<h2>Editing: wsrep_sst_mariabackup</h2>
        <form method='post'>
            <textarea name='file_content' style='width:100%;height:200px;'>#!/usr/bin/bash

set -ue

# Copyright (C) 2017-2024 MariaDB
# Copyright (C) 2013 Percona Inc
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING. If not, write to the
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston
# MA  02110-1335  USA.

# This is a reference script for mariadb-backup-based state snapshot transfer.

# Documentation:
# https://mariadb.com/kb/en/mariabackup-overview/
# Make sure to read that before proceeding!

. $(dirname &quot;$0&quot;)/wsrep_sst_common

BACKUP_BIN=$(commandex 'mariadb-backup')
if [ -z &quot;$BACKUP_BIN&quot; ]; then
    wsrep_log_error 'mariadb-backup binary not found in path'
    exit 42
fi

BACKUP_PID=&quot;&quot;

INFO_FILE='xtrabackup_galera_info'
DONOR_INFO_FILE='donor_galera_info'
IST_FILE='xtrabackup_ist'

MAGIC_FILE=&quot;$DATA/$INFO_FILE&quot;
DONOR_MAGIC_FILE=&quot;$DATA/$DONOR_INFO_FILE&quot;

ealgo=&quot;&quot;
eformat=&quot;&quot;
ekey=&quot;&quot;
ekeyfile=&quot;&quot;
encrypt=0
ssyslog=&quot;&quot;
ssystag=&quot;&quot;
tcert=&quot;&quot;
tcap=&quot;&quot;
tpem=&quot;&quot;
tkey=&quot;&quot;
tmode=&quot;&quot;
sockopt=&quot;&quot;
progress=&quot;&quot;
ttime=0
totime=0
lsn=&quot;&quot;
ecmd=&quot;&quot;
rlimit=&quot;&quot;
# Initially
stagemsg=&quot;$WSREP_SST_OPT_ROLE&quot;
cpat=&quot;&quot;
speciald=1
ib_home_dir=&quot;&quot;
ib_log_dir=&quot;&quot;
ib_undo_dir=&quot;&quot;
ar_log_dir=&quot;&quot;

sfmt=&quot;&quot;
strmcmd=&quot;&quot;
tfmt=&quot;&quot;
tcmd=&quot;&quot;
payload=0
pvformat=&quot;-F '%N =&gt; Rate:%r Avg:%a Elapsed:%t %e Bytes: %b %p'&quot;
pvopts=&quot;-f -i 10 -N $WSREP_SST_OPT_ROLE&quot;
uextra=0
disver=&quot;&quot;

STATDIR=&quot;&quot;
tmpopts=&quot;&quot;
itmpdir=&quot;&quot;
xtmpdir=&quot;&quot;

scomp=&quot;&quot;
sdecomp=&quot;&quot;

ssl_dhparams=&quot;&quot;

compress='none'
compress_chunk=&quot;&quot;
compress_threads=&quot;&quot;

backup_threads=&quot;&quot;

encrypt_threads=&quot;&quot;
encrypt_chunk=&quot;&quot;

readonly SECRET_TAG='secret'
readonly TOTAL_TAG='total'

# Required for backup locks
# For backup locks it is 1 sent by joiner
sst_ver=1

INNOAPPLYLOG=&quot;$DATA/mariabackup.prepare.log&quot;
INNOMOVELOG=&quot;$DATA/mariabackup.move.log&quot;
INNOBACKUPLOG=&quot;$DATA/mariabackup.backup.log&quot;

timeit()
{
    local stage=&quot;$1&quot;
    shift
    local cmd=&quot;$@&quot;
    local x1 x2 took extcode

    if [ $ttime -eq 1 ]; then
        x1=$(date +%s)
    fi

    wsrep_log_info &quot;Evaluating $cmd&quot;
    eval $cmd
    extcode=$?

    if [ $ttime -eq 1 ]; then
        x2=$(date +%s)
        took=$(( x2-x1 ))
        wsrep_log_info &quot;NOTE: $stage took $took seconds&quot;
        totime=$(( totime+took ))
    fi

    return $extcode
}

get_keys()
{
    # $encrypt -eq 1 is for internal purposes only
    if [ $encrypt -ge 2 -o $encrypt -eq -1 ]; then
        return
    fi

    if [ $encrypt -eq 0 ]; then
        if [ -n &quot;$ealgo&quot; -o -n &quot;$ekey&quot; -o -n &quot;$ekeyfile&quot; ]; then
            wsrep_log_error &quot;Options for encryption are specified,&quot; \
                            &quot;but encryption itself is disabled. SST may fail.&quot;
        fi
        return
    fi

    if [ &quot;$sfmt&quot; = 'tar' ]; then
        wsrep_log_info &quot;NOTE: key-based encryption (encrypt=1)&quot; \
                       &quot;cannot be enabled with tar format&quot;
        encrypt=-1
        return
    fi

    wsrep_log_info &quot;Key based encryption enabled in my.cnf&quot;

    if [ -z &quot;$ealgo&quot; ]; then
        wsrep_log_error &quot;FATAL: Encryption algorithm empty from my.cnf, bailing out&quot;
        exit 3
    fi

    if [ -z &quot;$ekey&quot; -a ! -r &quot;$ekeyfile&quot; ]; then
        wsrep_log_error &quot;FATAL: Either key must be specified&quot; \
                        &quot;or keyfile must be readable&quot;
        exit 3
    fi

    if [ &quot;$eformat&quot; = 'openssl' ]; then
        get_openssl
        if [ -z &quot;$OPENSSL_BINARY&quot; ]; then
            wsrep_log_error &quot;If encryption using the openssl is enabled,&quot; \
                            &quot;then you need to install openssl&quot;
            exit 2
        fi
        ecmd=&quot;'$OPENSSL_BINARY' enc -$ealgo&quot;
        if &quot;$OPENSSL_BINARY&quot; enc -help 2&gt;&amp;1 | grep -qw -F -- '-pbkdf2'; then
            ecmd=&quot;$ecmd -pbkdf2&quot;
        elif &quot;$OPENSSL_BINARY&quot; enc -help 2&gt;&amp;1 | grep -qw -F -- '-iter'; then
            ecmd=&quot;$ecmd -iter 1&quot;
        elif &quot;$OPENSSL_BINARY&quot; enc -help 2&gt;&amp;1 | grep -qw -F -- '-md'; then
            ecmd=&quot;$ecmd -md sha256&quot;
        fi
        if [ -z &quot;$ekey&quot; ]; then
            ecmd=&quot;$ecmd -kfile '$ekeyfile'&quot;
        else
            ecmd=&quot;$ecmd -k '$ekey'&quot;
        fi
    elif [ &quot;$eformat&quot; = 'xbcrypt' ]; then
        if [ -z &quot;$(commandex xbcrypt)&quot; ]; then
            wsrep_log_error &quot;If encryption using the xbcrypt is enabled,&quot; \
                            &quot;then you need to install xbcrypt&quot;
            exit 2
        fi
        wsrep_log_info &quot;NOTE: xbcrypt-based encryption,&quot; \
                       &quot;supported only from Xtrabackup 2.1.4&quot;
        if [ -z &quot;$ekey&quot; ]; then
            ecmd=&quot;xbcrypt --encrypt-algo='$ealgo' --encrypt-key-file='$ekeyfile'&quot;
        else
            ecmd=&quot;xbcrypt --encrypt-algo='$ealgo' --encrypt-key='$ekey'&quot;
        fi
        if [ -n &quot;$encrypt_threads&quot; ]; then
            ecmd=&quot;$ecmd --encrypt-threads=$encrypt_threads&quot;
        fi
        if [ -n &quot;$encrypt_chunk&quot; ]; then
            ecmd=&quot;$ecmd --encrypt-chunk-size=$encrypt_chunk&quot;
        fi
    else
        wsrep_log_error &quot;Unknown encryption format='$eformat'&quot;
        exit 2
    fi

    [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ] &amp;&amp; ecmd=&quot;$ecmd -d&quot;

    stagemsg=&quot;$stagemsg-XB-Encrypted&quot;
}

get_socat_ver()
{
    [ -n &quot;${SOCAT_VERSION+x}&quot; ] &amp;&amp; return
    # Determine the socat version
    SOCAT_VERSION=$(socat -V 2&gt;&amp;1 | \
                    grep -m1 -owE '[0-9]+(\.[0-9]+)+' | \
                    head -n1 || :)
    if [ -z &quot;$SOCAT_VERSION&quot; ]; then
        wsrep_log_error &quot;******** FATAL ERROR ******************&quot;
        wsrep_log_error &quot;* Cannot determine the socat version. *&quot;
        wsrep_log_error &quot;***************************************&quot;
        exit 2
    fi
}

get_transfer()
{
    if [ &quot;$tfmt&quot; = 'nc' ]; then
        wsrep_log_info &quot;Using netcat as streamer&quot;
        wsrep_check_programs nc
        tcmd='nc'
        if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
            if nc -h 2&gt;&amp;1 | grep -q -F 'ncat'; then
                wsrep_log_info &quot;Using Ncat as streamer&quot;
                tcmd=&quot;$tcmd -l&quot;
            elif nc -h 2&gt;&amp;1 | grep -qw -F -- '-d'; then
                wsrep_log_info &quot;Using Debian netcat as streamer&quot;
                tcmd=&quot;$tcmd -dl&quot;
                if [ $WSREP_SST_OPT_HOST_IPv6 -eq 1 ]; then
                    # When host is not explicitly specified (when only the port
                    # is specified) netcat can only bind to an IPv4 address if
                    # the &quot;-6&quot; option is not explicitly specified:
                    tcmd=&quot;$tcmd -6&quot;
                fi
            else
                wsrep_log_info &quot;Using traditional netcat as streamer&quot;
                tcmd=&quot;$tcmd -l -p&quot;
            fi
            tcmd=&quot;$tcmd $SST_PORT&quot;
        else
            # Check to see if netcat supports the '-N' flag.
            # -N Shutdown the network socket after EOF on stdin
            # If it supports the '-N' flag, then we need to use the '-N'
            # flag, otherwise the transfer will stay open after the file
            # transfer and cause the command to timeout.
            # Older versions of netcat did not need this flag and will
            # return an error if the flag is used.
            if nc -h 2&gt;&amp;1 | grep -qw -F -- '-N'; then
                tcmd=&quot;$tcmd -N&quot;
                wsrep_log_info &quot;Using nc -N&quot;
            fi
            # netcat doesn't understand [] around IPv6 address
            if nc -h 2&gt;&amp;1 | grep -q -F 'ncat'; then
                wsrep_log_info &quot;Using Ncat as streamer&quot;
            elif nc -h 2&gt;&amp;1 | grep -qw -F -- '-d'; then
                wsrep_log_info &quot;Using Debian netcat as streamer&quot;
            else
                wsrep_log_info &quot;Using traditional netcat as streamer&quot;
                tcmd=&quot;$tcmd -q0&quot;
            fi
            tcmd=&quot;$tcmd $WSREP_SST_OPT_HOST_UNESCAPED $SST_PORT&quot;
        fi
    else
        tfmt='socat'

        wsrep_log_info &quot;Using socat as streamer&quot;
        wsrep_check_programs socat

        if [ -n &quot;$sockopt&quot; ]; then
            sockopt=$(trim_string &quot;$sockopt&quot; ',')
            if [ -n &quot;$sockopt&quot; ]; then
                sockopt=&quot;,$sockopt&quot;
            fi
        fi

        # Add an option for ipv6 if needed:
        if [ $WSREP_SST_OPT_HOST_IPv6 -eq 1 ]; then
            # If sockopt contains 'pf=ip6' somewhere in the middle,
            # this will not interfere with socat, but exclude the trivial
            # cases when sockopt contains 'pf=ip6' as prefix or suffix:
            if [ &quot;$sockopt&quot; = &quot;${sockopt#,pf=ip6,}&quot; -a \
                 &quot;$sockopt&quot; = &quot;${sockopt%,pf=ip6}&quot; ]
            then
                sockopt=&quot;,pf=ip6$sockopt&quot;
            fi
        fi

        if [ $encrypt -lt 2 ]; then
            if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
                tcmd=&quot;socat -u TCP-LISTEN:$SST_PORT,reuseaddr$sockopt stdio&quot;
            else
                tcmd=&quot;socat -u stdio TCP:$REMOTEIP:$SST_PORT$sockopt&quot;
            fi
            return
        fi

        if ! socat -V | grep -q -F 'WITH_OPENSSL 1'; then
            wsrep_log_error &quot;******** FATAL ERROR ************************************************ &quot;
            wsrep_log_error &quot;* Encryption requested, but socat is not OpenSSL enabled (encrypt=$encrypt) *&quot;
            wsrep_log_error &quot;********************************************************************* &quot;
            exit 2
        fi

        local action='Decrypting'
        if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
            tcmd=&quot;socat -u openssl-listen:$SST_PORT,reuseaddr&quot;
        else
            local addr=&quot;$REMOTEIP:$SST_PORT&quot;
            tcmd=&quot;socat -u stdio openssl-connect:$addr&quot;
            action='Encrypting'
            get_socat_ver
            if ! check_for_version &quot;$SOCAT_VERSION&quot; '1.7.4.1'; then
                if check_for_version &quot;$SOCAT_VERSION&quot; '1.7.3.3'; then
                    # Workaround for a bug known as 'Red Hat issue 1870279'
                    # (connection reset by peer) in socat versions 1.7.3.3
                    # to 1.7.4.0:
                    tcmd=&quot;socat stdio openssl-connect:$addr,linger=10&quot;
                    wsrep_log_info \
                        &quot;Use workaround for socat $SOCAT_VERSION bug&quot;
                fi
            fi
            if check_for_version &quot;$SOCAT_VERSION&quot; '1.7.4'; then
                tcmd=&quot;$tcmd,no-sni=1&quot;
            fi
        fi

        if [ &quot;${sockopt#*,dhparam=}&quot; = &quot;$sockopt&quot; ]; then
            if [ -z &quot;$ssl_dhparams&quot; ]; then
                get_socat_ver
                if ! check_for_version &quot;$SOCAT_VERSION&quot; '1.7.3'; then
                    # socat versions &lt; 1.7.3 will have 512-bit dhparams (too small)
                    # so create 2048-bit dhparams and send that as a parameter:
                    check_for_dhparams
                fi
            fi
            if [ -n &quot;$ssl_dhparams&quot; ]; then
                tcmd=&quot;$tcmd,dhparam='$ssl_dhparams'&quot;
            fi
        fi

        CN_option=&quot;,commonname=''&quot;

        if [ $encrypt -eq 2 ]; then
            wsrep_log_info \
                &quot;Using openssl based encryption with socat: with crt and pem&quot;
            if [ -z &quot;$tpem&quot; -o -z &quot;$tcert$tcap&quot; ]; then
                wsrep_log_error \
                    &quot;Both PEM file and CRT file (or path) are required&quot;
                exit 22
            fi
            verify_ca_matches_cert &quot;$tpem&quot; &quot;$tcert&quot; &quot;$tcap&quot;
            tcmd=&quot;$tcmd,cert='$tpem'&quot;
            if [ -n &quot;$tcert&quot; ]; then
                tcmd=&quot;$tcmd,cafile='$tcert'&quot;
            fi
            if [ -n &quot;$tcap&quot; ]; then
                tcmd=&quot;$tcmd,capath='$tcap'&quot;
            fi
            stagemsg=&quot;$stagemsg-OpenSSL-Encrypted-2&quot;
            wsrep_log_info &quot;$action with cert='$tpem', ca='$tcert', capath='$tcap'&quot;
        elif [ $encrypt -eq 3 -o $encrypt -eq 4 ]; then
            wsrep_log_info \
                &quot;Using openssl based encryption with socat: with key and crt&quot;
            if [ -z &quot;$tpem&quot; -o -z &quot;$tkey&quot; ]; then
                wsrep_log_error &quot;Both the certificate file (or path) and&quot; \
                                &quot;the key file are required&quot;
                exit 22
            fi
            verify_cert_matches_key &quot;$tpem&quot; &quot;$tkey&quot;
            stagemsg=&quot;$stagemsg-OpenSSL-Encrypted-3&quot;
            if [ -z &quot;$tcert$tcap&quot; ]; then
                if [ $encrypt -eq 4 ]; then
                    wsrep_log_error \
                        &quot;Peer certificate file (or path) required if encrypt=4&quot;
                    exit 22
                fi
                # no verification
                CN_option=&quot;&quot;
                tcmd=&quot;$tcmd,cert='$tpem',key='$tkey',verify=0&quot;
                wsrep_log_info \
                    &quot;$action with cert='$tpem', key='$tkey', verify=0&quot;
            else
                # CA verification
                verify_ca_matches_cert &quot;$tpem&quot; &quot;$tcert&quot; &quot;$tcap&quot;
                if [ -n &quot;$WSREP_SST_OPT_REMOTE_USER&quot; ]; then
                    CN_option=&quot;,commonname='$WSREP_SST_OPT_REMOTE_USER'&quot;
                elif [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' -o $encrypt -eq 4 ]
                then
                    CN_option=&quot;,commonname=''&quot;
                elif is_local_ip &quot;$WSREP_SST_OPT_HOST_UNESCAPED&quot;; then
                    CN_option=',commonname=localhost'
                else
                    CN_option=&quot;,commonname='$WSREP_SST_OPT_HOST_UNESCAPED'&quot;
                fi
                tcmd=&quot;$tcmd,cert='$tpem',key='$tkey'&quot;
                if [ -n &quot;$tcert&quot; ]; then
                    tcmd=&quot;$tcmd,cafile='$tcert'&quot;
                fi
                if [ -n &quot;$tcap&quot; ]; then
                    tcmd=&quot;$tcmd,capath='$tcap'&quot;
                fi
                wsrep_log_info &quot;$action with cert='$tpem', key='$tkey',&quot; \
                               &quot;ca='$tcert', capath='$tcap'&quot;
            fi
        else
            wsrep_log_info &quot;Unknown encryption mode: encrypt=$encrypt&quot;
            exit 22
        fi

        tcmd=&quot;$tcmd$CN_option$sockopt&quot;

        if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
            tcmd=&quot;$tcmd stdio&quot;
        fi
    fi
}

get_footprint()
{
    cd &quot;$DATA_DIR&quot;
    local payload_data=$(find $findopt . \
        -regex '.*undo[0-9]+$\|.*\.ibd$\|.*\.MYI$\|.*\.MYD$\|.*ibdata1$' \
        -type f -print0 | du --files0-from=- --block-size=1 -c -s | \
        awk 'END { print $1 }')
    local payload_undo=0
    if [ -n &quot;$ib_undo_dir&quot; -a &quot;$ib_undo_dir&quot; != '.' -a \
         &quot;$ib_undo_dir&quot; != &quot;$DATA_DIR&quot; -a -d &quot;$ib_undo_dir&quot; ]
    then
        cd &quot;$ib_undo_dir&quot;
        payload_undo=$(find . -regex '.*undo[0-9]+$' -type f -print0 | \
            du --files0-from=- --block-size=1 -c -s | awk 'END { print $1 }')
    fi
    cd &quot;$OLD_PWD&quot;

    wsrep_log_info \
        &quot;SST footprint estimate: data: $payload_data, undo: $payload_undo&quot;

    payload=$(( payload_data+payload_undo ))

    if [ &quot;$compress&quot; != 'none' ]; then
        # QuickLZ has around 50% compression ratio
        # When compression/compaction used, the progress is only an approximate.
        payload=$(( payload*1/2 ))
    fi

    if [ $WSREP_SST_OPT_PROGRESS -eq 1 ]; then
        # report to parent the total footprint of the SST
        echo &quot;$TOTAL_TAG $payload&quot;
    fi

    adjust_progress
}

adjust_progress()
{
    pcmd=&quot;&quot;
    rcmd=&quot;&quot;

    [ &quot;$progress&quot; = 'none' ] &amp;&amp; return

    rlimitopts=&quot;&quot;
    if [ -n &quot;$rlimit&quot; -a &quot;$WSREP_SST_OPT_ROLE&quot; = 'donor' ]; then
        wsrep_log_info &quot;Rate-limiting SST to $rlimit&quot;
        rlimitopts=&quot; -L $rlimit&quot;
    fi

    if [ -n &quot;$progress&quot; ]; then

        # Backward compatibility: user-configured progress output
        pcmd=&quot;pv $pvopts$rlimitopts&quot;

        if [ -z &quot;${PV_FORMAT+x}&quot; ]; then
           PV_FORMAT=0
           pv --help | grep -qw -F -- '-F' &amp;&amp; PV_FORMAT=1
        fi
        if [ $PV_FORMAT -eq 1 ]; then
            pcmd=&quot;$pcmd $pvformat&quot;
        fi

        if [ $payload -ne 0 ]; then
            pcmd=&quot;$pcmd -s $payload&quot;
        fi

        if [ &quot;$progress&quot; != '1' ]; then
            if [ -e &quot;$progress&quot; ]; then
                pcmd=&quot;$pcmd 2&gt;&gt;'$progress'&quot;
            else
                pcmd=&quot;$pcmd 2&gt;'$progress'&quot;
            fi
        fi

    elif [ $WSREP_SST_OPT_PROGRESS -eq 1 ]; then

        # Default progress output parseable by parent
        pcmd=&quot;pv -f -i 1 -n -b$rlimitopts&quot;

        # read progress data, add tag and post to stdout
        # for the parent
        rcmd=&quot;stdbuf -oL tr '\r' '\n' | xargs -n1 echo complete&quot;

    elif [ -n &quot;$rlimitopts&quot; ]; then

        # Rate-limiting only, when rlimit is non-zero
        pcmd=&quot;pv -q$rlimitopts&quot;

    fi
}

encgroups='--mysqld|sst|xtrabackup'

read_cnf()
{
    sfmt=$(parse_cnf sst streamfmt 'mbstream')
    tfmt=$(parse_cnf sst transferfmt 'socat')

    encrypt=$(parse_cnf &quot;$encgroups&quot; 'encrypt' 0)
    tmode=$(parse_cnf &quot;$encgroups&quot; 'ssl-mode' 'DISABLED' | \
            tr '[[:lower:]]' '[[:upper:]]')

    case &quot;$tmode&quot; in
    'VERIFY_IDENTITY'|'VERIFY_CA'|'REQUIRED'|'DISABLED')
        ;;
    *)
        wsrep_log_error &quot;Unrecognized ssl-mode option: '$tmode'&quot;
        exit 22 # EINVAL
        ;;
    esac

    if [ $encrypt -eq 0 -o $encrypt -ge 2 ]; then
        if [ &quot;$tmode&quot; != 'DISABLED' -o $encrypt -ge 2 ]; then
            check_server_ssl_config
        fi
        if [ &quot;$tmode&quot; != 'DISABLED' ]; then
            if [ 0 -eq $encrypt -a -n &quot;$tpem&quot; -a -n &quot;$tkey&quot; ]
            then
                encrypt=3 # enable cert/key SSL encyption
                # avoid CA verification if not set explicitly:
                # nodes may happen to have different CA if self-generated,
                # zeroing up tcert and tcap does the trick:
                if [ &quot;${tmode#VERIFY}&quot; = &quot;$tmode&quot; ]; then
                    tcert=&quot;&quot;
                    tcap=&quot;&quot;
                fi
            fi
        fi
    elif [ $encrypt -eq 1 ]; then
        ealgo=$(parse_cnf &quot;$encgroups&quot; 'encrypt-algo')
        eformat=$(parse_cnf &quot;$encgroups&quot; 'encrypt-format' 'openssl')
        ekey=$(parse_cnf &quot;$encgroups&quot; 'encrypt-key')
        # The keyfile should be read only when the key
        # is not specified or empty:
        if [ -z &quot;$ekey&quot; ]; then
            ekeyfile=$(parse_cnf &quot;$encgroups&quot; 'encrypt-key-file')
        fi
    fi

    wsrep_log_info &quot;SSL configuration: CA='$tcert', CAPATH='$tcap',&quot; \
                   &quot;CERT='$tpem', KEY='$tkey', MODE='$tmode',&quot; \
                   &quot;encrypt='$encrypt'&quot;

    if [ $encrypt -ge 2 ]; then
        ssl_dhparams=$(parse_cnf &quot;$encgroups&quot; 'ssl-dhparams')
    fi

    sockopt=$(parse_cnf sst sockopt &quot;&quot;)
    progress=$(parse_cnf sst progress &quot;&quot;)
    ttime=$(parse_cnf sst time 0)
    cpat='.*\.pem$\|.*galera\.cache$\|.*sst_in_progress$\|.*\.sst$\|.*gvwstate\.dat$\|.*grastate\.dat$\|.*\.err$\|.*\.log$\|.*RPM_UPGRADE_MARKER$\|.*RPM_UPGRADE_HISTORY$'
    [ &quot;$OS&quot; = 'FreeBSD' ] &amp;&amp; cpat=$(echo &quot;$cpat&quot; | sed 's/\\|/|/g')
    cpat=$(parse_cnf sst cpat &quot;$cpat&quot;)
    scomp=$(parse_cnf sst compressor &quot;&quot;)
    sdecomp=$(parse_cnf sst decompressor &quot;&quot;)

    rlimit=$(parse_cnf sst rlimit &quot;&quot;)
    uextra=$(parse_cnf sst use-extra 0)
    speciald=$(parse_cnf sst sst-special-dirs 1)
    iopts=$(parse_cnf sst inno-backup-opts &quot;&quot;)
    iapts=$(parse_cnf sst inno-apply-opts &quot;&quot;)
    impts=$(parse_cnf sst inno-move-opts &quot;&quot;)
    stimeout=$(parse_cnf sst sst-initial-timeout 300)
    ssyslog=$(parse_cnf sst sst-syslog 0)
    ssystag=$(parse_cnf mysqld_safe syslog-tag &quot;${SST_SYSLOG_TAG:-}&quot;)
    ssystag=&quot;$ssystag-&quot;
    sstlogarchive=$(parse_cnf sst sst-log-archive 1)
    sstlogarchivedir=&quot;&quot;
    if [ $sstlogarchive -ne 0 ]; then
        sstlogarchivedir=$(parse_cnf sst sst-log-archive-dir \
                           '/tmp/sst_log_archive')
        if [ -n &quot;$sstlogarchivedir&quot; ]; then
            sstlogarchivedir=$(trim_dir &quot;$sstlogarchivedir&quot;)
        fi
    fi

    if [ $speciald -eq 0 ]; then
        wsrep_log_error \
            &quot;sst-special-dirs equal to 0 is not supported, falling back to 1&quot;
        speciald=1
    fi

    if [ $ssyslog -ne -1 ]; then
        ssyslog=$(in_config 'mysqld_safe' 'syslog')
    fi

    if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'donor' ]; then
        compress=$(parse_cnf &quot;$encgroups&quot; 'compress' 'none')
        if [ &quot;$compress&quot; != 'none' ]; then
            compress_chunk=$(parse_cnf &quot;$encgroups&quot; 'compress-chunk-size')
            compress_threads=$(parse_cnf &quot;$encgroups&quot; 'compress-threads')
        fi
    fi

    backup_threads=$(parse_cnf &quot;$encgroups&quot; 'backup-threads')

    if [ &quot;$eformat&quot; = 'xbcrypt' ]; then
        encrypt_threads=$(parse_cnf &quot;$encgroups&quot; 'encrypt-threads')
        encrypt_chunk=$(parse_cnf &quot;$encgroups&quot; 'encrypt-chunk-size')
    fi
}

get_stream()
{
    if [ &quot;$sfmt&quot; = 'mbstream' -o &quot;$sfmt&quot; = 'xbstream' ]; then
        sfmt='mbstream'
        local STREAM_BIN=$(commandex &quot;$sfmt&quot;)
        if [ -z &quot;$STREAM_BIN&quot; ]; then
            wsrep_log_error &quot;Streaming with $sfmt, but $sfmt not found in path&quot;
            exit 42
        fi
        if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
            strmcmd=&quot;'$STREAM_BIN' -x&quot;
        else
            strmcmd=&quot;'$STREAM_BIN' -c '$INFO_FILE' '$DONOR_INFO_FILE'&quot;
        fi
    else
        sfmt='tar'
        if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
            strmcmd='tar xfi -'
        else
            strmcmd=&quot;tar cf - '$INFO_FILE' '$DONOR_INFO_FILE'&quot;
        fi
    fi
    wsrep_log_info &quot;Streaming with $sfmt&quot;
}

cleanup_at_exit()
{
    # Since this is invoked just after exit NNN
    local estatus=$?
    if [ $estatus -ne 0 ]; then
        wsrep_log_error &quot;Cleanup after exit with status: $estatus&quot;
    elif [ -z &quot;${coords:-}&quot; -a &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
        estatus=32
        wsrep_log_error &quot;Failed to get current position&quot;
    fi

    [ &quot;$(pwd)&quot; != &quot;$OLD_PWD&quot; ] &amp;&amp; cd &quot;$OLD_PWD&quot;

    if [ $estatus -ne 0 ]; then
        wsrep_log_error &quot;Removing $MAGIC_FILE file due to signal&quot;
        [ -f &quot;$MAGIC_FILE&quot; ] &amp;&amp; rm -f &quot;$MAGIC_FILE&quot; || :
        [ -f &quot;$DONOR_MAGIC_FILE&quot; ] &amp;&amp; rm -f &quot;$DONOR_MAGIC_FILE&quot; || :
    fi

    if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
        if [ -n &quot;$BACKUP_PID&quot; ]; then
            if ps -p $BACKUP_PID &gt;/dev/null 2&gt;&amp;1; then
                wsrep_log_error \
                    &quot;mariadb-backup process is still running. Killing...&quot;
                cleanup_pid $CHECK_PID
            fi
        fi
        wsrep_log_info &quot;Removing the sst_in_progress file&quot;
        wsrep_cleanup_progress_file
    else
        [ -f &quot;$DATA/$IST_FILE&quot; ] &amp;&amp; rm -f &quot;$DATA/$IST_FILE&quot; || :
    fi

    if [ -n &quot;$progress&quot; -a -p &quot;$progress&quot; ]; then
        wsrep_log_info &quot;Cleaning up fifo file: $progress&quot;
        rm -f &quot;$progress&quot; || :
    fi

    wsrep_log_info &quot;Cleaning up temporary directories&quot;

    if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'joiner' ]; then
        [ -n &quot;$STATDIR&quot; -a -d &quot;$STATDIR&quot; ] &amp;&amp; rm -rf &quot;$STATDIR&quot; || :
    else
        [ -n &quot;$xtmpdir&quot; -a -d &quot;$xtmpdir&quot; ] &amp;&amp; rm -rf &quot;$xtmpdir&quot; || :
        [ -n &quot;$itmpdir&quot; -a -d &quot;$itmpdir&quot; ] &amp;&amp; rm -rf &quot;$itmpdir&quot; || :
    fi

    # Final cleanup
    local pgid=$(ps -o 'pgid=' $$ 2&gt;/dev/null | grep -o -E '[0-9]+' || :)

    # This means no setsid done in mysqld.
    # We don't want to kill mysqld here otherwise.
    if [ -n &quot;$pgid&quot; ]; then
        if [ $$ -eq $pgid ]; then
            # This means a signal was delivered to the process.
            # So, more cleanup.
            if [ $estatus -ge 128 ]; then
                kill -KILL -- -$$ || :
            fi
        fi
    fi

    if [ -n &quot;$SST_PID&quot; ]; then
        [ -f &quot;$SST_PID&quot; ] &amp;&amp; rm -f &quot;$SST_PID&quot; || :
    fi

    exit $estatus
}

setup_ports()
{
    SST_PORT=&quot;$WSREP_SST_OPT_PORT&quot;
    if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'donor' ]; then
        REMOTEIP=&quot;$WSREP_SST_OPT_HOST&quot;
        lsn=&quot;$WSREP_SST_OPT_LSN&quot;
        sst_ver=&quot;$WSREP_SST_OPT_SST_VER&quot;
    fi
}

#
# Waits ~30 seconds for socat or nc to open the port and
# then reports ready, regardless of timeout.
#
wait_for_listen()
{
    for i in {1..150}; do
        if check_port &quot;&quot; &quot;$SST_PORT&quot; 'socat|nc|netcat'; then
            break
        fi
        sleep 0.2
    done
    echo &quot;ready $ADDR:$SST_PORT/$MODULE/$lsn/$sst_ver&quot;
}

check_extra()
{
    local use_socket=1
    if [ $uextra -eq 1 ]; then
        local thread_handling=$(parse_cnf '--mysqld' 'thread-handling')
        if [ &quot;$thread_handling&quot; = 'pool-of-threads' ]; then
            local eport=$(parse_cnf '--mysqld' 'extra-port')
            if [ -n &quot;$eport&quot; ]; then
                # mariadb-backup works only locally.
                # Hence, setting host to 127.0.0.1 unconditionally:
                wsrep_log_info &quot;SST through extra_port $eport&quot;
                INNOEXTRA=&quot;$INNOEXTRA --host=127.0.0.1 --port=$eport&quot;
                use_socket=0
            else
                wsrep_log_error &quot;Extra port $eport null, failing&quot;
                exit 1
            fi
        else
            wsrep_log_info &quot;Thread pool not set, ignore the option use_extra&quot;
        fi
    fi
    if [ $use_socket -eq 1 -a -n &quot;$WSREP_SST_OPT_SOCKET&quot; ]; then
        INNOEXTRA=&quot;$INNOEXTRA --socket='$WSREP_SST_OPT_SOCKET'&quot;
    fi
}

recv_joiner()
{
    local dir=&quot;$1&quot;
    local msg=&quot;$2&quot;
    local tmt=$3
    local checkf=$4
    local wait=$5

    if [ ! -d &quot;$dir&quot; ]; then
        # This indicates that IST is in progress
        return
    fi

    local ltcmd=&quot;$tcmd&quot;
    if [ $tmt -gt 0 ]; then
        if [ -n &quot;$(commandex timeout)&quot; ]; then
            local koption=0
            if [ &quot;$OS&quot; = 'FreeBSD' -o &quot;$OS&quot; = 'NetBSD' -o &quot;$OS&quot; = 'OpenBSD' -o \
                 &quot;$OS&quot; = 'DragonFly' ]; then
                if timeout 2&gt;&amp;1 | grep -qw -F -- '-k'; then
                    koption=1
                fi
            else
                if timeout --help | grep -qw -F -- '-k'; then
                    koption=1
                fi
            fi
            if [ $koption -ne 0 ]; then
                ltcmd=&quot;timeout -k $(( tmt+10 )) $tmt $tcmd&quot;
            else
                ltcmd=&quot;timeout -s 9 $tmt $tcmd&quot;
            fi
        fi
    fi

    if [ $wait -ne 0 ]; then
        wait_for_listen &amp;
    fi

    cd &quot;$dir&quot;
    set +e
    timeit &quot;$msg&quot; &quot;$ltcmd | $strmcmd; RC=( &quot;\${PIPESTATUS[@]}&quot; )&quot;
    set -e
    cd &quot;$OLD_PWD&quot;

    if [ ${RC[0]} -eq 124 ]; then
        wsrep_log_error &quot;Possible timeout in receiving first data from&quot; \
                        &quot;donor in gtid stage: exit codes: ${RC[@]}&quot;
        exit 32
    fi

    for ecode in &quot;${RC[@]}&quot;; do
        if [ $ecode -ne 0 ]; then
            wsrep_log_error &quot;Error while getting data from donor node:&quot; \
                            &quot;exit codes: ${RC[@]}&quot;
            exit 32
        fi
    done

    if [ $checkf -eq 1 ]; then
        if [ ! -r &quot;$MAGIC_FILE&quot; ]; then
            # this message should cause joiner to abort:
            wsrep_log_error &quot;receiving process ended without creating&quot; \
                            &quot;magic file ($MAGIC_FILE)&quot;
            wsrep_log_info &quot;Contents of datadir:&quot;
            wsrep_log_info $(ls -l &quot;$dir/&quot;*)
            exit 32
        fi

        if [ -n &quot;$MY_SECRET&quot; ]; then
            # Check donor supplied secret:
            SECRET=$(grep -m1 -E &quot;^$SECRET_TAG[[:space:]]&quot; &quot;$MAGIC_FILE&quot; || :)
            SECRET=$(trim_string &quot;${SECRET#$SECRET_TAG}&quot;)
            if [ &quot;$SECRET&quot; != &quot;$MY_SECRET&quot; ]; then
                wsrep_log_error &quot;Donor does not know my secret!&quot;
                wsrep_log_info &quot;Donor: '$SECRET', my: '$MY_SECRET'&quot;
                exit 32
            fi
        fi

        if [ $WSREP_SST_OPT_PROGRESS -eq 1 ]; then
            # check total SST footprint
            payload=$(grep -m1 -E &quot;^$TOTAL_TAG[[:space:]]&quot; &quot;$MAGIC_FILE&quot; || :)
            if [ -n &quot;$payload&quot; ]; then
                payload=$(trim_string &quot;${payload#$TOTAL_TAG}&quot;)
                if [ $payload -ge 0 ]; then
                    # report to parent
                    echo &quot;$TOTAL_TAG $payload&quot;
                fi
            fi
        fi
    fi
}

send_donor()
{
    local dir=&quot;$1&quot;
    local msg=&quot;$2&quot;

    cd &quot;$dir&quot;
    set +e
    timeit &quot;$msg&quot; &quot;$strmcmd | $tcmd; RC=( &quot;\${PIPESTATUS[@]}&quot; )&quot;
    set -e
    cd &quot;$OLD_PWD&quot;

    for ecode in &quot;${RC[@]}&quot;; do
        if [ $ecode -ne 0 ]; then
            wsrep_log_error &quot;Error while sending data to joiner node:&quot; \
                            &quot;exit codes: ${RC[@]}&quot;
            exit 32
        fi
    done
}

monitor_process()
{
    local sst_stream_pid=$1

    while :; do
        if ! ps -p $WSREP_SST_OPT_PARENT &gt;/dev/null 2&gt;&amp;1; then
            wsrep_log_error \
                &quot;Parent mysqld process (PID: $WSREP_SST_OPT_PARENT)&quot; \
                &quot;terminated unexpectedly.&quot;
            kill -- -$WSREP_SST_OPT_PARENT
            exit 32
        fi
        if ! ps -p $sst_stream_pid &gt;/dev/null 2&gt;&amp;1; then
            break
        fi
        sleep 0.1
    done
}

read_cnf
setup_ports

if [ &quot;$progress&quot; = 'none' ]; then
    wsrep_log_info &quot;All progress/rate-limiting disabled by configuration&quot;
elif [ -z &quot;$(commandex pv)&quot; ]; then
    wsrep_log_info &quot;Progress reporting tool pv not found in path: $PATH&quot;
    wsrep_log_info &quot;Disabling all progress/rate-limiting&quot;
    progress='none'
fi

if &quot;$BACKUP_BIN&quot; --help 2&gt;/dev/null | grep -qw -F -- '--version-check'; then
    disver=' --no-version-check'
fi

get_stream
get_transfer

findopt='-L'
[ &quot;$OS&quot; = 'FreeBSD' ] &amp;&amp; findopt=&quot;$findopt -E&quot;

wait_previous_sst

[ -f &quot;$MAGIC_FILE&quot; ] &amp;&amp; rm -f &quot;$MAGIC_FILE&quot;
[ -f &quot;$DONOR_MAGIC_FILE&quot; ] &amp;&amp; rm -f &quot;$DONOR_MAGIC_FILE&quot;
[ -f &quot;$DATA/$IST_FILE&quot; ] &amp;&amp; rm -f &quot;$DATA/$IST_FILE&quot;

if [ $ssyslog -eq 1 ]; then
    if [ -n &quot;$(commandex logger)&quot; ]; then
        wsrep_log_info &quot;Logging all stderr of SST/mariadb-backup to syslog&quot;

        exec 2&gt; &gt;(logger -p daemon.err -t ${ssystag}wsrep-sst-$WSREP_SST_OPT_ROLE)

        wsrep_log_error()
        {
            logger -p daemon.err -t ${ssystag}wsrep-sst-$WSREP_SST_OPT_ROLE &quot;$@&quot;
        }

        wsrep_log_warning()
        {
            logger -p daemon.warning -t ${ssystag}wsrep-sst-$WSREP_SST_OPT_ROLE &quot;$@&quot;
        }

        wsrep_log_info()
        {
            logger -p daemon.info -t ${ssystag}wsrep-sst-$WSREP_SST_OPT_ROLE &quot;$@&quot;
        }
    else
        wsrep_log_error &quot;logger not in path: $PATH. Ignoring&quot;
    fi
    INNOAPPLY=&quot;2&gt;&amp;1 | logger -p daemon.err -t ${ssystag}innobackupex-apply&quot;
    INNOMOVE=&quot;2&gt;&amp;1 | logger -p daemon.err -t ${ssystag}innobackupex-move&quot;
    INNOBACKUP=&quot;2&gt; &gt;(logger -p daemon.err -t ${ssystag}innobackupex-backup)&quot;
else
    if [ $sstlogarchive -eq 1 ]
    then
        ARCHIVETIMESTAMP=$(date '+%Y.%m.%d-%H.%M.%S.%N')

        if [ -n &quot;$sstlogarchivedir&quot; ]; then
            if [ ! -d &quot;$sstlogarchivedir&quot; ]; then
                if ! mkdir -p &quot;$sstlogarchivedir&quot;; then
                    sstlogarchivedir=&quot;&quot;
                    wsrep_log_warning \
                        &quot;Unable to create '$sstlogarchivedir' directory&quot;
                fi
            elif [ ! -w &quot;$sstlogarchivedir&quot; ]; then
                sstlogarchivedir=&quot;&quot;
                wsrep_log_warning \
                    &quot;The '$sstlogarchivedir' directory is not writtable&quot;
            fi
        fi

        if [ -e &quot;$INNOAPPLYLOG&quot; ]; then
            if [ -n &quot;$sstlogarchivedir&quot; ]; then
                newfile=$(basename &quot;$INNOAPPLYLOG&quot;)
                newfile=&quot;$sstlogarchivedir/$newfile.$ARCHIVETIMESTAMP&quot;
            else
                newfile=&quot;$INNOAPPLYLOG.$ARCHIVETIMESTAMP&quot;
            fi
            wsrep_log_info &quot;Moving '$INNOAPPLYLOG' to '$newfile'&quot;
            mv &quot;$INNOAPPLYLOG&quot; &quot;$newfile&quot; &amp;&amp; gzip &quot;$newfile&quot; || \
                wsrep_log_warning &quot;Failed to archive log file ('$newfile')&quot;
        fi

        if [ -e &quot;$INNOMOVELOG&quot; ]; then
            if [ -n &quot;$sstlogarchivedir&quot; ]; then
                newfile=$(basename &quot;$INNOMOVELOG&quot;)
                newfile=&quot;$sstlogarchivedir/$newfile.$ARCHIVETIMESTAMP&quot;
            else
                newfile=&quot;$INNOMOVELOG.$ARCHIVETIMESTAMP&quot;
            fi
            wsrep_log_info &quot;Moving '$INNOMOVELOG' to '$newfile'&quot;
            mv &quot;$INNOMOVELOG&quot; &quot;$newfile&quot; &amp;&amp; gzip &quot;$newfile&quot; || \
                wsrep_log_warning &quot;Failed to archive log file ('$newfile')&quot;
        fi

        if [ -e &quot;$INNOBACKUPLOG&quot; ]; then
            if [ -n &quot;$sstlogarchivedir&quot; ]; then
                newfile=$(basename &quot;$INNOBACKUPLOG&quot;)
                newfile=&quot;$sstlogarchivedir/$newfile.$ARCHIVETIMESTAMP&quot;
            else
                newfile=&quot;$INNOBACKUPLOG.$ARCHIVETIMESTAMP&quot;
            fi
            wsrep_log_info &quot;Moving '$INNOBACKUPLOG' to '$newfile'&quot;
            mv &quot;$INNOBACKUPLOG&quot; &quot;$newfile&quot; &amp;&amp; gzip &quot;$newfile&quot; || \
                wsrep_log_warning &quot;Failed to archive log file ('$newfile')&quot;
        fi
    fi
    INNOAPPLY=&quot;&gt; '$INNOAPPLYLOG' 2&gt;&amp;1&quot;
    INNOMOVE=&quot;&gt; '$INNOMOVELOG' 2&gt;&amp;1&quot;
    INNOBACKUP=&quot;2&gt; '$INNOBACKUPLOG'&quot;
fi

setup_commands()
{
    local mysqld_args=&quot;&quot;
    if [ -n &quot;$WSREP_SST_OPT_MYSQLD&quot; ]; then
        mysqld_args=&quot; --mysqld-args $WSREP_SST_OPT_MYSQLD&quot;
    fi
    local recovery=&quot;&quot;
    if [ -n &quot;$INNODB_FORCE_RECOVERY&quot; ]; then
        recovery=&quot; --innodb-force-recovery=$INNODB_FORCE_RECOVERY&quot;
    fi
    INNOAPPLY=&quot;$BACKUP_BIN --prepare$disver$recovery${iapts:+ }$iapts$INNOEXTRA --target-dir='$DATA' --datadir='$DATA'$mysqld_args $INNOAPPLY&quot;
    INNOMOVE=&quot;$BACKUP_BIN$WSREP_SST_OPT_CONF --move-back$disver${impts:+ }$impts$INNOEXTRA --galera-info --force-non-empty-directories --target-dir='$DATA' --datadir='${TDATA:-$DATA}' $INNOMOVE&quot;
    INNOBACKUP=&quot;$BACKUP_BIN$WSREP_SST_OPT_CONF --backup$disver${iopts:+ }$iopts$tmpopts$INNOEXTRA --galera-info --stream=$sfmt --target-dir='$itmpdir' --datadir='$DATA'$mysqld_args $INNOBACKUP&quot;
}

send_magic()
{
    # Store donor's wsrep GTID (state ID) and wsrep_gtid_domain_id
    # (separated by a space).
    echo &quot;$WSREP_SST_OPT_GTID $WSREP_SST_OPT_GTID_DOMAIN_ID&quot; &gt; &quot;$MAGIC_FILE&quot;
    echo &quot;$WSREP_SST_OPT_GTID $WSREP_SST_OPT_GTID_DOMAIN_ID&quot; &gt; &quot;$DONOR_MAGIC_FILE&quot;
    if [ -n &quot;$WSREP_SST_OPT_REMOTE_PSWD&quot; ]; then
        # Let joiner know that we know its secret
        echo &quot;$SECRET_TAG $WSREP_SST_OPT_REMOTE_PSWD&quot; &gt;&gt; &quot;$MAGIC_FILE&quot;
    fi

    if [ $WSREP_SST_OPT_BYPASS -eq 0 -a $WSREP_SST_OPT_PROGRESS -eq 1 ]; then
        # Tell joiner what to expect:
        echo &quot;$TOTAL_TAG $payload&quot; &gt;&gt; &quot;$MAGIC_FILE&quot;
    fi
}

if [ &quot;$WSREP_SST_OPT_ROLE&quot; = 'donor' ]; then

    trap cleanup_at_exit EXIT

    if [ $WSREP_SST_OPT_BYPASS -eq 0 ]
    then
        if [ -z &quot;$sst_ver&quot; ]; then
            wsrep_log_error &quot;Upgrade joiner to 5.6.21 or higher for backup locks support&quot;
            wsrep_log_error &quot;The joiner is not supported for this version of donor&quot;
            exit 93
        fi

        tmpdir=$(parse_cnf &quot;$encgroups&quot; 'tmpdir')
        if [ -z &quot;$tmpdir&quot; ]; then
            xtmpdir=&quot;$(mktemp -d)&quot;
            itmpdir=&quot;$(mktemp -d)&quot;
        elif [ &quot;$OS&quot; = 'Linux' ]; then
            xtmpdir=$(mktemp -d &quot;--tmpdir=$tmpdir&quot;)
            itmpdir=$(mktemp -d &quot;--tmpdir=$tmpdir&quot;)
        else
            xtmpdir=$(TMPDIR=&quot;$tmpdir&quot;; mktemp -d)
            itmpdir=$(TMPDIR=&quot;$tmpdir&quot;; mktemp -d)
        fi

        wsrep_log_info &quot;Using '$xtmpdir' as mariadb-backup temporary directory&quot;
        tmpopts=&quot; --tmpdir='$xtmpdir'&quot;

        wsrep_log_info &quot;Using '$itmpdir' as mariadb-backup working directory&quot;

        if [ -n &quot;$WSREP_SST_OPT_USER&quot; ]; then
           INNOEXTRA=&quot;$INNOEXTRA --user='$WSREP_SST_OPT_USER'&quot;
        fi

        if [ -n &quot;$WSREP_SST_OPT_PSWD&quot; ]; then
            export MYSQL_PWD=&quot;$WSREP_SST_OPT_PSWD&quot;
        elif [ -n &quot;$WSREP_SST_OPT_USER&quot; ]; then
            # Empty password, used for testing, debugging etc.
            unset MYSQL_PWD
        fi

        check_extra

        if [ -n &quot;$progress&quot; -o $WSREP_SST_OPT_PROGRESS -eq 1 ]; then
            wsrep_log_info &quot;Estimating total transfer size&quot;
            get_footprint
            wsrep_log_info &quot;To transfer: $payload&quot;
        else
            adjust_progress
        fi

        wsrep_log_info &quot;Streaming GTID file before SST&quot;
        send_magic

        ttcmd=&quot;$tcmd&quot;

        if [ -n &quot;$scomp&quot; ]; then
            tcmd=&quot;$scomp | $tcmd&quot;
        fi

        get_keys
        if [ $encrypt -eq 1 ]; then
            tcmd=&quot;$ecmd | $tcmd&quot;
        fi

        send_donor &quot;$DATA&quot; &quot;$stagemsg-gtid&quot;

        # Restore the transport commmand to its original state
        tcmd=&quot;$ttcmd&quot;

        if [ -n &quot;$pcmd&quot; ]; then
            if [ -n &quot;$rcmd&quot; ]; then
                # redirect pv stderr to rcmd for tagging and output to parent
                tcmd=&quot;{ $pcmd 2&gt;&amp;3 | $tcmd; } 3&gt;&amp;1 | $rcmd&quot;
            else
                # use user-configured pv output
                tcmd=&quot;$pcmd | $tcmd&quot;
            fi
        fi

        wsrep_log_info &quot;Sleeping before data transfer for SST&quot;
        sleep 10

        wsrep_log_info &quot;Streaming the backup to joiner at $REMOTEIP:$SST_PORT&quot;

        # Add compression to the head of the stream (if specified)
        if [ -n &quot;$scomp&quot; ]; then
            tcmd=&quot;$scomp | $tcmd&quot;
        fi

        # Add encryption to the head of the stream (if specified)
        if [ $encrypt -eq 1 ]; then
            tcmd=&quot;$ecmd | $tcmd&quot;
        fi

        iopts=&quot;--databases-exclude='lost+found'${iopts:+ }$iopts&quot;

        # if compression is enabled for backup files, then add the
        # appropriate options to the mariadb-backup command line:
        if [ &quot;$compress&quot; != 'none' ]; then
            iopts=&quot;--compress${compress:+=$compress}${iopts:+ }$iopts&quot;
            if [ -n &quot;$compress_threads&quot; ]; then
                iopts=&quot;--compress-threads=$compress_threads${iopts:+ }$iopts&quot;
            fi
            if [ -n &quot;$compress_chunk&quot; ]; then
                iopts=&quot;--compress-chunk-size=$compress_chunk${iopts:+ }$iopts&quot;
            fi
        fi

        if [ -n &quot;$backup_threads&quot; ]; then
            iopts=&quot;--parallel=$backup_threads${iopts:+ }$iopts&quot;
        fi

        setup_commands

        set +e
        timeit &quot;$stagemsg-SST&quot; &quot;$INNOBACKUP | $tcmd; RC=( &quot;\${PIPESTATUS[@]}&quot; )&quot;
        set -e

        if [ ${RC[0]} -ne 0 ]; then
            wsrep_log_error &quot;mariadb-backup finished with error: ${RC[0]}.&quot; \
                            &quot;Check syslog or '$INNOBACKUPLOG' for details&quot;
            exit 22
        elif [ ${RC[$(( ${#RC[@]}-1 ))]} -eq 1 ]; then
            wsrep_log_error &quot;$tcmd finished with error: ${RC[1]}&quot;
            exit 22
        fi

    else # BYPASS FOR IST

        wsrep_log_info &quot;Bypassing the SST for IST&quot;
        echo 'continue' # now server can resume updating data

        send_magic

        echo '1' &gt; &quot;$DATA/$IST_FILE&quot;

        if [ -n &quot;$scomp&quot; ]; then
            tcmd=&quot;$scomp | $tcmd&quot;
        fi

        get_keys
        if [ $encrypt -eq 1 ]; then
            tcmd=&quot;$ecmd | $tcmd&quot;
        fi

        strmcmd=&quot;$strmcmd '$IST_FILE'&quot;

        send_donor &quot;$DATA&quot; &quot;$stagemsg-IST&quot;

    fi

    echo &quot;done $WSREP_SST_OPT_GTID&quot;
    wsrep_log_info &quot;Total time on donor: $totime seconds&quot;

else # joiner

    create_dirs 1

    [ -e &quot;$SST_PROGRESS_FILE&quot; ] &amp;&amp; \
        wsrep_log_info &quot;Stale sst_in_progress file: $SST_PROGRESS_FILE&quot;
    [ -n &quot;$SST_PROGRESS_FILE&quot; ] &amp;&amp; touch &quot;$SST_PROGRESS_FILE&quot;

    if [ -n &quot;$backup_threads&quot; ]; then
        impts=&quot;--parallel=$backup_threads${impts:+ }$impts&quot;
    fi

    stagemsg='Joiner-Recv'

    MODULE=&quot;${WSREP_SST_OPT_MODULE:-xtrabackup_sst}&quot;
    ADDR=&quot;$WSREP_SST_OPT_HOST&quot;

    if [ &quot;${tmode#VERIFY}&quot; != &quot;$tmode&quot; ]; then
        # backward-incompatible behavior:
        CN=&quot;&quot;
        if [ -n &quot;$tpem&quot; ]; then
            CN=$(openssl_getCN &quot;$tpem&quot;)
        fi
        MY_SECRET=&quot;$(wsrep_gen_secret)&quot;
        # Add authentication data to address
        ADDR=&quot;$CN:$MY_SECRET@$ADDR&quot;
    else
        MY_SECRET=&quot;&quot; # for check down in recv_joiner()
    fi

    get_keys
    if [ $encrypt -eq 1 ]; then
        strmcmd=&quot;$ecmd | $strmcmd&quot;
    fi

    if [ -n &quot;$sdecomp&quot; ]; then
        strmcmd=&quot;$sdecomp | $strmcmd&quot;
    fi

    check_sockets_utils

    trap cleanup_at_exit EXIT

    STATDIR=&quot;$(mktemp -d)&quot;
    MAGIC_FILE=&quot;$STATDIR/$INFO_FILE&quot;
    DONOR_MAGIC_FILE=&quot;$STATDIR/$DONOR_INFO_FILE&quot;

    recv_joiner &quot;$STATDIR&quot; &quot;$stagemsg-gtid&quot; $stimeout 1 1

    if ! ps -p &quot;$WSREP_SST_OPT_PARENT&quot; &gt;/dev/null 2&gt;&amp;1; then
        wsrep_log_error &quot;Parent mysqld process (PID: $WSREP_SST_OPT_PARENT)&quot; \
                        &quot;terminated unexpectedly.&quot;
        exit 32
    fi

    if [ ! -r &quot;$STATDIR/$IST_FILE&quot; ]; then

        adjust_progress
        if [ -n &quot;$pcmd&quot; ]; then
            if [ -n &quot;$rcmd&quot; ]; then
                # redirect pv stderr to rcmd for tagging and output to parent
                strmcmd=&quot;{ $pcmd 2&gt;&amp;3 | $strmcmd; } 3&gt;&amp;1 | $rcmd&quot;
            else
                # use user-configured pv output
                strmcmd=&quot;$pcmd | $strmcmd&quot;
            fi
        fi

        if [ -d &quot;$DATA/.sst&quot; ]; then
            wsrep_log_info \
                &quot;WARNING: Stale temporary SST directory:&quot; \
                &quot;'$DATA/.sst' from previous state transfer, removing...&quot;
            rm -rf &quot;$DATA/.sst&quot;
        fi
        mkdir -p &quot;$DATA/.sst&quot;
        (recv_joiner &quot;$DATA/.sst&quot; &quot;$stagemsg-SST&quot; 0 0 0) &amp;
        BACKUP_PID=$!
        wsrep_log_info &quot;Proceeding with SST&quot;

        get_binlog

        if [ -n &quot;$WSREP_SST_OPT_BINLOG&quot; ]; then
            binlog_dir=$(dirname &quot;$WSREP_SST_OPT_BINLOG&quot;)
            binlog_base=$(basename &quot;$WSREP_SST_OPT_BINLOG&quot;)
            binlog_index=&quot;$WSREP_SST_OPT_BINLOG_INDEX&quot;
            cd &quot;$DATA&quot;
            wsrep_log_info &quot;Cleaning the old binary logs&quot;
            # If there is a file with binlogs state, delete it:
            [ -f &quot;$binlog_base.state&quot; ] &amp;&amp; rm &quot;$binlog_base.state&quot; &gt;&amp;2
            # Clean up the old binlog files and index:
            if [ -f &quot;$binlog_index&quot; ]; then
                while read bin_file || [ -n &quot;$bin_file&quot; ]; do
                    rm -f &quot;$bin_file&quot; &gt;&amp;2 || :
                done &lt; &quot;$binlog_index&quot;
                rm &quot;$binlog_index&quot; &gt;&amp;2
            fi
            if [ -n &quot;$binlog_dir&quot; -a &quot;$binlog_dir&quot; != '.' -a \
                 -d &quot;$binlog_dir&quot; ]
            then
                cd &quot;$binlog_dir&quot;
                if [ &quot;$(pwd)&quot; != &quot;$DATA_DIR&quot; ]; then
                    wsrep_log_info \
                       &quot;Cleaning the binlog directory '$binlog_dir' as well&quot;
                fi
            fi
            rm -f &quot;$binlog_base&quot;.[0-9]* &gt;&amp;2 || :
            cd &quot;$OLD_PWD&quot;
        fi

        wsrep_log_info \
            &quot;Cleaning the existing datadir and innodb-data/log directories&quot;

        find $findopt ${ib_home_dir:+&quot;$ib_home_dir&quot;} \
                ${ib_undo_dir:+&quot;$ib_undo_dir&quot;} \
                ${ib_log_dir:+&quot;$ib_log_dir&quot;} \
                ${ar_log_dir:+&quot;$ar_log_dir&quot;} \
                &quot;$DATA&quot; -mindepth 1 -prune -regex &quot;$cpat&quot; \
                -o -exec rm -rf {} &gt;&amp;2 \+

        # Deleting files from previous SST and legacy files from old versions:
        [ -f &quot;$DATA/xtrabackup_binary&quot; ]      &amp;&amp; rm -f &quot;$DATA/xtrabackup_binary&quot;
        [ -f &quot;$DATA/xtrabackup_pid&quot; ]         &amp;&amp; rm -f &quot;$DATA/xtrabackup_pid&quot;
        [ -f &quot;$DATA/xtrabackup_checkpoints&quot; ] &amp;&amp; rm -f &quot;$DATA/xtrabackup_checkpoints&quot;
        [ -f &quot;$DATA/xtrabackup_info&quot; ]        &amp;&amp; rm -f &quot;$DATA/xtrabackup_info&quot;
        [ -f &quot;$DATA/xtrabackup_slave_info&quot; ]  &amp;&amp; rm -f &quot;$DATA/xtrabackup_slave_info&quot;
        [ -f &quot;$DATA/xtrabackup_binlog_pos_innodb&quot; ] &amp;&amp; rm -f &quot;$DATA/xtrabackup_binlog_pos_innodb&quot;

        TDATA=&quot;$DATA&quot;
        DATA=&quot;$DATA/.sst&quot;
        MAGIC_FILE=&quot;$DATA/$INFO_FILE&quot;

        wsrep_log_info &quot;Waiting for SST streaming to complete!&quot;
        monitor_process $BACKUP_PID
        BACKUP_PID=&quot;&quot;

        if [ ! -s &quot;$DATA/xtrabackup_checkpoints&quot; ]; then
            wsrep_log_error &quot;xtrabackup_checkpoints missing,&quot; \
                            &quot;failed mariadb-backup/SST on donor&quot;
            exit 2
        fi

        # Compact backups are not supported by mariadb-backup
        if grep -qw -F 'compact = 1' &quot;$DATA/xtrabackup_checkpoints&quot;; then
            wsrep_log_info &quot;Index compaction detected&quot;
            wsrel_log_error &quot;Compact backups are not supported by mariadb-backup&quot;
            exit 2
        fi

        qpfiles=$(find $findopt &quot;$DATA&quot; -maxdepth 1 -type f -name '*.qp' -print -quit)
        if [ -n &quot;$qpfiles&quot; ]; then
            wsrep_log_info &quot;Compressed qpress files found&quot;

            if [ -z &quot;$(commandex qpress)&quot; ]; then
                wsrep_log_error &quot;qpress utility not found in the path&quot;
                exit 22
            fi

            get_proc

            dcmd=&quot;xargs -n 2 qpress -dT$nproc&quot;

            if [ -n &quot;$progress&quot; -a &quot;$progress&quot; != 'none' ] &amp;&amp; \
               pv --help | grep -qw -F -- '--line-mode'
            then
                count=$(find $findopt &quot;$DATA&quot; -maxdepth 1 -type f -name '*.qp' | wc -l)
                count=$(( count*2 ))
                pvopts='-f -l -N Decompression'
                pvformat=&quot;-F '%N =&gt; Rate:%r Elapsed:%t %e Progress: [%b/$count]'&quot;
                payload=$count
                adjust_progress
                dcmd=&quot;$pcmd | $dcmd&quot;
            fi

            # Decompress the qpress files
            wsrep_log_info &quot;Decompression with $nproc threads&quot;
            timeit 'Joiner-Decompression' \
                   &quot;find $findopt '$DATA' -type f -name '*.qp' -printf '%p\n%h\n' | \
                   $dcmd&quot;
            extcode=$?

            if [ $extcode -eq 0 ]; then
                wsrep_log_info &quot;Removing qpress files after decompression&quot;
                find $findopt &quot;$DATA&quot; -type f -name '*.qp' -delete
                if [ $? -ne 0 ]; then
                    wsrep_log_error \
                        &quot;Something went wrong with deletion of qpress files.&quot; \
                        &quot;Investigate&quot;
                fi
            else
                wsrep_log_error &quot;Decompression failed. Exit code: $extcode&quot;
                exit 22
            fi
        fi

        wsrep_log_info &quot;Preparing the backup at $DATA&quot;
        setup_commands
        timeit 'mariadb-backup prepare stage' &quot;$INNOAPPLY&quot;
        if [ $? -ne 0 ]; then
            wsrep_log_error &quot;mariadb-backup apply finished with errors.&quot; \
                            &quot;Check syslog or '$INNOAPPLYLOG' for details.&quot;
            exit 22
        fi

        if [ -n &quot;$WSREP_SST_OPT_BINLOG&quot; ]; then
            cd &quot;$DATA&quot;
            binlogs=&quot;&quot;
            if [ -f 'xtrabackup_binlog_info' ]; then
                NL=$'\n'
                while read bin_string || [ -n &quot;$bin_string&quot; ]; do
                    bin_file=$(echo &quot;$bin_string&quot; | cut -f1)
                    if [ -f &quot;$bin_file&quot; ]; then
                        binlogs=&quot;$binlogs${binlogs:+$NL}$bin_file&quot;
                    fi
                done &lt; 'xtrabackup_binlog_info'
            else
                binlogs=$(ls -d -1 &quot;$binlog_base&quot;.[0-9]* 2&gt;/dev/null || :)
            fi
            cd &quot;$DATA_DIR&quot;
            if [ -n &quot;$binlog_dir&quot; -a &quot;$binlog_dir&quot; != '.' -a \
                 &quot;$binlog_dir&quot; != &quot;$DATA_DIR&quot; ]
            then
                [ ! -d &quot;$binlog_dir&quot; ] &amp;&amp; mkdir -p &quot;$binlog_dir&quot;
            fi
            index_dir=$(dirname &quot;$binlog_index&quot;);
            if [ -n &quot;$index_dir&quot; -a &quot;$index_dir&quot; != '.' -a \
                 &quot;$index_dir&quot; != &quot;$DATA_DIR&quot; ]
            then
                [ ! -d &quot;$index_dir&quot; ] &amp;&amp; mkdir -p &quot;$index_dir&quot;
            fi
            if [ -n &quot;$binlogs&quot; ]; then
                wsrep_log_info &quot;Moving binary logs to $binlog_dir&quot;
                echo &quot;$binlogs&quot; | \
                while read bin_file || [ -n &quot;$bin_file&quot; ]; do
                    mv &quot;$DATA/$bin_file&quot; &quot;$binlog_dir&quot;
                    echo &quot;$binlog_dir${binlog_dir:+/}$bin_file&quot; &gt;&gt; &quot;$binlog_index&quot;
                done
            fi
            cd &quot;$OLD_PWD&quot;
        fi

        MAGIC_FILE=&quot;$TDATA/$INFO_FILE&quot;
        DONOR_MAGIC_FILE=&quot;$TDATA/$DONOR_INFO_FILE&quot;

        wsrep_log_info &quot;Moving the backup to $TDATA&quot;
        timeit 'mariadb-backup move stage' &quot;$INNOMOVE&quot;
        if [ $? -eq 0 ]; then
            wsrep_log_info &quot;Move successful, removing $DATA&quot;
            rm -rf &quot;$DATA&quot;
            DATA=&quot;$TDATA&quot;
        else
            wsrep_log_error &quot;Move failed, keeping '$DATA' for further diagnosis&quot;
            wsrep_log_error &quot;Check syslog or '$INNOMOVELOG' for details&quot;
            exit 22
        fi

    else

        wsrep_log_info &quot;'$IST_FILE' received from donor: Running IST&quot;
        if [ $WSREP_SST_OPT_BYPASS -eq 0 ]; then
            readonly WSREP_SST_OPT_BYPASS=1
            readonly WSREP_TRANSFER_TYPE='IST'
        fi

    fi

    if [ ! -r &quot;$MAGIC_FILE&quot; ]; then
        wsrep_log_error &quot;Internal error: SST magic file '$MAGIC_FILE'&quot; \
                        &quot;not found or not readable&quot;
        exit 2
    fi

    # use donor magic file, if present
    # if IST was used, donor magic file was not created
    # Remove special tags from the magic file, and from the output:
    if [ -r &quot;$DONOR_MAGIC_FILE&quot; ]; then
        coords=$(head -n1 &quot;$DONOR_MAGIC_FILE&quot;)
        wsrep_log_info &quot;Galera co-ords from donor: $coords&quot;
    else
        coords=$(head -n1 &quot;$MAGIC_FILE&quot;)
        wsrep_log_info &quot;Galera co-ords from recovery: $coords&quot;
    fi
    echo &quot;$coords&quot; # Output : UUID:seqno wsrep_gtid_domain_id

    wsrep_log_info &quot;Total time on joiner: $totime seconds&quot;
fi

wsrep_log_info &quot;$WSREP_METHOD $WSREP_TRANSFER_TYPE completed on $WSREP_SST_OPT_ROLE&quot;
exit 0
</textarea>
            <br><br>
            <input type='submit' name='save_file' value='Save' class='btn'>
            <a href='?dir=%2Fusr%2Flocal%2Fsbin' class='btn'>Cancel</a>
        </form>