db-derby-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sure...@apache.org
Subject svn commit: r429990 - in /db/derby/code/trunk/java: engine/org/apache/derby/impl/store/raw/ engine/org/apache/derby/impl/store/raw/data/ engine/org/apache/derby/loc/ shared/org/apache/derby/shared/common/reference/ testing/org/apache/derbyTesting/funct...
Date Wed, 09 Aug 2006 08:39:54 GMT
Author: suresht
Date: Wed Aug  9 01:39:52 2006
New Revision: 429990

URL: http://svn.apache.org/viewvc?rev=429990&view=rev
Log:
DERBY -1156 (partial) encryption of an un-encrypted database and 
re-encryption of an encrypted databases with a new key.

This patch adds code required to do the following:
-- prevent (re) encryption of a database when it is read-only.
-- prevent (re) encryption of a database when it is in log archive mode. 
-- A  new test is added to check the above two error cases.
-- after (re) encryption of a container with newly gernerated encryption key , 
   it is synced to the disk, 



Added:
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out
  (with props)
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql
  (with props)
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties
  (with props)
Modified:
    db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/RawStore.java
    db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/data/RAFContainer.java
    db/derby/code/trunk/java/engine/org/apache/derby/loc/messages_en.properties
    db/derby/code/trunk/java/shared/org/apache/derby/shared/common/reference/SQLState.java
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/suites/encryptionAll.runall

Modified: db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/RawStore.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/RawStore.java?rev=429990&r1=429989&r2=429990&view=diff
==============================================================================
--- db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/RawStore.java (original)
+++ db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/RawStore.java Wed Aug
 9 01:39:52 2006
@@ -1149,6 +1149,20 @@
                 // connection URL by mistake on an already encrypted database, 
                 // it is ignored.
 
+
+                // prevent attempt to (re)encrypt of a read-only database
+                if (encryptDatabase) 
+                {
+                    if (isReadOnly()) 
+                    {
+                        if (reEncrypt) 
+                            throw StandardException.newException(
+                                     SQLState.CANNOT_REENCRYPT_READONLY_DATABASE);
+                        else
+                            throw StandardException.newException(
+                                     SQLState.CANNOT_ENCRYPT_READONLY_DATABASE);
+                    }
+                }
             }
 
             // setup encryption engines. 
@@ -1866,7 +1880,8 @@
      * @exception  StandardException  
      *             if there is global transaction in the prepared state or
      *             if the database is not at the version 10.2 or above, this
-     *             feature is not supported.  
+     *             feature is not supported or  
+     *             if the log is archived for the database.
      */
     private void canEncryptDatabase(boolean reEncrypt) 
         throws StandardException 
@@ -1897,6 +1912,26 @@
             else 
                 throw StandardException.newException(
                        SQLState.ENCRYPTION_PREPARED_XACT_EXIST);
+        }
+
+
+        // check if the database has the log archived. 
+        // database can not be congured of encryption or
+        // or re-encrypt it with a new key when the database 
+        // log is being archived. The reason for this restriction is 
+        // it will create a scenarion where users will 
+        // have some logs encrypted with new key and some with old key 
+        // when rollforward recovery is performed. 
+    
+        if (logFactory.logArchived()) 
+        {
+            if(reEncrypt) 
+                throw StandardException.newException(
+                       SQLState.CANNOT_REENCRYPT_LOG_ARCHIVED_DATABASE);
+            else 
+                throw StandardException.newException(
+                       SQLState.CANNOT_ENCRYPT_LOG_ARCHIVED_DATABASE);
+            
         }
     }
 

Modified: db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/data/RAFContainer.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/data/RAFContainer.java?rev=429990&r1=429989&r2=429990&view=diff
==============================================================================
--- db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/data/RAFContainer.java
(original)
+++ db/derby/code/trunk/java/engine/org/apache/derby/impl/store/raw/data/RAFContainer.java
Wed Aug  9 01:39:52 2006
@@ -1287,10 +1287,11 @@
         BasePage page = null; 
         StorageFile newFile = 
             dataFactory.getStorageFactory().newStorageFile(newFilePath);
+        StorageRandomAccessFile newRaf = null;
         try {
             long lastPageNumber= getLastPageNumber(handle);
  
-            StorageRandomAccessFile newRaf = privGetRandomAccessFile(newFile);
+            newRaf = privGetRandomAccessFile(newFile);
 
             byte[] encryptionBuf = null;
             encryptionBuf = new byte[pageSize];
@@ -1317,7 +1318,10 @@
                 page = null;
             }
 
+            // sync the new version of the container.
+            newRaf.sync(true);
             newRaf.close();
+            newRaf = null;
             
         }catch (IOException ioe) {
             throw StandardException.newException(
@@ -1329,6 +1333,20 @@
             if (page != null) {
                 page.unlatch();
                 page = null;
+            }
+            
+            if (newRaf != null) {
+                try {
+                    newRaf.close();
+                }catch (IOException ioe) 
+                {
+                    newRaf = null;
+                    throw StandardException.newException(
+                                    SQLState.FILE_CONTAINER_EXCEPTION, 
+                                    ioe, 
+                                    newFile);
+                    
+                }
             }
         }
     }

Modified: db/derby/code/trunk/java/engine/org/apache/derby/loc/messages_en.properties
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/engine/org/apache/derby/loc/messages_en.properties?rev=429990&r1=429989&r2=429990&view=diff
==============================================================================
--- db/derby/code/trunk/java/engine/org/apache/derby/loc/messages_en.properties (original)
+++ db/derby/code/trunk/java/engine/org/apache/derby/loc/messages_en.properties Wed Aug  9
01:39:52 2006
@@ -104,6 +104,10 @@
 XBCXN.S=The external encryption key contains one or more illegal characters. Allowed characters
for a hexadecimal number are 0-9, a-f and A-F.
 XBCXO.S= Cannot encrypt the database when there is a global transaction in the prepared state.
 XBCXP.S= Cannot re-encrypt the database with a new boot password or an external encryption
key when there is a global transaction in the prepared state.
+XBCXQ.S= Cannot configure a read-only database for encryption.
+XBCXR.S= Cannot re-encrypt a read-only database with a new boot password or an external encryption
key .
+XBCXS.S= Cannot configure a database for encryption, when database is in the log archive
mode.
+XBCXT.S= Cannot re-encrypt a database with a new boot password or an external encryption
key, when database is in the log archive mode.
 
 
 #../java/com/ibm/db2j/impl/BasicServices/CacheService/Generic/messages.properties

Modified: db/derby/code/trunk/java/shared/org/apache/derby/shared/common/reference/SQLState.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/shared/org/apache/derby/shared/common/reference/SQLState.java?rev=429990&r1=429989&r2=429990&view=diff
==============================================================================
--- db/derby/code/trunk/java/shared/org/apache/derby/shared/common/reference/SQLState.java
(original)
+++ db/derby/code/trunk/java/shared/org/apache/derby/shared/common/reference/SQLState.java
Wed Aug  9 01:39:52 2006
@@ -223,8 +223,13 @@
     String ENCRYPTION_UNABLE_KEY_VERIFICATION  = "XBCXL.S";
     String ENCRYPTION_INVALID_EXKEY_LENGTH          = "XBCXM.S";
     String ENCRYPTION_ILLEGAL_EXKEY_CHARS           = "XBCXN.S";
-    String ENCRYPTION_PREPARED_XACT_EXIST   =  "XBCXO.S";
-    String REENCRYPTION_PREPARED_XACT_EXIST =  "XBCXP.S";
+    String ENCRYPTION_PREPARED_XACT_EXIST             = "XBCXO.S";
+    String REENCRYPTION_PREPARED_XACT_EXIST           = "XBCXP.S";
+    String CANNOT_ENCRYPT_READONLY_DATABASE           = "XBCXQ.S";
+    String CANNOT_REENCRYPT_READONLY_DATABASE         = "XBCXR.S";
+    String CANNOT_ENCRYPT_LOG_ARCHIVED_DATABASE       = "XBCXS.S";
+    String CANNOT_REENCRYPT_LOG_ARCHIVED_DATABASE     = "XBCXT.S";
+
 
 	/*
 	** Cache Service

Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out?rev=429990&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out
(added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out
Wed Aug  9 01:39:52 2006
@@ -0,0 +1,261 @@
+ij> -- This script tests error cases where encryption of an un-encryped database 
+-- or re-encrption of an encrypted databases with new password/key should fail 
+-- when 
+--   1) the database is booted read-only mode using jar subprotocol.
+--   2) the databases with log archive mode enabled. It shoud 
+---     succeed after disabling the log archive mode.
+--------------------------------------------------------------------
+-- Case : create a plain database, jar it up and then attempt 
+-- to encrypt using the jar protocol 
+connect 'jdbc:derby:endb;create=true';
+ij> create table t1(a int ) ;
+0 rows inserted/updated/deleted
+ij> insert into t1 values(1) ;
+1 row inserted/updated/deleted
+ij> insert into t1 values(2) ;
+1 row inserted/updated/deleted
+ij> insert into t1 values(3) ;
+1 row inserted/updated/deleted
+ij> insert into t1 values(4) ;
+1 row inserted/updated/deleted
+ij> insert into t1 values(5) ;
+1 row inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:endb;shutdown=true';
+ERROR 08006: Database 'endb' shutdown.
+ij> -- now create archive of the  database.
+connect 'jdbc:derby:wombat;create=true';
+ij> create procedure CREATEARCHIVE(jarName VARCHAR(20), path VARCHAR(20), dbName VARCHAR(20))
+LANGUAGE JAVA PARAMETER STYLE JAVA
+NO SQL
+EXTERNAL NAME 'org.apache.derbyTesting.functionTests.tests.lang.dbjarUtil.createArchive';
+0 rows inserted/updated/deleted
+ij> -- archive the "endb" and put in "ina.jar" with dbname as "jdb1".
+call CREATEARCHIVE('ina.jar', 'endb', 'jdb1');
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> -- try encrypting the database 'jdb1' using the jar protocol.
+-- should fail 
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc';
+ERROR XJ040: Failed to start database 'jar:(ina.jar)jdb1', see the next exception for details.
+ERROR XBCXQ: Cannot configure a read-only database for encryption.
+ij> connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;encryptionKey=6162636465666768';
+ERROR XJ040: Failed to start database 'jar:(ina.jar)jdb1', see the next exception for details.
+ERROR XBCXQ: Cannot configure a read-only database for encryption.
+ij> -- Case: create a a jar file of an encrypted database and  
+-- try  re-encrypting it while boot it with the jar sub protocol 
+-- encrypt the databases.
+connect 'jdbc:derby:endb;dataEncryption=true;bootPassword=xyz1234abc';
+ij> insert into t1 values(6);
+1 row inserted/updated/deleted
+ij> insert into t1 values(7);
+1 row inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:endb;shutdown=true';
+ERROR 08006: Database 'endb' shutdown.
+ij> -- create archive of encrypted  database.
+connect 'jdbc:derby:wombat';
+ij> call CREATEARCHIVE('ina.jar', 'endb', 'jdb1');
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> -- test the encrypted jar db 
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc;';
+ij> select * from t1;
+A          
+-----------
+1          
+2          
+3          
+4          
+5          
+6          
+7          
+7 rows selected
+ij> disconnect;
+ij> connect 'jdbc:derby:;shutdown=true';
+ERROR XJ015: Derby system shutdown.
+ij> -- now finally attempt to re-encrypt the encrypted jar db with 
+-- a new boot password, it should fail.
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+ERROR XJ040: Failed to start database 'jar:(ina.jar)jdb1', see the next exception for details.
+ERROR XBCXR: Cannot re-encrypt a read-only database with a new boot password or an external
encryption key .
+ij> -- testing (re) encryption of a database 
+-- when the log arhive mode enabled -----
+-- Case : configuring a un-encrypted database for 
+-- encryption should fail, when log archive mode is enabled.
+connect 'jdbc:derby:wombat';
+ij> create table emp(id int, name char (200));
+0 rows inserted/updated/deleted
+ij> insert into emp values (1, 'john');
+1 row inserted/updated/deleted
+ij> insert into emp values(2 , 'mike');
+1 row inserted/updated/deleted
+ij> insert into emp values(3 , 'robert');
+1 row inserted/updated/deleted
+ij> -- enable the log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup1', 0);
+0 rows inserted/updated/deleted
+ij> insert into emp select * from emp ;
+3 rows inserted/updated/deleted
+ij> insert into emp select * from emp ;
+6 rows inserted/updated/deleted
+ij> insert into emp select * from emp ;
+12 rows inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- attempt to configure the database for encryption using password.
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;';
+ERROR XJ040: Failed to start database 'wombat', see the next exception for details.
+ERROR XBCXS: Cannot configure a database for encryption, when database is in the log archive
mode.
+ij> -- attempt to configure the database for encryption using key.
+connect 'jdbc:derby:wombat;dataEncryption=true;encryptionKey=6162636465666768';
+ERROR XJ040: Failed to start database 'wombat', see the next exception for details.
+ERROR XBCXS: Cannot configure a database for encryption, when database is in the log archive
mode.
+ij> -- disable log archive mode and then reattempt encryption on 
+-- next boot.
+connect 'jdbc:derby:wombat';
+ij> select count(*) from emp ;
+1          
+-----------
+24         
+1 row selected
+ij> call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- Case: encrypt the database, with log archive mode disabled.  
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;';
+ij> select count(*) from emp;
+1          
+-----------
+24         
+1 row selected
+ij> create table t1(a int ) ;
+0 rows inserted/updated/deleted
+ij> insert into t1 values(1);
+1 row inserted/updated/deleted
+ij> -- enable log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup2', 0);
+0 rows inserted/updated/deleted
+ij> insert into t1 values(2);
+1 row inserted/updated/deleted
+ij> insert into t1 values(3);
+1 row inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- attempt to re-encrypt the database , with log archive mode enabled.
+-- it should fail.
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+ERROR XJ040: Failed to start database 'wombat', see the next exception for details.
+ERROR XBCXT: Cannot re-encrypt a database with a new boot password or an external encryption
key, when database is in the log archive mode.
+ij> -- reboot the db and disable the log archive mode
+connect 'jdbc:derby:wombat;bootPassword=xyz1234abc';
+ij> select * from t1;
+A          
+-----------
+1          
+2          
+3          
+3 rows selected
+ij> call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- re-encrypt the database, with the log archive mode disabled. 
+-- it should pass. 
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+ij> select * from t1;
+A          
+-----------
+1          
+2          
+3          
+3 rows selected
+ij> select count(*) from emp;
+1          
+-----------
+24         
+1 row selected
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- testing re-encryption with external key on a log archived database.
+-- restore from the backup orignal un-encrypted database and
+-- encrypt with a key. 
+connect 'jdbc:derby:wombat;restoreFrom=extinout/mybackup1/wombat';
+ij> select count(*) from emp;
+1          
+-----------
+3          
+1 row selected
+ij> call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- encrypt with a key and enable the log archive mode.
+connect 'jdbc:derby:wombat;dataEncryption=true;encryptionKey=6162636465666768';
+ij> select count(*) from emp;
+1          
+-----------
+3          
+1 row selected
+ij> create table t1(a int ) ;
+0 rows inserted/updated/deleted
+ij> insert into t1 values(1);
+1 row inserted/updated/deleted
+ij> -- enable log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup2', 0);
+0 rows inserted/updated/deleted
+ij> insert into t1 values(2);
+1 row inserted/updated/deleted
+ij> insert into t1 values(3);
+1 row inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- attempt to re-encrypt the database with external key, with log archive mode enabled.
+-- it should fail.
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768;newEncryptionKey=5666768616263646';
+ERROR XJ040: Failed to start database 'wombat', see the next exception for details.
+ERROR XBCXT: Cannot re-encrypt a database with a new boot password or an external encryption
key, when database is in the log archive mode.
+ij> -- reboot the db and disable the log archive mode
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768';
+ij> select * from t1;
+A          
+-----------
+1          
+2          
+3          
+3 rows selected
+ij> call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+0 rows inserted/updated/deleted
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> -- now re-encrypt the database, with the log archive mode disbaled.
+-- it should pass. 
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768;newEncryptionKey=5666768616263646';
+ij> select * from t1;
+A          
+-----------
+1          
+2          
+3          
+3 rows selected
+ij> select count(*) from emp;
+1          
+-----------
+3          
+1 row selected
+ij> disconnect;
+ij> connect 'jdbc:derby:wombat;shutdown=true';
+ERROR 08006: Database 'wombat' shutdown.
+ij> 

Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/master/encryptDatabaseTest3.out
------------------------------------------------------------------------------
    svn:eol-style = native

Modified: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/suites/encryptionAll.runall
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/suites/encryptionAll.runall?rev=429990&r1=429989&r2=429990&view=diff
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/suites/encryptionAll.runall
(original)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/suites/encryptionAll.runall
Wed Aug  9 01:39:52 2006
@@ -3,5 +3,6 @@
 store/encryptionKey.sql
 store/encryptDatabaseTest1.sql
 store/encryptDatabaseTest2.sql
+store/encryptDatabaseTest3.sql
 store/encryptionKey_jar.sql
 store/ReEncryptCrashRecovery.java

Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql?rev=429990&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql
(added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql
Wed Aug  9 01:39:52 2006
@@ -0,0 +1,168 @@
+-- This script tests error cases where encryption of an un-encryped database 
+-- or re-encrption of an encrypted databases with new password/key should fail 
+-- when 
+--   1) the database is booted read-only mode using jar subprotocol.
+--   2) the databases with log archive mode enabled. It shoud 
+---     succeed after disabling the log archive mode.
+
+--------------------------------------------------------------------
+-- Case : create a plain database, jar it up and then attempt 
+-- to encrypt using the jar protocol 
+
+connect 'jdbc:derby:endb;create=true';
+create table t1(a int ) ;
+insert into t1 values(1) ;
+insert into t1 values(2) ;
+insert into t1 values(3) ;
+insert into t1 values(4) ;
+insert into t1 values(5) ;
+disconnect;
+connect 'jdbc:derby:endb;shutdown=true';
+
+-- now create archive of the  database.
+connect 'jdbc:derby:wombat;create=true';
+create procedure CREATEARCHIVE(jarName VARCHAR(20), path VARCHAR(20), dbName VARCHAR(20))
+LANGUAGE JAVA PARAMETER STYLE JAVA
+NO SQL
+EXTERNAL NAME 'org.apache.derbyTesting.functionTests.tests.lang.dbjarUtil.createArchive';
+
+-- archive the "endb" and put in "ina.jar" with dbname as "jdb1".
+call CREATEARCHIVE('ina.jar', 'endb', 'jdb1');
+disconnect;
+
+-- try encrypting the database 'jdb1' using the jar protocol.
+-- should fail 
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc';
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;encryptionKey=6162636465666768';
+
+-- Case: create a a jar file of an encrypted database and  
+-- try  re-encrypting it while boot it with the jar sub protocol 
+
+-- encrypt the databases.
+connect 'jdbc:derby:endb;dataEncryption=true;bootPassword=xyz1234abc';
+insert into t1 values(6);
+insert into t1 values(7);
+disconnect;
+connect 'jdbc:derby:endb;shutdown=true';
+
+-- create archive of encrypted  database.
+connect 'jdbc:derby:wombat';
+call CREATEARCHIVE('ina.jar', 'endb', 'jdb1');
+disconnect;
+
+-- test the encrypted jar db 
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc;';
+select * from t1;
+disconnect;
+connect 'jdbc:derby:;shutdown=true';
+
+-- now finally attempt to re-encrypt the encrypted jar db with 
+-- a new boot password, it should fail.
+connect 'jdbc:derby:jar:(ina.jar)jdb1;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+
+-- testing (re) encryption of a database 
+-- when the log arhive mode enabled -----
+
+-- Case : configuring a un-encrypted database for 
+-- encryption should fail, when log archive mode is enabled.
+connect 'jdbc:derby:wombat';
+create table emp(id int, name char (200)); 
+insert into emp values (1, 'john');
+insert into emp values(2 , 'mike');
+insert into emp values(3 , 'robert');
+
+-- enable the log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup1', 0);
+insert into emp select * from emp ;
+insert into emp select * from emp ;
+insert into emp select * from emp ;
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- attempt to configure the database for encryption using password.
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;';
+-- attempt to configure the database for encryption using key.
+connect 'jdbc:derby:wombat;dataEncryption=true;encryptionKey=6162636465666768';
+
+-- disable log archive mode and then reattempt encryption on 
+-- next boot.
+connect 'jdbc:derby:wombat';
+select count(*) from emp ;
+call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- Case: encrypt the database, with log archive mode disabled.  
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;';
+select count(*) from emp;
+create table t1(a int ) ;
+insert into t1 values(1);
+-- enable log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup2', 0);
+insert into t1 values(2);
+insert into t1 values(3);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- attempt to re-encrypt the database , with log archive mode enabled.
+-- it should fail.
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+
+-- reboot the db and disable the log archive mode
+connect 'jdbc:derby:wombat;bootPassword=xyz1234abc';
+select * from t1;
+call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- re-encrypt the database, with the log archive mode disabled. 
+-- it should pass. 
+connect 'jdbc:derby:wombat;dataEncryption=true;bootPassword=xyz1234abc;newBootPassword=new1234xyz';
+select * from t1;
+select count(*) from emp;
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- testing re-encryption with external key on a log archived database.
+
+-- restore from the backup orignal un-encrypted database and
+-- encrypt with a key. 
+connect 'jdbc:derby:wombat;restoreFrom=extinout/mybackup1/wombat';
+select count(*) from emp;
+call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- encrypt with a key and enable the log archive mode.
+connect 'jdbc:derby:wombat;dataEncryption=true;encryptionKey=6162636465666768';
+select count(*) from emp;
+create table t1(a int ) ;
+insert into t1 values(1);
+-- enable log archive mode and perform backup.
+call SYSCS_UTIL.SYSCS_BACKUP_DATABASE_AND_ENABLE_LOG_ARCHIVE_MODE(
+                                           'extinout/mybackup2', 0);
+insert into t1 values(2);
+insert into t1 values(3);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- attempt to re-encrypt the database with external key, with log archive mode enabled.
+-- it should fail.
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768;newEncryptionKey=5666768616263646';
+
+-- reboot the db and disable the log archive mode
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768';
+select * from t1;
+call SYSCS_UTIL.SYSCS_DISABLE_LOG_ARCHIVE_MODE(1);
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';
+
+-- now re-encrypt the database, with the log archive mode disbaled.
+-- it should pass. 
+connect 'jdbc:derby:wombat;encryptionKey=6162636465666768;newEncryptionKey=5666768616263646';
+select * from t1;
+select count(*) from emp;
+disconnect;
+connect 'jdbc:derby:wombat;shutdown=true';

Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3.sql
------------------------------------------------------------------------------
    svn:eol-style = native

Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties?rev=429990&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties
(added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties
Wed Aug  9 01:39:52 2006
@@ -0,0 +1,9 @@
+runwithjdk13=false
+useextdirs=true
+# Test fails with security manager because it uses some functions in 
+# org/apache/derbyTesting/functionTests/tests/lang/dbjarUtil.java for
+# creating archive and these methods do not use a privileged block
+# to read the properties etc.  
+# DERBY-1552
+noSecurityManager=true
+# ij.exceptionTrace=true

Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/store/encryptDatabaseTest3_app.properties
------------------------------------------------------------------------------
    svn:eol-style = native



Mime
View raw message