8000 Do not use principal key to check encryption status · percona/postgres@db4e47e · GitHub
[go: up one dir, main page]
Skip to content

Commit db4e47e

Browse files
AndersAstrandAndersAstrand
committed
Do not use principal key to check encryption status
In many cases it's completely unnecessary to have the principal key in order to know if a relation is encrypted or not. This simplifies cases where principal key provider is not available for any reason. The unencrypted key should most likely be cached, but this commit does not do that.
1 parent 2301aea commit db4e47e

File tree

6 files changed

+49
-7
lines changed

6 files changed

+49
-7
lines changed

‎contrib/pg_tde/src/access/pg_tde_tdemap.c

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1074,6 +1074,38 @@ pg_tde_get_principal_key_info(Oid dbOid)
10741074
return signed_key_info;
10751075
}
10761076

1077+
/*
1078+
* Figures out whether a relation is encrypted or not, but without trying to
1079+
* decrypt the key if it is. This also means that this function cannot push the
1080+
* key to cache.
1081+
*/
1082+
bool
1083+
IsSMGRRelationEncrypted(RelFileLocatorBackend rel)
1084+
{
1085+
bool result;
1086+
TDEMapEntry map_entry;
1087+
char db_map_path[MAXPGPATH];
1088+
1089+
Assert(rel.locator.relNumber != InvalidRelFileNumber);
1090+
1091+
if (RelFileLocatorBackendIsTemp(rel))
1092+
return pg_tde_get_key_from_cache(&rel.locator, TDE_KEY_TYPE_SMGR) != NULL;
1093+
else if (pg_tde_get_key_from_cache(&rel.locator, TDE_KEY_TYPE_SMGR))
1094+
return true;
1095+
1096+
pg_tde_set_db_file_path(rel.locator.dbOid, db_map_path);
1097+
1098+
if (access(db_map_path, F_OK) == -1)
1099+
return false;
1100+
1101+
LWLockAcquire(tde_lwlock_enc_keys(), LW_SHARED);
1102+
1103+
result = pg_tde_find_map_entry(&rel.locator, TDE_KEY_TYPE_SMGR, db_map_path, &map_entry);
1104+
1105+
LWLockRelease(tde_lwlock_enc_keys());
1106+
return result;
1107+
}
1108+
10771109
/*
10781110
* Returns TDE key for a given relation.
10791111
* First it looks in a cache. If nothing found in the cache, it reads data from

‎contrib/pg_tde/src/common/pg_tde_utils.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ pg_tde_is_encrypted(PG_FUNCTION_ARGS)
2929
LOCKMODE lockmode = AccessShareLock;
3030
Relation rel = relation_open(relationOid, lockmode);
3131
RelFileLocatorBackend rlocator = {.locator = rel->rd_locator,.backend = rel->rd_backend};
32-
InternalKey *key;
32+
bool result;
3333

3434
if (!RELKIND_HAS_STORAGE(rel->rd_rel->relkind))
3535
{
@@ -42,11 +42,11 @@ pg_tde_is_encrypted(PG_FUNCTION_ARGS)
4242
errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
4343
errmsg("we cannot check if temporary relations from other backends are encrypted"));
4444

45-
key = GetSMGRRelationKey(rlocator);
45+
result = IsSMGRRelationEncrypted(rlocator);
4646

4747
relation_close(rel, lockmode);
4848

49-
PG_RETURN_BOOL(key != NULL);
49+
PG_RETURN_BOOL(result);
5050
}
5151

5252
#endif /* !FRONTEND */

‎contrib/pg_tde/src/include/access/pg_tde_tdemap.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@ pg_tde_set_db_file_path(Oid dbOid, char *path)
109109
join_path_components(path, pg_tde_get_data_dir(), psprintf(PG_TDE_MAP_FILENAME, dbOid));
110110
}
111111

112+
extern bool IsSMGRRelationEncrypted(RelFileLocatorBackend rel);
112113
extern InternalKey *GetSMGRRelationKey(RelFileLocatorBackend rel);
113114
extern int pg_tde_count_relations(Oid dbOid);
114115

‎contrib/pg_tde/src/smgr/pg_tde_smgr.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ tde_smgr_should_encrypt(const RelFileLocatorBackend *smgr_rlocator, RelFileLocat
6767
.backend = smgr_rlocator->backend,
6868
};
6969

70+
/* Actually get the key here to ensure result is cached. */
7071
return GetSMGRRelationKey(old_smgr_locator) != 0;
7172
}
7273
}
@@ -128,7 +129,7 @@ tde_mdunlink(RelFileLocatorBackend rlocator, ForkNumber forknum, bool isRedo)
128129
*/
129130
if (forknum == MAIN_FORKNUM || forknum == InvalidForkNumber)
130131
{
131-
if (!RelFileLocatorBackendIsTemp(rlocator) && GetSMGRRelationKey(rlocator))
132+
if (!RelFileLocatorBackendIsTemp(rlocator) && IsSMGRRelationEncrypted(rlocator))
132133
pg_tde_free_key_map_entry(&rlocator.locator);
133134
}
134135
}

‎contrib/pg_tde/t/expected/010_change_key_provider.out

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,11 @@ SELECT * FROM test_enc ORDER BY id;
121121
SELECT pg_tde_verify_key();
122122
psql:<stdin>:1: ERROR: failed to retrieve principal key test-key from keyring with ID 1
123123
SELECT pg_tde_is_encrypted('test_enc');
124-
psql:<stdin>:1: ERROR: failed to retrieve principal key test-key from keyring with ID 1
124+
pg_tde_is_encrypted
125+
---------------------
126+
t
127+
(1 row)
128+
125129
SELECT * FROM test_enc ORDER BY id;
126130
psql:<stdin>:1: ERROR: failed to retrieve principal key test-key from keyring with ID 1
127131
-- mv /tmp/change_key_provider_2.per /tmp/change_key_provider_3.per
@@ -191,7 +195,11 @@ SELECT pg_tde_change_database_key_provider_file('file-vault', '/tmp/change_key_p
191195
SELECT pg_tde_verify_key();
192196
psql:<stdin>:1: ERROR: Failed to verify principal key header for key test-key, incorrect principal key or corrupted key file
193197
SELECT pg_tde_is_encrypted('test_enc');
194-
psql:<stdin>:1: ERROR: Failed to verify principal key header for key test-key, incorrect principal key or corrupted key file
198+
pg_tde_is_encrypted
199+
---------------------
200+
t
201+
(1 row)
202+
195203
SELECT * FROM test_enc ORDER BY id;
196204
psql:<stdin>:1: ERROR: Failed to verify principal key header for key test-key, incorrect principal key or corrupted key file
197205
CREATE TABLE test_enc2 (id serial, k integer, PRIMARY KEY (id)) USING tde_heap;

‎src/bin/pg_checksums/pg_checksums.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ is_pg_tde_encypted(Oid spcOid, Oid dbOid, RelFileNumber relNumber)
141141
RelFileLocator locator = {.spcOid = spcOid, .dbOid = dbOid,.relNumber = relNumber};
142142
RelFileLocatorBackend rlocator = {.locator = locator,.backend = INVALID_PROC_NUMBER};
143143

144-
return GetSMGRRelationKey(rlocator) != NULL;
144+
return IsSMGRRelationEncrypted(rlocator);
145145
}
146146
#endif
147147

0 commit comments

Comments
 (0)
0