Skip to content

Commit cf6cc06

Browse files
harinvadodariaharinvadodaria
committed
WL#9772: Test and Document Gemalto KMIP Appliance
 with existing OKV_Keyring Description: This worklog enhances keyring_okv plugin to support KMIP appliance such as KeySecure. This worklog also fixes following issue(s). Bug#25540639: KEYRING_OKV DOES NOT GENERATE RSA/DSA KEYS CORRECTLY in MySQL 5.7 Reviewed-By : Georgi Kodinov <[email protected]>
1 parent 2006195 commit cf6cc06

File tree

1 file changed

+253
-0
lines changed

1 file changed

+253
-0
lines changed

‎mysql-test/include/keyring_udf_keyring_plugin_loaded_symmetric.inc‎

Lines changed: 253 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,253 @@
1+
--replace_regex /\.dll/.so/
2+
eval create function keyring_key_store returns integer soname '$KEYRING_UDF';
3+
--replace_regex /\.dll/.so/
4+
eval create function keyring_key_fetch returns string soname '$KEYRING_UDF';
5+
--replace_regex /\.dll/.so/
6+
eval create function keyring_key_type_fetch returns string soname '$KEYRING_UDF';
7+
--replace_regex /\.dll/.so/
8+
eval create function keyring_key_length_fetch returns integer soname '$KEYRING_UDF';
9+
--replace_regex /\.dll/.so/
10+
eval create function keyring_key_remove returns integer soname '$KEYRING_UDF';
11+
--replace_regex /\.dll/.so/
12+
eval create function keyring_key_generate returns integer soname '$KEYRING_UDF';
13+
14+
# Error cases -- wrong argument count
15+
--error ER_CANT_INITIALIZE_UDF
16+
select keyring_key_store('Key_1');
17+
--error ER_CANT_INITIALIZE_UDF
18+
select keyring_key_store('Key_1','AES');
19+
--error ER_CANT_INITIALIZE_UDF
20+
select keyring_key_fetch('Key_1','AES');
21+
--error ER_CANT_INITIALIZE_UDF
22+
select keyring_key_type_fetch('Key_1','AES');
23+
--error ER_CANT_INITIALIZE_UDF
24+
select keyring_key_length_fetch('Key_1','AES');
25+
--error ER_CANT_INITIALIZE_UDF
26+
select keyring_key_remove('Key_1','AES');
27+
--error ER_CANT_INITIALIZE_UDF
28+
select keyring_key_generate('Key_1');
29+
--error ER_CANT_INITIALIZE_UDF
30+
select keyring_key_generate('Key_1','AES');
31+
--error ER_CANT_INITIALIZE_UDF
32+
select keyring_key_generate('Key_1','');
33+
--error ER_CANT_INITIALIZE_UDF
34+
select keyring_key_fetch('Key_1',NULL);
35+
# End of wrong count
36+
37+
# Error cases -- wrong argument type
38+
--error ER_CANT_INITIALIZE_UDF
39+
select keyring_key_store('Key_1','AES',123);
40+
--error ER_CANT_INITIALIZE_UDF
41+
select keyring_key_store(NULL,'AES',123);
42+
--error ER_CANT_INITIALIZE_UDF
43+
select keyring_key_store('Key_1',NULL,123);
44+
--error ER_CANT_INITIALIZE_UDF
45+
select keyring_key_store('Key_1','AES',NULL);
46+
--error ER_CANT_INITIALIZE_UDF
47+
select keyring_key_store(NULL,NULL,NULL);
48+
--error ER_CANT_INITIALIZE_UDF
49+
select keyring_key_store(1234,NULL,'53247@#$%^');
50+
--error ER_CANT_INITIALIZE_UDF
51+
select keyring_key_store(1,'AES','123');
52+
--error ER_CANT_INITIALIZE_UDF
53+
select keyring_key_store('Key_1',123,'123');
54+
--error ER_CANT_INITIALIZE_UDF
55+
select keyring_key_fetch(1);
56+
--error ER_CANT_INITIALIZE_UDF
57+
select keyring_key_fetch(NULL);
58+
--error ER_CANT_INITIALIZE_UDF
59+
select keyring_key_type_fetch(1);
60+
--error ER_CANT_INITIALIZE_UDF
61+
select keyring_key_type_fetch(NULL);
62+
--error ER_CANT_INITIALIZE_UDF
63+
select keyring_key_length_fetch(1);
64+
--error ER_CANT_INITIALIZE_UDF
65+
select keyring_key_length_fetch(NULL);
66+
--error ER_CANT_INITIALIZE_UDF
67+
select keyring_key_generate('Key_1','AES','123');
68+
--error ER_CANT_INITIALIZE_UDF
69+
select keyring_key_generate(NULL,'AES','123');
70+
--error ER_CANT_INITIALIZE_UDF
71+
select keyring_key_generate('Key_1',NULL,'123');
72+
--error ER_CANT_INITIALIZE_UDF
73+
select keyring_key_generate('Key_1','AES',NULL);
74+
--error ER_CANT_INITIALIZE_UDF
75+
select keyring_key_generate(NULL,NULL,NULL);
76+
--error ER_CANT_INITIALIZE_UDF
77+
select keyring_key_generate(1,'AES',123);
78+
--error ER_CANT_INITIALIZE_UDF
79+
select keyring_key_generate('Key_1',123,'123');
80+
--error ER_CANT_INITIALIZE_UDF
81+
select keyring_key_generate('Key_invalid_key_type',123,123);
82+
--error ER_CANT_INITIALIZE_UDF
83+
select keyring_key_remove(1);
84+
--error ER_CANT_INITIALIZE_UDF
85+
select keyring_key_remove(NULL);
86+
# End of wrong argument type
87+
88+
#Error case -- too long key
89+
--error ER_CANT_INITIALIZE_UDF
90+
select keyring_key_generate('Rob_AES_8196','AES',2049);
91+
92+
#Check the plugins
93+
94+
select PLUGIN_NAME,PLUGIN_AUTHOR from information_schema.plugins where PLUGIN_NAME like '%keyring%';
95+
96+
# Genuine cases
97+
98+
# AES
99+
# Generate AES_128
100+
select keyring_key_generate('Rob_AES_128','AES',16);
101+
select keyring_key_fetch('Rob_AES_128') into @x;
102+
select LENGTH(@x);
103+
select keyring_key_type_fetch('Rob_AES_128');
104+
select keyring_key_length_fetch('Rob_AES_128');
105+
select keyring_key_remove('Rob_AES_128');
106+
# Store AES_128
107+
select keyring_key_store('Rob_AES_128','AES',"0123456789012345");
108+
select keyring_key_fetch('Rob_AES_128') into @x;
109+
select LENGTH(@x);
110+
select keyring_key_type_fetch('Rob_AES_128');
111+
select keyring_key_length_fetch('Rob_AES_128');
112+
select keyring_key_remove('Rob_AES_128');
113+
# Generate AES_192
114+
select keyring_key_generate('Rob_AES_192','AES',24);
115+
select keyring_key_fetch('Rob_AES_192') into @x;
116+
select LENGTH(@x);
117+
select keyring_key_type_fetch('Rob_AES_192');
118+
select keyring_key_length_fetch('Rob_AES_192');
119+
select keyring_key_remove('Rob_AES_192');
120+
# Store AES_192
121+
select keyring_key_store('Rob_AES_192','AES',"012345678901234567890%@3");
122+
select keyring_key_fetch('Rob_AES_192') into @x;
123+
select LENGTH(@x);
124+
select keyring_key_type_fetch('Rob_AES_192');
125+
select keyring_key_length_fetch('Rob_AES_192');
126+
select keyring_key_remove('Rob_AES_192');
127+
# Generate AES_256
128+
select keyring_key_generate('Rob_AES_256','AES',32);
129+
select keyring_key_fetch('Rob_AES_256') into @x;
130+
select LENGTH(@x);
131+
select keyring_key_type_fetch('Rob_AES_256');
132+
select keyring_key_length_fetch('Rob_AES_256');
133+
select keyring_key_remove('Rob_AES_256');
134+
# Store AES_256
135+
select keyring_key_store('Rob_AES_256','AES',"01234567890123456789012345678901");
136+
select keyring_key_fetch('Rob_AES_256') into @x;
137+
select LENGTH(@x);
138+
select keyring_key_type_fetch('Rob_AES_256');
139+
select keyring_key_length_fetch('Rob_AES_256');
140+
select keyring_key_remove('Rob_AES_256');
141+
142+
# Fetch not existing:
143+
select keyring_key_fetch('key') into @x;
144+
select @x;
145+
select keyring_key_type_fetch('key') into @x;
146+
select @x;
147+
select keyring_key_length_fetch('key') into @x;
148+
select @x;
149+
150+
--echo #Testing with AES_ENCRYPT/AES_DECRYPT
151+
152+
select keyring_key_generate('AES_128','AES',16);
153+
select AES_ENCRYPT('secret message', keyring_key_fetch('AES_128')) into @cipher;
154+
select AES_DECRYPT(@cipher, keyring_key_fetch('AES_128'));
155+
156+
select keyring_key_remove('AES_128');
157+
158+
# Fetch non-existent key - we should get empty string as result
159+
select keyring_key_fetch('Rob1');
160+
# Fetch non-existent type
161+
select keyring_key_type_fetch('Rob1');
162+
# Fetch length not existing
163+
select keyring_key_length_fetch('Rob1');
164+
165+
# Errors comming from keyring
166+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
167+
select keyring_key_fetch('') into @x;
168+
select @x;
169+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
170+
select keyring_key_length_fetch('') into @x;
171+
select @x;
172+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
173+
select keyring_key_type_fetch('') into @x;
174+
select @x;
175+
# Remove not existing
176+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
177+
select keyring_key_remove('Rob_not_existing') into @x;
178+
select @x;
179+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
180+
select keyring_key_remove('') into @x;
181+
select @x;
182+
# Generate wrong key type
183+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
184+
select keyring_key_generate('Wrong_type','xxx', 16) into @x;
185+
select @x;
186+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
187+
select keyring_key_generate('','AES', 16) into @x;
188+
select @x;
189+
# Store wrong key type
190+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
191+
select keyring_key_store('Wrong_type','xxx', '0123456789012345') into @x;
192+
select @x;
193+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
194+
select keyring_key_store('','AES', '0123456789012345') into @x;
195+
select @x;
196+
197+
--echo # Testing privileges
198+
199+
select keyring_key_generate('roots_key', 'AES',16);
200+
201+
create definer=root@localhost procedure shared_key() select keyring_key_fetch('roots_key');
202+
203+
CREATE USER user_execute_test@localhost;
204+
connect(conn_no_execute, localhost, user_execute_test);
205+
206+
--error ER_CANT_INITIALIZE_UDF
207+
select keyring_key_generate('Rob_AES_no_privilege','AES',16);
208+
209+
connection default;
210+
disconnect conn_no_execute;
211+
GRANT EXECUTE ON *.* TO 'user_execute_test'@'localhost';
212+
213+
connect(conn_with_execute, localhost, user_execute_test);
214+
215+
select keyring_key_generate('Rob_AES_no_privilege','AES',16);
216+
select keyring_key_generate('another_Rob_AES_no_privilege','AES',16);
217+
218+
--echo #Check if user you can access another user's keys
219+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
220+
select keyring_key_remove('roots_key');
221+
222+
--echo #Check that the user is able to access the key via procedure
223+
--replace_column 1 #
224+
call shared_key();
225+
226+
connection default;
227+
228+
DROP PROCEDURE shared_key;
229+
230+
--echo #Check if a user can create a key with id that already exist but belongs
231+
--echo #to another user.
232+
233+
select keyring_key_generate('Rob_AES_no_privilege','AES',16);
234+
235+
--echo #Check if user with larger privileges can access another user's key
236+
237+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
238+
select keyring_key_remove('another_Rob_AES_no_privilege');
239+
240+
--echo #Cleanup
241+
242+
select keyring_key_remove('Rob_AES_no_privilege');
243+
select keyring_key_remove('roots_key');
244+
connection conn_with_execute;
245+
select keyring_key_remove('Rob_AES_no_privilege');
246+
select keyring_key_remove('another_Rob_AES_no_privilege');
247+
248+
connection default;
249+
disconnect conn_with_execute;
250+
DROP USER 'user_execute_test'@'localhost';
251+
252+
# End of genuine cases
253+

0 commit comments

Comments
 (0)