Skip to content

Commit 9340eb1

Browse files
harinvadodariaharinvadodaria
committed
WL#5769, WL#8821 and WL#8548
WL#5769: Keyring service for MySQL - Added keyring service - Added file based keyring plugin : keyring_file WL#8821: Innodb tablespace encryption key rotation SQL commands - Added syntax and server support for master key rotation SQL: ALTER INSTANCE ROTATE INNODB MASTER KEY - Added support to load plugin before mandatory/built-in plugins using new option : --early-plugin-load - Added support for compile time default for --early-plugin-load WL#8548: InnoDB: Transparent data encryption - Added new option for table creation for enablin data encryption : ENCRYPTION="Y"/"N" - Added transparent data encryption using keyring service - Added support for master key rotation - Added support for import/export of encrypted tablespace
1 parent e31e04b commit 9340eb1

File tree

308 files changed

+15463
-617
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

308 files changed

+15463
-617
lines changed

‎CMakeLists.txt

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or modify
44
# it under the terms of the GNU General Public License as published by
@@ -412,6 +412,11 @@ IF(INSTALL_MYSQLDATADIR MATCHES "^/.*")
412412
ELSE()
413413
SET(MYSQL_DATADIR "${DEFAULT_MYSQL_HOME}/${INSTALL_MYSQLDATADIR}" CACHE PATH "default MySQL data directory")
414414
ENDIF()
415+
IF(INSTALL_MYSQLKEYRINGDIR MATCHES "^/.*")
416+
SET(MYSQL_KEYRINGDIR ${INSTALL_MYSQLKEYRINGDIR} CACHE PATH "default MySQL keyring directory")
417+
ELSE()
418+
SET(MYSQL_KEYRINGDIR "${DEFAULT_MYSQL_HOME}/${INSTALL_MYSQLKEYRINGDIR}" CACHE PATH "default MySQL keyring directory")
419+
ENDIF()
415420
SET(DEFAULT_CHARSET_HOME "${DEFAULT_MYSQL_HOME}")
416421
SET(PLUGINDIR "${DEFAULT_MYSQL_HOME}/${INSTALL_PLUGINDIR}")
417422
IF(SYSCONFDIR)
@@ -534,6 +539,8 @@ IF(WITH_UNIT_TESTS)
534539
ENDIF()
535540

536541
IF(NOT WITHOUT_SERVER)
542+
# Set default keyring plugin information
543+
SET(KEYRING_PLUGIN_INFO "" CACHE INTERNAL "")
537544
SET (MYSQLD_STATIC_PLUGIN_LIBS "" CACHE INTERNAL "")
538545
SET (MYSQLD_STATIC_EMBEDDED_PLUGIN_LIBS "" CACHE INTERNAL "")
539546
# Add storage engines and plugins.
@@ -600,6 +607,10 @@ IF(NOT WITHOUT_SERVER)
600607
IF(EXISTS ${CMAKE_SOURCE_DIR}/internal/CMakeLists.txt)
601608
ADD_SUBDIRECTORY(internal)
602609
ENDIF()
610+
# Set default value for --early_load_plugin.
611+
# KEYRING_PLUGIN_INFO should have been set to appropriate default
612+
# by keyring plugin
613+
SET(DEFAULT_EARLY_PLUGIN_LOAD "\"${KEYRING_PLUGIN_INFO}\"" CACHE INTERNAL "Default value for --early_plugin_load" FORCE)
603614
ADD_SUBDIRECTORY(packaging/rpm-oel)
604615
ADD_SUBDIRECTORY(packaging/rpm-fedora)
605616
ADD_SUBDIRECTORY(packaging/rpm-sles)

‎cmake/abi_check.cmake

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2009, 2016, Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or modify
44
# it under the terms of the GNU General Public License as published by
@@ -45,6 +45,7 @@ IF(CMAKE_COMPILER_IS_GNUCC AND RUN_ABI_CHECK)
4545
${CMAKE_SOURCE_DIR}/include/mysql/client_plugin.h
4646
${CMAKE_SOURCE_DIR}/include/mysql/plugin_auth.h
4747
${CMAKE_SOURCE_DIR}/include/mysql/services.h
48+
${CMAKE_SOURCE_DIR}/include/mysql/plugin_keyring.h
4849
)
4950

5051
ADD_CUSTOM_TARGET(abi_check ALL

‎cmake/install_layout.cmake

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or modify
44
# it under the terms of the GNU General Public License as published by
@@ -71,6 +71,7 @@
7171
# - INSTALL_SUPPORTFILESDIR (various extra support files)
7272
#
7373
# - INSTALL_MYSQLDATADIR (data directory)
74+
# - INSTALL_MYSQLKEYRING (keyring directory)
7475
# - INSTALL_SECURE_FILE_PRIVDIR (--secure-file-priv directory)
7576
#
7677
# When changing this page, _please_ do not forget to update public Wiki
@@ -172,6 +173,7 @@ SET(INSTALL_MYSQLTESTDIR_STANDALONE "mysql-test")
172173
SET(INSTALL_SUPPORTFILESDIR_STANDALONE "support-files")
173174
#
174175
SET(INSTALL_MYSQLDATADIR_STANDALONE "data")
176+
SET(INSTALL_MYSQLKEYRINGDIR_STANDALONE "keyring")
175177
SET(INSTALL_PLUGINTESTDIR_STANDALONE ${plugin_tests})
176178
SET(INSTALL_SECURE_FILE_PRIVDIR_STANDALONE ${secure_file_priv_path})
177179
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_STANDALONE ${secure_file_priv_embedded_path})
@@ -199,6 +201,7 @@ SET(INSTALL_MYSQLTESTDIR_WIN "mysql-test")
199201
SET(INSTALL_SUPPORTFILESDIR_WIN "support-files")
200202
#
201203
SET(INSTALL_MYSQLDATADIR_WIN "data")
204+
SET(INSTALL_MYSQLKEYRINGDIR_WIN "keyring")
202205
SET(INSTALL_PLUGINTESTDIR_WIN ${plugin_tests})
203206
SET(INSTALL_SECURE_FILE_PRIVDIR_WIN ${secure_file_priv_path})
204207
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_WIN ${secure_file_priv_embedded_path})
@@ -226,6 +229,7 @@ SET(INSTALL_MYSQLTESTDIR_FREEBSD "mysql-test")
226229
SET(INSTALL_SUPPORTFILESDIR_FREEBSD "support-files")
227230
#
228231
SET(INSTALL_MYSQLDATADIR_FREEBSD "data")
232+
SET(INSTALL_MYSQLKEYRINGDIR_FREEBSD "keyring")
229233
SET(INSTALL_PLUGINTESTDIR_FREEBSD ${plugin_tests})
230234
SET(INSTALL_SECURE_FILE_PRIVDIR_FREEBSD ${secure_file_priv_path})
231235
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_FREEBSD ${secure_file_priv_embedded_path})
@@ -253,6 +257,7 @@ SET(INSTALL_MYSQLTESTDIR_GLIBC "mysql-test")
253257
SET(INSTALL_SUPPORTFILESDIR_GLIBC "support-files")
254258
#
255259
SET(INSTALL_MYSQLDATADIR_GLIBC "data")
260+
SET(INSTALL_MYSQLKEYRINGDIR_GLIBC "keyring")
256261
SET(INSTALL_PLUGINTESTDIR_GLIBC ${plugin_tests})
257262
SET(INSTALL_SECURE_FILE_PRIVDIR_GLIBC ${secure_file_priv_path})
258263
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_GLIBC ${secure_file_priv_embedded_path})
@@ -280,6 +285,7 @@ SET(INSTALL_MYSQLTESTDIR_OSX "mysql-test")
280285
SET(INSTALL_SUPPORTFILESDIR_OSX "support-files")
281286
#
282287
SET(INSTALL_MYSQLDATADIR_OSX "data")
288+
SET(INSTALL_MYSQLKEYRINGDIR_OSX "keyring")
283289
SET(INSTALL_PLUGINTESTDIR_OSX ${plugin_tests})
284290
SET(INSTALL_SECURE_FILE_PRIVDIR_OSX ${secure_file_priv_path})
285291
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_OSX ${secure_file_priv_embedded_path})
@@ -307,6 +313,7 @@ SET(INSTALL_MYSQLTESTDIR_TARGZ "mysql-test")
307313
SET(INSTALL_SUPPORTFILESDIR_TARGZ "support-files")
308314
#
309315
SET(INSTALL_MYSQLDATADIR_TARGZ "data")
316+
SET(INSTALL_MYSQLKEYRINGDIR_TARGZ "keyring")
310317
SET(INSTALL_PLUGINTESTDIR_TARGZ ${plugin_tests})
311318
SET(INSTALL_SECURE_FILE_PRIVDIR_TARGZ ${secure_file_priv_path})
312319
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_TARGZ ${secure_file_priv_embedded_path})
@@ -343,6 +350,7 @@ SET(INSTALL_MYSQLTESTDIR_RPM "share/mysql-test")
343350
SET(INSTALL_SUPPORTFILESDIR_RPM "share/mysql")
344351
#
345352
SET(INSTALL_MYSQLDATADIR_RPM "/var/lib/mysql")
353+
SET(INSTALL_MYSQLKEYRINGDIR_RPM "/var/lib/mysql-keyring")
346354
SET(INSTALL_PLUGINTESTDIR_RPM ${plugin_tests})
347355
SET(INSTALL_SECURE_FILE_PRIVDIR_RPM ${secure_file_priv_path})
348356
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_RPM ${secure_file_priv_embedded_path})
@@ -375,6 +383,7 @@ SET(INSTALL_MYSQLTESTDIR_SLES "share/mysql-test")
375383
SET(INSTALL_SUPPORTFILESDIR_SLES "share/mysql")
376384
#
377385
SET(INSTALL_MYSQLDATADIR_SLES "/var/lib/mysql")
386+
SET(INSTALL_MYSQLKEYRINGDIR_SLES "/var/lib/mysql-keyring")
378387
SET(INSTALL_PLUGINTESTDIR_SLES ${plugin_tests})
379388
SET(INSTALL_SECURE_FILE_PRIVDIR_SLES ${secure_file_priv_path})
380389
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_SLES ${secure_file_priv_embedded_path})
@@ -402,6 +411,7 @@ SET(INSTALL_MYSQLTESTDIR_DEB "mysql-test")
402411
SET(INSTALL_SUPPORTFILESDIR_DEB "support-files")
403412
#
404413
SET(INSTALL_MYSQLDATADIR_DEB "/var/lib/mysql")
414+
SET(INSTALL_MYSQLKEYRINGDIR_DEB "/var/lib/mysql-keyring")
405415
SET(INSTALL_PLUGINTESTDIR_DEB ${plugin_tests})
406416
SET(INSTALL_SECURE_FILE_PRIVDIR_DEB ${secure_file_priv_path})
407417
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_DEB ${secure_file_priv_embedded_path})
@@ -429,6 +439,7 @@ SET(INSTALL_MYSQLTESTDIR_SVR4 "mysql-test")
429439
SET(INSTALL_SUPPORTFILESDIR_SVR4 "support-files")
430440
#
431441
SET(INSTALL_MYSQLDATADIR_SVR4 "/var/lib/mysql")
442+
SET(INSTALL_MYSQLKEYRINGDIR_SVR4 "/var/lib/mysql-keyring")
432443
SET(INSTALL_PLUGINTESTDIR_SVR4 ${plugin_tests})
433444
SET(INSTALL_SECURE_FILE_PRIVDIR_SVR4 ${secure_file_priv_path})
434445
SET(INSTALL_SECURE_FILE_PRIV_EMBEDDEDDIR_SVR4 ${secure_file_priv_embedded_path})
@@ -447,7 +458,7 @@ SET(OLD_INSTALL_LAYOUT ${INSTALL_LAYOUT} CACHE INTERNAL "")
447458
# layout is chosen)
448459
FOREACH(var BIN SBIN LIB MYSQLSHARE SHARE PLUGIN INCLUDE SCRIPT DOC MAN
449460
INFO MYSQLTEST DOCREADME SUPPORTFILES MYSQLDATA PLUGINTEST
450-
SECURE_FILE_PRIV SECURE_FILE_PRIV_EMBEDDED)
461+
SECURE_FILE_PRIV SECURE_FILE_PRIV_EMBEDDED MYSQLKEYRING)
451462
SET(INSTALL_${var}DIR ${INSTALL_${var}DIR_${INSTALL_LAYOUT}}
452463
CACHE STRING "${var} installation directory" ${FORCE})
453464
MARK_AS_ADVANCED(INSTALL_${var}DIR)

‎config.h.cmake

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2009, 2016, Oracle and/or its affiliates. All rights reserved.
22

33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -237,6 +237,7 @@
237237
#cmakedefine SHAREDIR "@SHAREDIR@"
238238
#cmakedefine DEFAULT_BASEDIR "@DEFAULT_BASEDIR@"
239239
#cmakedefine MYSQL_DATADIR "@MYSQL_DATADIR@"
240+
#cmakedefine MYSQL_KEYRINGDIR "@MYSQL_KEYRINGDIR@"
240241
#cmakedefine DEFAULT_CHARSET_HOME "@DEFAULT_CHARSET_HOME@"
241242
#cmakedefine PLUGINDIR "@PLUGINDIR@"
242243
#cmakedefine DEFAULT_SYSCONFDIR "@DEFAULT_SYSCONFDIR@"
@@ -249,6 +250,7 @@
249250
#cmakedefine INSTALL_INCLUDEDIR "@default_prefix@/@INSTALL_INCLUDEDIR@"
250251
#cmakedefine INSTALL_SCRIPTDIR "@default_prefix@/@INSTALL_SCRIPTDIR@"
251252
#cmakedefine INSTALL_MYSQLDATADIR "@default_prefix@/@INSTALL_MYSQLDATADIR@"
253+
#cmakedefine INSTALL_MYSQLKEYRINGDIR "@default_prefix@/@INSTALL_MYSQLKEYRINGDIR@"
252254
#cmakedefine INSTALL_PLUGINTESTDIR "@INSTALL_PLUGINTESTDIR@"
253255
#cmakedefine INSTALL_INFODIR "@default_prefix@/@INSTALL_INFODIR@"
254256
#cmakedefine INSTALL_MYSQLTESTDIR "@default_prefix@/@INSTALL_MYSQLTESTDIR@"
@@ -432,4 +434,7 @@
432434
#cmakedefine DEFAULT_SECURE_FILE_PRIV_EMBEDDED_DIR @DEFAULT_SECURE_FILE_PRIV_EMBEDDED_DIR@
433435
#cmakedefine HAVE_LIBNUMA 1
434436

437+
/* For default value of --early_plugin_load */
438+
#cmakedefine DEFAULT_EARLY_PLUGIN_LOAD @DEFAULT_EARLY_PLUGIN_LOAD@
439+
435440
#endif

‎include/CMakeLists.txt

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or modify
44
# it under the terms of the GNU General Public License as published by
@@ -32,6 +32,7 @@ SET(HEADERS_ABI
3232
mysql/plugin_audit.h
3333
mysql/plugin_ftparser.h
3434
mysql/plugin_validate_password.h
35+
mysql/plugin_keyring.h
3536
mysql/plugin_group_replication.h
3637
)
3738

‎include/my_aes.h

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef MY_AES_INCLUDED
22
#define MY_AES_INCLUDED
33

4-
/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
4+
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License as published by
@@ -25,6 +25,9 @@ C_MODE_START
2525
/** AES IV size is 16 bytes for all supported ciphers except ECB */
2626
#define MY_AES_IV_SIZE 16
2727

28+
/** AES block size is fixed to be 128 bits for CBC and ECB */
29+
#define MY_AES_BLOCK_SIZE 16
30+
2831

2932
/** Supported AES cipher/block mode combos */
3033
enum my_aes_opmode
@@ -74,13 +77,15 @@ extern const char *my_aes_opmode_names[];
7477
@param key_length [in] Length of the key. Will handle keys of any length
7578
@param mode [in] encryption mode
7679
@param iv [in] 16 bytes initialization vector if needed. Otherwise NULL
80+
@param padding [in] if padding needed.
7781
@return size of encrypted data, or negative in case of error
7882
*/
7983

8084
int my_aes_encrypt(const unsigned char *source, uint32 source_length,
8185
unsigned char *dest,
8286
const unsigned char *key, uint32 key_length,
83-
enum my_aes_opmode mode, const unsigned char *iv);
87+
enum my_aes_opmode mode, const unsigned char *iv,
88+
bool padding = true);
8489

8590
/**
8691
Decrypt an AES encrypted buffer
@@ -92,14 +97,16 @@ int my_aes_encrypt(const unsigned char *source, uint32 source_length,
9297
@param key_length Length of the key. Will handle keys of any length
9398
@param mode encryption mode
9499
@param iv 16 bytes initialization vector if needed. Otherwise NULL
100+
@param padding if padding needed.
95101
@return size of original data.
96102
*/
97103

98104

99105
int my_aes_decrypt(const unsigned char *source, uint32 source_length,
100106
unsigned char *dest,
101-
const unsigned char *key, uint32 key_length,
102-
enum my_aes_opmode mode, const unsigned char *iv);
107+
const unsigned char *key, uint32 key_length,
108+
enum my_aes_opmode mode, const unsigned char *iv,
109+
bool padding = true);
103110

104111
/**
105112
Calculate the size of a buffer large enough for encrypted data

‎include/my_sqlcommand.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -171,6 +171,7 @@ enum enum_sql_command {
171171
SQLCOM_EXPLAIN_OTHER,
172172
SQLCOM_SHOW_CREATE_USER,
173173
SQLCOM_SHUTDOWN,
174+
SQLCOM_ALTER_INSTANCE,
174175
/* This should be the last !!! */
175176
SQLCOM_END
176177
};

‎include/mysql/plugin.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -95,7 +95,8 @@ typedef struct st_mysql_xid MYSQL_XID;
9595
#define MYSQL_AUTHENTICATION_PLUGIN 7 /* The authentication plugin type */
9696
#define MYSQL_VALIDATE_PASSWORD_PLUGIN 8 /* validate password plugin type */
9797
#define MYSQL_GROUP_REPLICATION_PLUGIN 9 /* The Group Replication plugin */
98-
#define MYSQL_MAX_PLUGIN_TYPE_NUM 10 /* The number of plugin types */
98+
#define MYSQL_KEYRING_PLUGIN 10 /* The Keyring plugin type */
99+
#define MYSQL_MAX_PLUGIN_TYPE_NUM 11 /* The number of plugin types */
99100

100101
/* We use the following strings to define licenses for plugins */
101102
#define PLUGIN_LICENSE_PROPRIETARY 0

‎include/mysql/plugin_audit.h.pp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,7 @@
302302
SQLCOM_EXPLAIN_OTHER,
303303
SQLCOM_SHOW_CREATE_USER,
304304
SQLCOM_SHUTDOWN,
305+
SQLCOM_ALTER_INSTANCE,
305306
SQLCOM_END
306307
};
307308
typedef enum

0 commit comments

Comments
 (0)