Commit 19716ad5 authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-25982 Upgrade of MariaDB 10.1 log crashes due to missing encryption key

init_crypt_key(): On failure, set info->key_version to
ENCRYPTION_KEY_VERSION_INVALID.

log_crypt_101_read_block(): Refuse to attempt decryption if
info->key_version is ENCRYPTION_KEY_VERSION_INVALID.
parent cc0bd843
/***************************************************************************** /*****************************************************************************
Copyright (C) 2013, 2015, Google Inc. All Rights Reserved. Copyright (C) 2013, 2015, Google Inc. All Rights Reserved.
Copyright (C) 2014, 2018, MariaDB Corporation. Copyright (C) 2014, 2021, MariaDB Corporation.
This program is free software; you can redistribute it and/or modify it under This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software the terms of the GNU General Public License as published by the Free Software
...@@ -163,6 +163,7 @@ static bool init_crypt_key(crypt_info_t* info, bool upgrade = false) ...@@ -163,6 +163,7 @@ static bool init_crypt_key(crypt_info_t* info, bool upgrade = false)
<< info->key_version << " failed (" << rc << info->key_version << " failed (" << rc
<< "). Maybe the key or the required encryption " << "). Maybe the key or the required encryption "
"key management plugin was not found."; "key management plugin was not found.";
info->key_version = ENCRYPTION_KEY_VERSION_INVALID;
return false; return false;
} }
...@@ -182,6 +183,7 @@ static bool init_crypt_key(crypt_info_t* info, bool upgrade = false) ...@@ -182,6 +183,7 @@ static bool init_crypt_key(crypt_info_t* info, bool upgrade = false)
if (err != MY_AES_OK || dst_len != MY_AES_BLOCK_SIZE) { if (err != MY_AES_OK || dst_len != MY_AES_BLOCK_SIZE) {
ib::error() << "Getting redo log crypto key failed: err = " ib::error() << "Getting redo log crypto key failed: err = "
<< err << ", len = " << dst_len; << err << ", len = " << dst_len;
info->key_version = ENCRYPTION_KEY_VERSION_INVALID;
return false; return false;
} }
...@@ -275,6 +277,7 @@ log_crypt_101_read_block(byte* buf) ...@@ -275,6 +277,7 @@ log_crypt_101_read_block(byte* buf)
for (const crypt_info_t* const end = info + infos_used; info < end; for (const crypt_info_t* const end = info + infos_used; info < end;
info++) { info++) {
if (info->key_version if (info->key_version
&& info->key_version != ENCRYPTION_KEY_VERSION_INVALID
&& info->checkpoint_no == checkpoint_no) { && info->checkpoint_no == checkpoint_no) {
goto found; goto found;
} }
...@@ -286,6 +289,9 @@ log_crypt_101_read_block(byte* buf) ...@@ -286,6 +289,9 @@ log_crypt_101_read_block(byte* buf)
/* MariaDB Server 10.1 would use the first key if it fails to /* MariaDB Server 10.1 would use the first key if it fails to
find a key for the current checkpoint. */ find a key for the current checkpoint. */
info = infos; info = infos;
if (info->key_version == ENCRYPTION_KEY_VERSION_INVALID) {
return false;
}
found: found:
byte dst[OS_FILE_LOG_BLOCK_SIZE]; byte dst[OS_FILE_LOG_BLOCK_SIZE];
uint dst_len; uint dst_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment