mariadb

Tree: a0d396fd3f

Author	SHA1	Message	Date
Sergei Golubchik	65e7826070	renames to follow single consistent naming style with namespace prefixes	11 years ago
Sergei Golubchik	bb1b61b312	encryption plugin controls the encryption * no --encryption-algorithm option anymore * encrypt/decrypt methods in the encryption plugin * ecnrypt/decrypt methods in the encryption_km service * file_km plugin has --file-key-management-encryption-algorithm * debug_km always uses aes_cbc * example_km changes between aes_cbc and aes_ecb for different key versions	11 years ago
Sergei Golubchik	6a3932fdd0	use key derivation procedure for all encryption algorithms	11 years ago
Sergei Golubchik	ef5b4889c2	optimize encryption api only one encryption key lookup in most cases instead of three (has_key, get_key_size, get_key).	11 years ago
Jan Lindström	af768c2f22	InnoDB/XtraDB Encryption code cleanup Step 4: -- Review fixes -- Rename pages_page_* to pages_* -- Remove unnecessary code	11 years ago
Jan Lindström	71ec0463af	Encryption cleanup Step 3: -- Make encrytion_algorithm changeable by SUPER -- Remove AES_ECB method from encryption_algorithms -- Support AES method change by storing used method on InnoDB/XtraDB objects -- Store used AES method to crypt_data as different crypt types -- Store used AES method to redo/undo logs and checkpoint -- Store used AES method on every encrypted page after key_version -- Add test	11 years ago
Jan Lindström	0ba9fa35bc	InnoDB/XtraDB Encryption cleanup Step 2: -- Introduce temporal memory array to buffer pool where to allocate temporary memory for encryption/compression -- Rename PAGE_ENCRYPTION -> ENCRYPTION -- Rename PAGE_ENCRYPTION_KEY -> ENCRYPTION_KEY -- Rename innodb_default_page_encryption_key -> innodb_default_encryption_key -- Allow enable/disable encryption for tables by changing ENCRYPTION to enum having values DEFAULT, ON, OFF -- In create table store crypt_data if ENCRYPTION is ON or OFF -- Do not crypt tablespaces having ENCRYPTION=OFF -- Store encryption mode to crypt_data and redo-log	11 years ago
Jan Lindström	b4a4d82396	InnoDB/XtraDB Encryption cleanup. Step 1: -- Remove page encryption from dictionary (per table encryption will be handled by storing crypt_data to page 0) -- Remove encryption/compression from os0file and all functions before that (compression will be added to buf0buf.cc) -- Use same CRYPT_SCHEME_1 for all encryption methods -- Do some code cleanups to confort InnoDB coding style	11 years ago
Sergei Golubchik	2f8d101f9e	unify my_{en\|de}crypt_{cbc\|ecb\|ctr}. no yassl support yet.	11 years ago
Jan Lindström	cbc5157feb	MDEV-7878: innodb_scrub_background fails sporadically in buildbot (Failing assertion: offset > 0 && offset < UNIV_PAGE_SIZE) Problem was that when encrypted space was flushed page 0 is also updated but crypt data offset was sometimes not calculated.	11 years ago
Jan Lindström	3578419b77	MDEV-7797: file_key_management_plugin uses static IV for a key Currently crypt data is written to file space always. Use that to obtain random IV for every object (file). Beatify code to confort InnoDB coding styles. Conflicts: storage/innobase/fil/fil0crypt.cc storage/xtradb/fil/fil0crypt.cc	11 years ago
Jan Lindström	b3438f24a1	MDEV-7803: Encryption metadata (crypt_data) is written to InnoDB file space page 0 even when encryption is not enabled	11 years ago
Jan Lindström	64a290dc31	MDEV-7797: file_key_management_plugin uses static IV for a key Currently crypt data is written to file space always. Use that to obtain random IV for every object (file). Beatify code to confort InnoDB coding styles.	11 years ago
Jan Lindström	bab0bdbb5c	Introduce two debug crash points while writing crypt data to test redo operations.	11 years ago
Jan Lindström	c4b268add0	InnoDB cleanup. Remove empty statements i.e. extra ; characters.	11 years ago
Jan Lindström	7c21ea9f50	MDEV-7772: SIGSEGV on my_aes_encrypt_cbc when -DWITH_SSL=bundled Two problems: - Read/Write outside of buffer at memcpy() because of incorrect parameters . OPENSSL_assert(EVP_CIPHER_CTX_iv_length(&ctx.ctx) == iv_length); // ECB does not use IV, thus incorrect assertion Added: mysql-test/include/have_file_key_management_plugin.combinations ( to run with aes_cbc and aes_ecb) mysql-test/include/have_openssl_ctr.combinations ( to run with aes_cbc, aes_ecb and aes_ctr)	11 years ago
Jan Lindström	7047bef1ef	Use standard InnoDB error mechanism on compression and encryption error messages.	11 years ago
Jan Lindström	e2e809860e	Pass down the information should we encrypt the page at os0file.cc when page compression and google encryption is used.	11 years ago
Sergei Golubchik	21430e4378	encryption keys service	11 years ago
Sergei Golubchik	cf8bf0b68e	encryption key management plugin api	11 years ago
Sergei Golubchik	d7d589dc01	Further fixes (copied from `d7d589dc`)	11 years ago
Michael Widenius	1e3e19a4dd	Fixes for encryption from eperi	11 years ago
Monty	fb7a504ee1	Pushed files missing in last commit	11 years ago
Jan Lindström	89af7cfdf4	Fix error.	11 years ago
Jan Lindström	831bf6eada	Start integraring encryption and compression so that we have only one implementation of encryption using CRYPT_SCHEME_1 where L = AES_ECB(KEY, IV) CRYPT(PAGE) = AES_CRT(KEY=L, IV=C, PAGE) and two different implementations how keys are stored. For AIO this means that compression and encryption is called at os0file as earlier. For all other we do these at buf0buf.cc.	11 years ago
Jan Lindström	da41a9683c	Merge Google's Scrubing feature: commit `c01fc2134d` Author: Jonas Oreland <jonaso@google.com> Date: Thu Apr 10 15:04:25 2014 +0000 innodb datafile scrubbing this patch implements scrubbing of innodb datafiles either by scrubbing as part of purge (non compressed) or scrubbing by scanning whole tablespaces (added into key rotation threads). the background scrubbing is further divided into btr_optimistic_scrub (which calls btr_page_reorganize) or if that fails btr_pessimistic_scrub (which calls page split routines). Change-Id: I55915e9274ab3b0c5ac90b42d7304386124b0b0f commit `aad1e79709` Author: Minli Zhu <minliz@google.com> Date: Mon Feb 10 15:42:26 2014 -0800 Innodb redo log scrubbing. Change-Id: I0d4a55b0021dde7129f6ff701c7b75c4186f9e9a	11 years ago
Jan Lindström	c5ae630582	Merge Google encryption commit `195158e988` Author: Minli Zhu <minliz@google.com> Date: Mon Nov 25 11:05:55 2013 -0800 Innodb redo log encryption/decryption. Use start lsn of a log block as part of AES CTR counter. Record key version with each checkpoint. Internally key version 0 means no encryption. Tests done (see test_innodb_log_encryption.sh for detail): - Verify flag innodb_encrypt_log on or off, combined with various key versions passed through CLI, and dynamically set after startup, will not corrupt database. This includes tests from being unencrypted to encrypted, and encrypted to unencrypted. - Verify start-up with no redo logs succeeds. - Verify fresh start-up succeeds. Change-Id: I4ce4c2afdf3076be2fce90ebbc2a7ce01184b612 commit `c1b9727365` Author: Jonas Oreland <jonaso@google.com> Date: Tue Dec 3 18:47:27 2013 +0100 encryption of aria data&index files this patch implements encryption of aria data & index files. this is implemented as 1) add read/write hooks (renamed from callbacks) that does encrypt/decrypt (also add pre_read and post_write hooks) 2) modify page headers for data/index to contain key version (making the data-page header size different for with/without encryption) 3) modify index page 0 to contain IV (and crypt header) 4) AES CRT crypt functions 5) counter block is implemented using combination of page no, lsn and table specific id NOTE: 1) log files are not encrypted, this is not needed for if aria is only used for internal temporary tables and they are not transactional (i.e not logged) 2) all encrypted tables are using PAGE_CHECKSUM (crc) normal internal temporary tables are (currently) not CHECKSUM:ed 3) This patch adds insert-order semantics to aria block_format. The default behaviour of aria block-format is best-fit, meaning that rows gets allocated to page trying to fill the pages as much as possible. However, certain sql constructs materialize temporary result in tmp-tables, and expect that a table scan will later return the rows in the same order they were inserted. This implementation of insert-order is only enabled when explicitly requested by sql-layer. CHANGES: 1) found bug in ma_write that made code try to abort a record that was never written unsure why this is not exposed Change-Id: Ia82bbaa92e2c0629c08693c5add2f56b815c0509 commit `89dc1ab651` Author: Jonas Oreland <jonaso@google.com> Date: Mon Feb 17 08:04:50 2014 -0800 Implement encryption of innodb datafiles. Pages are encrypted before written to disk and decrypted when read from disk. Each page except first page (page 0) in tablespace is encrypted. Page 0 is unencrypted and contains IV for the tablespace. FIL_PAGE_FILE_FLUSH_LSN on each page (except page 0) is used to store a 32-bit key-version, so that multiple keys can be active in a tablespace simultaneous. The other 32-bit of the FIL_PAGE_FILE_FLUSH_LSN field contains a checksum that is computed after encryption. This checksum is used by innochecksum and when restoring from double-write-buffer. The encryption is performed using AES CRT. Monitoring of encryption is enabled using new IS-table INNODB_TABLESPACES_ENCRYPTION. In addition to that new status variables innodb_encryption_rotation_{ pages_read_from_cache, pages_read_from_disk, pages_modified,pages_flushed } has been added. The following tunables are introduces - innodb_encrypt_tables - innodb_encryption_threads - innodb_encryption_rotate_key_age - innodb_encryption_rotation_iops Change-Id: I8f651795a30b52e71b16d6bc9cb7559be349d0b2 commit `a17eef2f69` Author: Andrew Ford <andrewford@google.com> Date: Thu Jan 2 15:43:09 2014 -0800 Key management skeleton with debug hooks. Change-Id: Ifd6aa3743d7ea291c70083f433a059c439aed866 commit `68a399838a` Author: Andrew Ford <andrewford@google.com> Date: Mon Oct 28 16:27:44 2013 -0700 Add AES-128 CTR and GCM encryption classes. Change-Id: I116305eced2a233db15306bc2ef5b9d398d1a3a2	11 years ago

1 2

78 Commits (a0d396fd3f5f86e09f602ac9f76b8d9f2e739221)