id,
+	ulint		flags,
+	bool		for_import)
 {
 	dberr_t err;
 
@@ -403,7 +405,7 @@ Datafile::validate_to_dd(
 	/* Validate this single-table-tablespace with the data dictionary,
 	but do not compare the DATA_DIR flag, in case the tablespace was
 	remotely located. */
-	err = validate_first_page();
+	err = validate_first_page(0, for_import);
 	if (err != DB_SUCCESS) {
 		return(err);
 	}
@@ -447,7 +449,7 @@ Datafile::validate_for_recovery()
 	ut_ad(is_open());
 	ut_ad(!srv_read_only_mode);
 
-	err = validate_first_page();
+	err = validate_first_page(0, false);
 
 	switch (err) {
 	case DB_SUCCESS:
@@ -459,7 +461,7 @@ Datafile::validate_for_recovery()
 		}
 		/* Free the previously read first page and then re-validate. */
 		free_first_page();
-		err = validate_first_page();
+		err = validate_first_page(0, false);
 		if (err == DB_SUCCESS) {
 			std::string filepath = fil_space_get_first_path(
 				m_space_id);
@@ -520,7 +522,7 @@ Datafile::validate_for_recovery()
 
 		/* Free the previously read first page and then re-validate. */
 		free_first_page();
-		err = validate_first_page();
+		err = validate_first_page(0, false);
 	}
 
 	if (err == DB_SUCCESS) {
@@ -535,12 +537,14 @@ tablespace is opened.  This occurs before the fil_space_t is created
 so the Space ID found here must not already be open.
 m_is_valid is set true on success, else false.
 @param[out]	flush_lsn	contents of FIL_PAGE_FILE_FLUSH_LSN
+@param[in]	for_import	if it is for importing
 (only valid for the first file of the system tablespace)
 @retval DB_SUCCESS on if the datafile is valid
 @retval DB_CORRUPTION if the datafile is not readable
 @retval DB_TABLESPACE_EXISTS if there is a duplicate space_id */
 dberr_t
-Datafile::validate_first_page(lsn_t*	flush_lsn)
+Datafile::validate_first_page(lsn_t*	flush_lsn,
+			      bool	for_import)
 {
 	char*		prev_name;
 	char*		prev_filepath;
@@ -631,8 +635,8 @@ Datafile::validate_first_page(lsn_t*	flush_lsn)
 
 	/* For encrypted tablespace, check the encryption info in the
 	first page can be decrypt by master key, otherwise, this table
-	can't be open. */
-	if (FSP_FLAGS_GET_ENCRYPTION(m_flags)) {
+	can't be open. And for importing, we skip checking it. */
+	if (FSP_FLAGS_GET_ENCRYPTION(m_flags) && !for_import) {
 		m_encryption_key = static_cast<byte*>(
 			ut_zalloc_nokey(ENCRYPTION_KEY_LEN));
 		m_encryption_iv = static_cast<byte*>(
diff --git a/storage/innobase/fsp/fsp0sysspace.cc b/storage/innobase/fsp/fsp0sysspace.cc
@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 2013, 2015, Oracle and/or its affiliates. All Rights Reserved.
+Copyright (c) 2013, 2016, Oracle and/or its affiliates. All Rights Reserved.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -577,7 +577,7 @@ SysTablespace::read_lsn_and_check_flags(lsn_t* flushed_lsn)
 	first datafile. */
 	for (int retry = 0; retry < 2; ++retry) {
 
-		err = it->validate_first_page(flushed_lsn);
+		err = it->validate_first_page(flushed_lsn, false);
 
 		if (err != DB_SUCCESS
 		    && (retry == 1
diff --git a/storage/innobase/include/fsp0file.h b/storage/innobase/include/fsp0file.h
@@ -239,11 +239,13 @@ class Datafile {
 	successfully opened in order for this function to validate it.
 	@param[in]	space_id	The expected tablespace ID.
 	@param[in]	flags		The expected tablespace flags.
+	@param[in]	for_import	is it for importing
 	@retval DB_SUCCESS if tablespace is valid, DB_ERROR if not.
 	m_is_valid is also set true on success, else false. */
 	dberr_t validate_to_dd(
-		ulint	space_id,
-		ulint	flags)
+		ulint		space_id,
+		ulint		flags,
+		bool		for_import)
 		__attribute__((warn_unused_result));
 
 	/** Validates this datafile for the purpose of recovery.
@@ -262,11 +264,13 @@ class Datafile {
 	so the Space ID found here must not already be open.
 	m_is_valid is set true on success, else false.
 	@param[out]	flush_lsn	contents of FIL_PAGE_FILE_FLUSH_LSN
+	@param[in]	for_import	if it is for importing
 	(only valid for the first file of the system tablespace)
 	@retval DB_SUCCESS on if the datafile is valid
 	@retval DB_CORRUPTION if the datafile is not readable
 	@retval DB_TABLESPACE_EXISTS if there is a duplicate space_id */
-	dberr_t validate_first_page(lsn_t*	flush_lsn = 0)
+	dberr_t validate_first_page(lsn_t*	flush_lsn,
+				    bool	for_import)
 		__attribute__((warn_unused_result));
 
 	/** Get Datafile::m_name.
diff --git a/storage/innobase/log/log0recv.cc b/storage/innobase/log/log0recv.cc
@@ -1651,6 +1651,7 @@ fil_write_encryption_parse(
 		ut_ad(FSP_FLAGS_GET_ENCRYPTION(space->flags));
 
 		space->encryption_type = Encryption::AES;
+		space->encryption_klen = ENCRYPTION_KEY_LEN;
 	}
 
 	return(ptr);
diff --git a/storage/innobase/os/os0file.cc b/storage/innobase/os/os0file.cc
@@ -8859,6 +8859,8 @@ Encryption::encrypt(
 	case Encryption::AES: {
 		lint			elen;
 
+		ut_ad(m_klen == ENCRYPTION_KEY_LEN);
+
 		elen = my_aes_encrypt(
 			src + FIL_PAGE_DATA,
 			static_cast<uLong>(main_len),
@@ -9071,6 +9073,8 @@ Encryption::decrypt(
 		/* First decrypt the last 2 blocks data of data, since
 		data is no block aligned. */
 		if (remain_len != 0) {
+			ut_ad(m_klen == ENCRYPTION_KEY_LEN);
+
 			remain_len = MY_AES_BLOCK_SIZE * 2;
 
 			/* Copy the last 2 blocks. */

Original file line number	Diff line number	Diff line change
`@@ -1651,6 +1651,7 @@ fil_write_encryption_parse(`
`1651`	`1651`	`ut_ad(FSP_FLAGS_GET_ENCRYPTION(space->flags));`
`1652`	`1652`
`1653`	`1653`	`space->encryption_type = Encryption::AES;`
	`1654`	`+ space->encryption_klen = ENCRYPTION_KEY_LEN;`
`1654`	`1655`	`}`
`1655`	`1656`
`1656`	`1657`	`return(ptr);`