@@ -69,7 +69,6 @@ typedef struct TDEFileHeader
69
69
static WALKeyCacheRec * tde_wal_key_cache = NULL ;
70
70
static WALKeyCacheRec * tde_wal_key_last_rec = NULL ;
71
71
72
- static InternalKey * pg_tde_get_key_from_file (const RelFileLocator * rlocator , TDEMapEntryType key_type );
73
72
static bool pg_tde_find_map_entry (const RelFileLocator * rlocator , TDEMapEntryType key_type , char * db_map_path , TDEMapEntry * map_entry );
74
73
static InternalKey * tde_decrypt_rel_key (TDEPrincipalKey * principal_key , TDEMapEntry * map_entry );
75
74
static int pg_tde_open_file_basic (const char * tde_filename , int fileFlags , bool ignore_missing );
@@ -645,59 +644,6 @@ pg_tde_open_file_write(const char *tde_filename, const TDESignedPrincipalKeyInfo
645
644
646
645
#endif /* !FRONTEND */
647
646
648
- /*
649
- * Reads the key of the required relation. It identifies its map entry and then simply
650
- * reads the key data from the keydata file.
651
- */
652
- static InternalKey *
653
- pg_tde_get_key_from_file (const RelFileLocator * rlocator , TDEMapEntryType key_type )
654
- {
655
- TDEMapEntry map_entry ;
656
- TDEPrincipalKey * principal_key ;
657
- LWLock * lock_pk = tde_lwlock_enc_keys ();
658
- char db_map_path [MAXPGPATH ];
659
- InternalKey * rel_key ;
660
-
661
- Assert (rlocator );
662
-
663
- pg_tde_set_db_file_path (rlocator -> dbOid , db_map_path );
664
-
665
- if (access (db_map_path , F_OK ) == -1 )
666
- return NULL ;
667
-
668
- LWLockAcquire (lock_pk , LW_SHARED );
669
-
670
- if (!pg_tde_find_map_entry (rlocator , key_type , db_map_path , & map_entry ))
671
- {
672
- LWLockRelease (lock_pk );
673
- return NULL ;
674
- }
675
-
676
- /*
677
- * Get/generate a principal key, create the key for relation and get the
678
- * encrypted key with bytes to write
679
- *
680
- * We should hold the lock until the internal key is loaded to be sure the
681
- * retrieved key was encrypted with the obtained principal key. Otherwise,
682
- * the next may happen: - GetPrincipalKey returns key "PKey_1". - Some
683
- * other process rotates the Principal key and re-encrypt an Internal key
684
- * with "PKey_2". - We read the Internal key and decrypt it with "PKey_1"
685
- * (that's what we've got). As the result we return an invalid Internal
686
- * key.
687
- */
688
- principal_key = GetPrincipalKey (rlocator -> dbOid , LW_SHARED );
689
- if (principal_key == NULL )
690
- ereport (ERROR ,
691
- errmsg ("principal key not configured" ),
692
- errhint ("create one using pg_tde_set_key before using encrypted tables" ));
693
-
694
- rel_key = tde_decrypt_rel_key (principal_key , & map_entry );
695
-
696
- LWLockRelease (lock_pk );
697
-
698
- return rel_key ;
699
- }
700
-
701
647
/*
702
648
* Returns true if we find a valid match; e.g. type is not set to
703
649
* MAP_ENTRY_EMPTY and the relNumber and spcOid matches the one provided in
@@ -986,14 +932,55 @@ pg_tde_has_smgr_key(RelFileLocator rel)
986
932
}
987
933
988
934
/*
989
- * Returns TDE key for a given relation.
935
+ * Reads the map entry of the relation and decrypts the key .
990
936
*/
991
937
InternalKey *
992
938
pg_tde_get_smgr_key (RelFileLocator rel )
993
939
{
940
+ TDEMapEntry map_entry ;
941
+ TDEPrincipalKey * principal_key ;
942
+ LWLock * lock_pk = tde_lwlock_enc_keys ();
943
+ char db_map_path [MAXPGPATH ];
944
+ InternalKey * rel_key ;
945
+
994
946
Assert (rel .relNumber != InvalidRelFileNumber );
995
947
996
- return pg_tde_get_key_from_file (& rel , TDE_KEY_TYPE_SMGR );
948
+ pg_tde_set_db_file_path (rel .dbOid , db_map_path );
949
+
950
+ if (access (db_map_path , F_OK ) == -1 )
951
+ return NULL ;
952
+
953
+ LWLockAcquire (lock_pk , LW_SHARED );
954
+
955
+ if (!pg_tde_find_map_entry (& rel , TDE_KEY_TYPE_SMGR , db_map_path , & map_entry ))
956
+ {
957
+ LWLockRelease (lock_pk );
958
+ return NULL ;
959
+ }
960
+
961
+ /*
962
+ * Get/generate a principal key, create the key for relation and get the
963
+ * encrypted key with bytes to write
964
+ *
965
+ * We should hold the lock until the internal key is loaded to be sure the
966
+ * retrieved key was encrypted with the obtained principal key. Otherwise,
967
+ * the next may happen: - GetPrincipalKey returns key "PKey_1". - Some
968
+ * other process rotates the Principal key and re-encrypt an Internal key
969
+ * with "PKey_2". - We read the Internal key and decrypt it with "PKey_1"
970
+ * (that's what we've got). As the result we return an invalid Internal
971
+ * key.
972
+ */
973
+ principal_key = GetPrincipalKey (rel .dbOid , LW_SHARED );
974
+ if (principal_key == NULL )
975
+ ereport (ERROR ,
976
+ errmsg ("principal key not configured" ),
977
+ errhint ("create one using pg_tde_set_key before using encrypted tables" ));
978
+
979
+ rel_key = tde_decrypt_rel_key (principal_key , & map_entry );
980
+
981
+ LWLockRelease (lock_pk );
982
+
983
+ return rel_key ;
997
984
}
998
985
999
986
/*
0 commit comments