################################################################################
# InnoDB transparent tablespace data encryption for mysql.tablespace.
# For mysql.tablespace, this test will test
#    1 - Alter mysql.tablespace with
#        - and without loading keyring plugin
#        - valid/invalid encryption option
#        -ENCRYPTION='n' to ENCRYPTION='y'
#    2 - Actual encryption taking place or not
#    3 - Create/Alter table using mysql.tablespace
#    4 - Alter table part of innodb_file_per_table/general/innodb_system/mysql ts to mysql ts
#    5 - Create view using mysql.tablespace
#    6 - Delete/truncate/drop DD table part of mysql tablespace
#    7 - Changing encryption attribute of tables in mysql tablespace
#    8 - Restart with same keyring plugin option and access mysql tables
#    9 - Restart without keyring plugin option, Install plugin explicitly and alter encryption to Y
#   10 - Monitor progress of encryption in performance_schema table
#   11 - Rename/drop mysql tablespace
#   12 - Create tablespace with name as mysql
################################################################################

--source include/big_test.inc
--source include/have_debug.inc
# Disable in valgrind because of timeout, cf. Bug#22760145
--source include/not_valgrind.inc
call mtr.add_suppression("\\[ERROR\\] \\[[^]]*\\] \\[[^]]*\\] Check keyring plugin fail, please check the keyring plugin is loaded.");
call mtr.add_suppression("\\[ERROR\\].*Plugin keyring_file reported: 'keyring_file initialization failure.");
call mtr.add_suppression("\\[ERROR\\].*Plugin keyring_file reported: 'File .*keyring' not found .*");
call mtr.add_suppression("\\[ERROR\\] \\[[^]]*\\] \\[[^]]*\\] Encryption can't find master key, please check the keyring plugin is loaded.");

--echo #########
--echo # SETUP #
--echo #########
--echo

let datadir=`SELECT @@datadir`;
let search_pattern=mysql.plugin;
let ts_name=mysql.ibd;
--echo #########################################################################
--echo # START : WITHOUT KEYRING PLUGIN
--echo #########################################################################
# Alter mysql.tablespace with encryption, should fail since keyring is not
# loaded.

--error ER_CANNOT_FIND_KEY_IN_KEYRING
ALTER TABLESPACE mysql ENCRYPTION='Y';

--error ER_CANNOT_FIND_KEY_IN_KEYRING
ALTER TABLESPACE mysql ENCRYPTION='N';

--echo #########################################################################
--echo # RESTART 1 : WITH KEYRING PLUGIN
--echo #########################################################################
let $restart_parameters = restart: --early-plugin-load=keyring_file=$KEYRING_PLUGIN --loose-keyring_file_data=$MYSQL_TMP_DIR/mysql_ts_keyring $KEYRING_PLUGIN_OPT;
--source include/restart_mysqld_no_echo.inc

--echo --------------------------------------------------
--echo By Default, mysql tablespace should be unencrypted
--echo --------------------------------------------------
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';
# mysql.ibd file should be actually unencrypted
--source include/if_encrypted.inc

ALTER TABLESPACE mysql ENCRYPTION='Y';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';
# mysql.ibd file should be actually encrypted
--source include/if_encrypted.inc

--echo -----------------------------------------------------
--echo ALTER mysql TABLESPACE WITH INVALID ENCRYPTION OPTION
--echo -----------------------------------------------------
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='R';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='TRUE';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='True';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='true';
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=TRUE;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=True;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=true;
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='FALSE';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='False';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='false';
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=FALSE;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=False;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=false;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=0;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=1;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=null;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=-1;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=n;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=N;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=y;
--error ER_PARSE_ERROR
ALTER TABLESPACE mysql ENCRYPTION=Y;
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='1';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='1True';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='@';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='null';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION='';
--error ER_INVALID_ENCRYPTION_OPTION
ALTER TABLESPACE mysql ENCRYPTION="";

--echo ----------------------------------------------------
--echo ALTER MYSQL TABLESPACE WITH VALID ENCRYPTION OPTION
--echo ----------------------------------------------------
# ALTER mysql TABLESPACE WITH ENCRYPTION='Y'.
ALTER TABLESPACE mysql ENCRYPTION='Y';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION='y'.
ALTER TABLESPACE mysql ENCRYPTION='y';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION='n'.
ALTER TABLESPACE mysql ENCRYPTION='n';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION='N'.
ALTER TABLESPACE mysql ENCRYPTION='N';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

#Below SQL uses double quotes
# ALTER mysql TABLESPACE WITH ENCRYPTION="Y".
ALTER TABLESPACE mysql ENCRYPTION="Y";
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION="y".
ALTER TABLESPACE mysql ENCRYPTION="y";
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION="n".
ALTER TABLESPACE mysql ENCRYPTION="n";
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';

# ALTER mysql TABLESPACE WITH ENCRYPTION="N".
ALTER TABLESPACE mysql ENCRYPTION="N";
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';


--echo -----------------------------------------------------
--echo Create/Alter table using mysql.tablespace
--echo -----------------------------------------------------
# This should fail as mysql is a reserved tablespace
--error ER_RESERVED_TABLESPACE_NAME
CREATE TABLE t1(i int) TABLESPACE mysql;
--error ER_RESERVED_TABLESPACE_NAME
CREATE TEMPORARY TABLE t1(i int) TABLESPACE mysql;

# Alter table part of innodb_file_per_table ts to mysql ts
CREATE TABLE t1(i int);
--error ER_RESERVED_TABLESPACE_NAME
ALTER TABLE t1 TABLESPACE mysql;
DROP TABLE t1;

# Alter table part of general ts to mysql ts
CREATE TABLESPACE encrypt_ts ADD DATAFILE 'encrypt_ts.ibd' engine=INNODB;
CREATE TABLE t1(i int) TABLESPACE encrypt_ts;
--error ER_RESERVED_TABLESPACE_NAME
ALTER TABLE t1 TABLESPACE mysql;
DROP TABLE t1;

# Alter table part of innodb_system to mysql ts
CREATE TABLE t1(i int) TABLESPACE innodb_system;
--error ER_RESERVED_TABLESPACE_NAME
ALTER TABLE t1 TABLESPACE mysql;
DROP TABLE t1;

# Alter table part of mysql ts to mysql ts
# This should be successful
ALTER TABLE mysql.component TABLESPACE mysql;

# Alter temporary table to mysql ts
CREATE TEMPORARY TABLE t1(i int);
--error ER_RESERVED_TABLESPACE_NAME
ALTER TABLE t1 TABLESPACE mysql;
DROP TABLE t1;

--echo -----------------------------------------------------
--echo Create view using mysql.tablespace
--echo -----------------------------------------------------
# This should throw parse error as view does not support tablespace attribute
CREATE TABLE t1(i int);
INSERT INTO t1 VALUES(1);
INSERT INTO t1 SELECT * FROM t1;
INSERT INTO t1 SELECT * FROM t1;
INSERT INTO t1 SELECT * FROM t1;
INSERT INTO t1 SELECT * FROM t1;
--error ER_PARSE_ERROR
CREATE VIEW v1 AS SELECT * FROM t1 TABLESPACE mysql;
DROP TABLE t1;

--echo ------------------------------------------------------------
--echo Alter DD table part of mysql.tablespace to other tablespaces
--echo ------------------------------------------------------------
# This should fail as access to DD table is not allowed
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_file_per_table ENCRYPTION='Y';
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_file_per_table;
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_temporary ENCRYPTION='Y';
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_temporary;
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_system ENCRYPTION='Y';
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE innodb_system;
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE encrypt_ts ENCRYPTION='Y';
--error ER_NO_SYSTEM_TABLE_ACCESS
ALTER TABLE mysql.events TABLESPACE encrypt_ts;
DROP TABLESPACE encrypt_ts;

--echo -------------------------------------------------------
--echo  Delete/truncate/drop DD table part of mysql tablespace
--echo -------------------------------------------------------
# Access should be denied
--error ER_NO_SYSTEM_TABLE_ACCESS
DELETE FROM mysql.events;
--error ER_NO_SYSTEM_TABLE_ACCESS
TRUNCATE TABLE mysql.events;
--error ER_NO_SYSTEM_TABLE_ACCESS
DROP TABLE mysql.events;

--echo --------------------------------------------------
--echo Alter encryption of table part of mysql tablespace
--echo --------------------------------------------------
# Changing encryption at table level should not be permitted
--error ER_INVALID_ENCRYPTION_REQUEST
ALTER TABLE mysql.component ENCRYPTION='Y';
--error ER_INVALID_ENCRYPTION_REQUEST
ALTER TABLE mysql.component ENCRYPTION='y';
ALTER TABLE mysql.component ENCRYPTION='N';
ALTER TABLE mysql.component ENCRYPTION='n';

--echo ---------------------------------------------------------------------
--echo Metadata for a table in mysql ts should not show encryption attribute
--echo ---------------------------------------------------------------------
SHOW CREATE TABLE mysql.plugin;


--echo -------------------
--echo Drop mysql database
--echo -------------------
--error ER_NO_SYSTEM_SCHEMA_ACCESS
DROP DATABASE mysql;

--echo -----------------------------------------------------
--echo Other DDL operation not allowed on 'mysql' tablespace
--echo -----------------------------------------------------
--error ER_WRONG_TABLESPACE_NAME
CREATE TABLESPACE mysql ADD DATAFILE 'mysql.ibd' ENGINE=INNODB;

--error ER_WRONG_TABLESPACE_NAME
DROP TABLESPACE mysql;

--error ER_WRONG_TABLESPACE_NAME
ALTER TABLESPACE mysql RENAME TO xyz;

--error ER_TABLESPACE_ENGINE_MISMATCH
ALTER TABLESPACE mysql ENGINE=myisam;

--error ER_TABLESPACE_ENGINE_MISMATCH
ALTER TABLESPACE mysql ENGINE=memory;

--echo #########################################################################
--echo # Restart with same keyring plugin option
--echo #   - tables in mysql ts should be accessible
--echo #########################################################################
ALTER TABLESPACE mysql ENCRYPTION='Y';
let $restart_parameters = restart: --early-plugin-load="keyring_file=$KEYRING_PLUGIN" --loose-keyring_file_data=$MYSQL_TMP_DIR/mysql_ts_keyring $KEYRING_PLUGIN_OPT;
--source include/restart_mysqld_no_echo.inc
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';
SELECT help_keyword_id FROM mysql.help_keyword ORDER BY help_keyword_id LIMIT 2;


ALTER TABLESPACE mysql ENCRYPTION='N';
--echo #########################################################################
--echo # Restart without keyring plugin option
--echo #   - Install plugin explicitly and alter encryption to Y
--echo #########################################################################
let $restart_parameters = restart: ;
--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR $KEYRING_PLUGIN_OPT --plugin-dir=KEYRING_PLUGIN_PATH $KEYRING_PLUGIN keyring_file.so
--source include/restart_mysqld.inc
--disable_warnings
--replace_regex /\.dll/.so/
eval INSTALL PLUGIN keyring_file SONAME '$KEYRING_PLUGIN';
--enable_warnings
--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
eval SET @@global.keyring_file_data='$MYSQL_TMP_DIR/mysql_ts_keyring';
--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
SELECT @@global.keyring_file_data;
ALTER TABLESPACE mysql ENCRYPTION='Y';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';
--replace_regex /\.dll/.so/
UNINSTALL PLUGIN keyring_file;
--error ER_CANNOT_FIND_KEY_IN_KEYRING
ALTER INSTANCE ROTATE INNODB MASTER KEY;

--echo #########################################################################
--echo # Restart with keyring plugin
--echo #   - monitor progress of encryption in performance_schema table
--echo #########################################################################
let $restart_parameters = restart: --early-plugin-load="keyring_file=$KEYRING_PLUGIN" --loose-keyring_file_data=$MYSQL_TMP_DIR/mysql_ts_keyring $KEYRING_PLUGIN_OPT;
--source include/restart_mysqld_no_echo.inc
ALTER TABLESPACE mysql ENCRYPTION='N';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES where NAME='mysql';
--echo # Set Encryption process to wait after page 5 so that we can monitor
--echo # progress in performance_schema table
SET DEBUG_SYNC = 'alter_encrypt_tablespace_wait_after_page5 SIGNAL s1 WAIT_FOR s2';

let $con_default_thread_id= `select THREAD_ID from performance_schema.threads
                                where PROCESSLIST_ID = connection_id()`;

--send
ALTER TABLESPACE mysql ENCRYPTION='Y';
--echo # Monitoring connection
connect(con1, localhost, root,,);
--connection con1
SET DEBUG_SYNC = 'now WAIT_FOR s1';

--echo # Wait for Encryption progress monitoring to appear in PFS table
let $wait_condition = SELECT COUNT(*) = 1
        FROM performance_schema.events_stages_current
        WHERE EVENT_NAME='stage/innodb/alter tablespace (encryption)';
--source include/wait_condition.inc

--echo # Wait for some progress to appear in PFS table
let $wait_condition = SELECT WORK_COMPLETED > 0
    FROM performance_schema.events_stages_current
    WHERE EVENT_NAME='stage/innodb/alter tablespace (encryption)';
--source include/wait_condition.inc

# Verify the expected progress seen in PFS table
select WORK_COMPLETED
    FROM performance_schema.events_stages_current
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)';

# Let the encryption processing continue
SET DEBUG_SYNC = 'now SIGNAL s2';

--echo # Default connection
--connection default
--reap

--echo # Once done, select count from PFS tables
SELECT COUNT(*)
    FROM performance_schema.events_stages_current
    WHERE EVENT_NAME='stage/innodb/alter tablespace (encryption)';

SELECT COUNT(*)
    FROM performance_schema.events_stages_history
    WHERE EVENT_NAME='stage/innodb/alter tablespace (encryption)';

SELECT COUNT(*)
    FROM performance_schema.events_stages_history_long
    WHERE EVENT_NAME='stage/innodb/alter tablespace (encryption)';

SELECT COUNT(*)
    FROM performance_schema.events_stages_summary_global_by_event_name
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)' AND
    COUNT_STAR>0;

--disable_query_log
eval SELECT COUNT(*)
    FROM performance_schema.events_stages_summary_by_thread_by_event_name
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)' AND
    THREAD_ID=$con_default_thread_id;
--enable_query_log

SELECT COUNT(*)
    FROM performance_schema.events_stages_summary_by_user_by_event_name
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)' AND
    COUNT_STAR>0;

SELECT COUNT(*)
    FROM performance_schema.events_stages_summary_by_host_by_event_name
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)' AND
    COUNT_STAR>0;

SELECT COUNT(*)
    FROM performance_schema.events_stages_summary_by_account_by_event_name
    WHERE EVENT_NAME = 'stage/innodb/alter tablespace (encryption)' AND
    COUNT_STAR>0;

--echo # Check that Encryption done successfully.
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES
    WHERE NAME='mysql';
SELECT help_keyword_id FROM mysql.help_keyword ORDER BY help_keyword_id LIMIT 2;

--echo ###########
--echo # Cleanup #
--echo ###########
--disconnect con1
 # Unencrypt tablespace
ALTER TABLESPACE mysql ENCRYPTION='N';
SELECT NAME, ENCRYPTION FROM INFORMATION_SCHEMA.INNODB_TABLESPACES WHERE NAME='mysql';

remove_file $MYSQL_TMP_DIR/mydummy_key;
remove_file $MYSQL_TMP_DIR/mysql_ts_keyring;
remove_file $MYSQLTEST_VARDIR/tmpfile.txt;

--echo #########################################################################
--echo # RESTART : WITHOUT KEYRING PLUGIN
--echo #########################################################################
let $restart_parameters = restart: ;
--source include/restart_mysqld.inc