Skip to content

Commit 42d0b02

Browse files
harinvadodariaharinvadodaria
committed
WL#9143: Keyring plugin for the Amazon's AWS
 Key Management service Description: This worklog introduces a new keyring plugin -keyring_aws. The plugin will communicate with Amazon's AWS Key Management Service andfetch keys that can be used by MySQL server. It will provide ability to store/fetch/remove keys from Key Management service. In addition, Plugin also introduces two UDFs which provides ability to: - Rotate Customer Master Key - Reencrypt data keys using latest Customer Master Key. Reviewed-By: Georgi Kodinov <[email protected]>
1 parent f1fe79a commit 42d0b02

28 files changed

+906
-278
lines changed

‎CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ INCLUDE(plugin)
212212
INCLUDE(install_macros)
213213
INCLUDE(install_layout)
214214
INCLUDE(mysql_add_executable)
215+
INCLUDE(curl)
215216

216217
# Handle options
217218
IF(EXISTS ${CMAKE_SOURCE_DIR}/rapid)
@@ -524,6 +525,8 @@ MYSQL_CHECK_LZ4()
524525
IF(NOT WITHOUT_SERVER)
525526
MYSQL_CHECK_PROTOBUF()
526527
ENDIF()
528+
# Try and set CURL_LIBRARY
529+
MYSQL_CHECK_CURL()
527530

528531
# Check for SYS_thread_selfid system call
529532
CHECK_C_SOURCE_COMPILES("

‎cmake/curl.cmake‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
2+
#
3+
# This program is free software; you can redistribute it and/or modify
4+
# it under the terms of the GNU General Public License as published by
5+
# the Free Software Foundation; version 2 of the License.
6+
#
7+
# This program is distributed in the hope that it will be useful,
8+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
9+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10+
# GNU General Public License for more details.
11+
#
12+
# You should have received a copy of the GNU General Public License
13+
# along with this program; if not, write to the Free Software
14+
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
15+
16+
MACRO(MYSQL_CHECK_CURL)
17+
IF(NOT WIN32)
18+
IF(WITH_CURL STREQUAL "system")
19+
# FindCURL.cmake will set
20+
# CURL_INCLUDE_DIRS - where to find curl/curl.h, etc.
21+
# CURL_LIBRARIES - List of libraries when using curl.
22+
# CURL_FOUND - True if curl found.
23+
# CURL_VERSION_STRING - the version of curl found (since CMake 2.8.8)
24+
FIND_PACKAGE(CURL)
25+
IF(CURL_FOUND)
26+
SET(CURL_LIBRARY ${CURL_LIBRARIES} CACHE PATH "Curl library")
27+
ENDIF()
28+
MESSAGE(STATUS "CURL_LIBRARY = ${CURL_LIBRARY}")
29+
ELSEIF(WITH_CURL)
30+
LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
31+
FIND_LIBRARY(CURL_LIBRARY
32+
NAMES curl
33+
PATHS ${WITH_CURL}
34+
NO_DEFAULT_PATH
35+
NO_CMAKE_ENVIRONMENT_PATH
36+
NO_SYSTEM_ENVIRONMENT_PATH
37+
)
38+
LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
39+
MESSAGE(STATUS "CURL_LIBRARY = ${CURL_LIBRARY}")
40+
ELSE()
41+
MESSAGE(STATUS
42+
"You need to set WITH_CURL. This"
43+
" variable needs to point to curl library.")
44+
ENDIF()
45+
ENDIF()
46+
ENDMACRO()

‎mysql-test/include/keyring_udf_keyring_plugin_loaded.inc‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
--replace_regex /\.dll/.so/
2-
eval create function keyring_key_store returns integer soname '$KEYRING_UDF';
3-
--replace_regex /\.dll/.so/
42
eval create function keyring_key_fetch returns string soname '$KEYRING_UDF';
53
--replace_regex /\.dll/.so/
64
eval create function keyring_key_type_fetch returns string soname '$KEYRING_UDF';
@@ -13,10 +11,6 @@ eval create function keyring_key_generate returns integer soname '$KEYRING_UDF';
1311

1412
# Error cases -- wrong argument count
1513
--error ER_CANT_INITIALIZE_UDF
16-
select keyring_key_store('Key_1');
17-
--error ER_CANT_INITIALIZE_UDF
18-
select keyring_key_store('Key_1','AES');
19-
--error ER_CANT_INITIALIZE_UDF
2014
select keyring_key_fetch('Key_1','AES');
2115
--error ER_CANT_INITIALIZE_UDF
2216
select keyring_key_type_fetch('Key_1','AES');
@@ -36,22 +30,6 @@ select keyring_key_fetch('Key_1',NULL);
3630

3731
# Error cases -- wrong argument type
3832
--error ER_CANT_INITIALIZE_UDF
39-
select keyring_key_store('Key_1','AES',123);
40-
--error ER_CANT_INITIALIZE_UDF
41-
select keyring_key_store(NULL,'AES',123);
42-
--error ER_CANT_INITIALIZE_UDF
43-
select keyring_key_store('Key_1',NULL,123);
44-
--error ER_CANT_INITIALIZE_UDF
45-
select keyring_key_store('Key_1','AES',NULL);
46-
--error ER_CANT_INITIALIZE_UDF
47-
select keyring_key_store(NULL,NULL,NULL);
48-
--error ER_CANT_INITIALIZE_UDF
49-
select keyring_key_store(1234,NULL,'53247@#$%^');
50-
--error ER_CANT_INITIALIZE_UDF
51-
select keyring_key_store(1,'AES','123');
52-
--error ER_CANT_INITIALIZE_UDF
53-
select keyring_key_store('Key_1',123,'123');
54-
--error ER_CANT_INITIALIZE_UDF
5533
select keyring_key_fetch(1);
5634
--error ER_CANT_INITIALIZE_UDF
5735
select keyring_key_fetch(NULL);
@@ -103,41 +81,20 @@ select LENGTH(@x);
10381
select keyring_key_type_fetch('Rob_AES_128');
10482
select keyring_key_length_fetch('Rob_AES_128');
10583
select keyring_key_remove('Rob_AES_128');
106-
# Store AES_128
107-
select keyring_key_store('Rob_AES_128','AES',"0123456789012345");
108-
select keyring_key_fetch('Rob_AES_128') into @x;
109-
select LENGTH(@x);
110-
select keyring_key_type_fetch('Rob_AES_128');
111-
select keyring_key_length_fetch('Rob_AES_128');
112-
select keyring_key_remove('Rob_AES_128');
11384
# Generate AES_192
11485
select keyring_key_generate('Rob_AES_192','AES',24);
11586
select keyring_key_fetch('Rob_AES_192') into @x;
11687
select LENGTH(@x);
11788
select keyring_key_type_fetch('Rob_AES_192');
11889
select keyring_key_length_fetch('Rob_AES_192');
11990
select keyring_key_remove('Rob_AES_192');
120-
# Store AES_192
121-
select keyring_key_store('Rob_AES_192','AES',"012345678901234567890%@3");
122-
select keyring_key_fetch('Rob_AES_192') into @x;
123-
select LENGTH(@x);
124-
select keyring_key_type_fetch('Rob_AES_192');
125-
select keyring_key_length_fetch('Rob_AES_192');
126-
select keyring_key_remove('Rob_AES_192');
12791
# Generate AES_256
12892
select keyring_key_generate('Rob_AES_256','AES',32);
12993
select keyring_key_fetch('Rob_AES_256') into @x;
13094
select LENGTH(@x);
13195
select keyring_key_type_fetch('Rob_AES_256');
13296
select keyring_key_length_fetch('Rob_AES_256');
13397
select keyring_key_remove('Rob_AES_256');
134-
# Store AES_256
135-
select keyring_key_store('Rob_AES_256','AES',"01234567890123456789012345678901");
136-
select keyring_key_fetch('Rob_AES_256') into @x;
137-
select LENGTH(@x);
138-
select keyring_key_type_fetch('Rob_AES_256');
139-
select keyring_key_length_fetch('Rob_AES_256');
140-
select keyring_key_remove('Rob_AES_256');
14198
# RSA
14299
# Generate RSA_1024
143100
select keyring_key_generate('Rob_RSA_1024','RSA',128);
@@ -146,13 +103,6 @@ select LENGTH(@x);
146103
select keyring_key_type_fetch('Rob_RSA_1024');
147104
select keyring_key_length_fetch('Rob_RSA_1024');
148105
select keyring_key_remove('Rob_RSA_1024');
149-
# Store RSA_1024
150-
select keyring_key_store('Rob_RSA_1024','RSA',"01234567890123456789012345678901234567890123456789012345678901230123456789012345678901234567890123456789012345678901234567890123");
151-
select keyring_key_fetch('Rob_RSA_1024') into @x;
152-
select LENGTH(@x);
153-
select keyring_key_type_fetch('Rob_RSA_1024');
154-
select keyring_key_length_fetch('Rob_RSA_1024');
155-
select keyring_key_remove('Rob_RSA_1024');
156106
#Generate RSA_2048
157107
select keyring_key_generate('Rob_RSA_2048','RSA',256);
158108
select keyring_key_fetch('Rob_RSA_2048') into @x;
@@ -175,13 +125,6 @@ select LENGTH(@x);
175125
select keyring_key_type_fetch('Rob_DSA_1024');
176126
select keyring_key_length_fetch('Rob_DSA_1024');
177127
select keyring_key_remove('Rob_DSA_1024');
178-
# Store DSA 1024
179-
select keyring_key_store('Rob_DSA_1024','DSA',"01234567890123456789012345678901234567890123456789012345678901230123456789012345678901234567890123456789012345678901234567890123");
180-
select keyring_key_fetch('Rob_DSA_1024') into @x;
181-
select LENGTH(@x);
182-
select keyring_key_type_fetch('Rob_DSA_1024');
183-
select keyring_key_length_fetch('Rob_DSA_1024');
184-
select keyring_key_remove('Rob_DSA_1024');
185128
# Generate DSA 2048
186129
select keyring_key_generate('Rob_DSA_2048','DSA',256);
187130
select keyring_key_fetch('Rob_DSA_2048') into @x;
@@ -244,13 +187,6 @@ select @x;
244187
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
245188
select keyring_key_generate('','AES', 16) into @x;
246189
select @x;
247-
# Store wrong key type
248-
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
249-
select keyring_key_store('Wrong_type','xxx', '0123456789012345') into @x;
250-
select @x;
251-
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
252-
select keyring_key_store('','AES', '0123456789012345') into @x;
253-
select @x;
254190

255191
--echo # Testing privileges
256192

‎mysql-test/include/keyring_udf_keyring_plugin_loaded_store_operations.inc‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
--replace_regex /\.dll/.so/
2+
eval create function keyring_key_store returns integer soname '$KEYRING_UDF';
3+
4+
# Error cases -- wrong argument count
5+
--error ER_CANT_INITIALIZE_UDF
6+
select keyring_key_store('Key_1');
7+
--error ER_CANT_INITIALIZE_UDF
8+
select keyring_key_store('Key_1','AES');
9+
10+
# Error cases -- wrong argument type
11+
--error ER_CANT_INITIALIZE_UDF
12+
select keyring_key_store('Key_1','AES',123);
13+
--error ER_CANT_INITIALIZE_UDF
14+
select keyring_key_store(NULL,'AES',123);
15+
--error ER_CANT_INITIALIZE_UDF
16+
select keyring_key_store('Key_1',NULL,123);
17+
--error ER_CANT_INITIALIZE_UDF
18+
select keyring_key_store('Key_1','AES',NULL);
19+
--error ER_CANT_INITIALIZE_UDF
20+
select keyring_key_store(NULL,NULL,NULL);
21+
--error ER_CANT_INITIALIZE_UDF
22+
select keyring_key_store(1234,NULL,'53247@#$%^');
23+
--error ER_CANT_INITIALIZE_UDF
24+
select keyring_key_store(1,'AES','123');
25+
--error ER_CANT_INITIALIZE_UDF
26+
select keyring_key_store('Key_1',123,'123');
27+
28+
# Store AES_128
29+
select keyring_key_store('Rob_AES_128','AES',"0123456789012345");
30+
select keyring_key_fetch('Rob_AES_128') into @x;
31+
select LENGTH(@x);
32+
select keyring_key_type_fetch('Rob_AES_128');
33+
select keyring_key_length_fetch('Rob_AES_128');
34+
select keyring_key_remove('Rob_AES_128');
35+
36+
# Store AES_192
37+
select keyring_key_store('Rob_AES_192','AES',"012345678901234567890%@3");
38+
select keyring_key_fetch('Rob_AES_192') into @x;
39+
select LENGTH(@x);
40+
select keyring_key_type_fetch('Rob_AES_192');
41+
select keyring_key_length_fetch('Rob_AES_192');
42+
select keyring_key_remove('Rob_AES_192');
43+
44+
# Store AES_256
45+
select keyring_key_store('Rob_AES_256','AES',"01234567890123456789012345678901");
46+
select keyring_key_fetch('Rob_AES_256') into @x;
47+
select LENGTH(@x);
48+
select keyring_key_type_fetch('Rob_AES_256');
49+
select keyring_key_length_fetch('Rob_AES_256');
50+
select keyring_key_remove('Rob_AES_256');
51+
52+
# Store RSA_1024
53+
select keyring_key_store('Rob_RSA_1024','RSA',"01234567890123456789012345678901234567890123456789012345678901230123456789012345678901234567890123456789012345678901234567890123");
54+
select keyring_key_fetch('Rob_RSA_1024') into @x;
55+
select LENGTH(@x);
56+
select keyring_key_type_fetch('Rob_RSA_1024');
57+
select keyring_key_length_fetch('Rob_RSA_1024');
58+
select keyring_key_remove('Rob_RSA_1024');
59+
60+
# Store DSA_1024
61+
select keyring_key_store('Rob_DSA_1024','DSA',"01234567890123456789012345678901234567890123456789012345678901230123456789012345678901234567890123456789012345678901234567890123");
62+
select keyring_key_fetch('Rob_DSA_1024') into @x;
63+
select LENGTH(@x);
64+
select keyring_key_type_fetch('Rob_DSA_1024');
65+
select keyring_key_length_fetch('Rob_DSA_1024');
66+
select keyring_key_remove('Rob_DSA_1024');
67+
68+
# Store wrong key type
69+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
70+
select keyring_key_store('Wrong_type','xxx', '0123456789012345') into @x;
71+
select @x;
72+
--error ER_KEYRING_UDF_KEYRING_SERVICE_ERROR
73+
select keyring_key_store('','AES', '0123456789012345') into @x;
74+
select @x;
75+

‎mysql-test/mysql-test-run.pl‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2607,7 +2607,6 @@ sub environment_setup {
26072607
$ENV{'MYSQL_BINDIR'}= "$bindir";
26082608
$ENV{'MYSQL_SHAREDIR'}= $path_language;
26092609
$ENV{'MYSQL_CHARSETSDIR'}= $path_charsetsdir;
2610-
26112610
if (IS_WINDOWS)
26122611
{
26132612
$ENV{'SECURE_LOAD_PATH'}= $glob_mysql_test_dir."\\std_data";

‎mysql-test/suite/auth_sec/r/keyring_file_data_qa.result‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,17 @@ PLUGIN_NAME keyring_file
1414
PLUGIN_VERSION 1.0
1515
PLUGIN_STATUS ACTIVE
1616

17-
SET @@global.keyring_file_data= 'MYSQL_TMP_DIR/keyring';
17+
SET @@global.keyring_file_data='keyring_file';
1818
SELECT @@global.keyring_file_data;
1919
@@global.keyring_file_data
20-
MYSQL_TMP_DIR/keyring
20+
keyring_file
2121
CREATE TABLE t1(c1 INT, c2 char(20)) ENCRYPTION="Y" ENGINE = InnoDB;
2222
SET @@global.keyring_file_data= 'MYSQL_TMP_DIR/new_keyring_file_data';
2323
SELECT @@global.keyring_file_data;
2424
@@global.keyring_file_data
2525
MYSQL_TMP_DIR/new_keyring_file_data
2626
SET @@global.keyring_file_data='';
2727
ERROR 42000: Variable 'keyring_file_data' can't be set to the value of ''
28-
SET @@global.keyring_file_data='#^$^@E&(';
29-
ERROR 42000: Variable 'keyring_file_data' can't be set to the value of '#^$^@E&('
3028
SET @@global.keyring_file_data=1;
3129
ERROR 42000: Incorrect argument type to variable 'keyring_file_data'
3230
SET @@global.keyring_file_data='/';

0 commit comments

Comments
 (0)