Skip to content

Commit 69f7a38

Browse files
committed
Fold pg_tde_get_key_from_file() into its caller
Since the caller of the function became a very thin wrapper having both functions no longer make any sense.
1 parent 9618f69 commit 69f7a38

File tree

1 file changed

+43
-56
lines changed

1 file changed

+43
-56
lines changed

contrib/pg_tde/src/access/pg_tde_tdemap.c

Lines changed: 43 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ typedef struct TDEFileHeader
6969
static WALKeyCacheRec *tde_wal_key_cache = NULL;
7070
static WALKeyCacheRec *tde_wal_key_last_rec = NULL;
7171

72-
static InternalKey *pg_tde_get_key_from_file(const RelFileLocator *rlocator, TDEMapEntryType key_type);
7372
static bool pg_tde_find_map_entry(const RelFileLocator *rlocator, TDEMapEntryType key_type, char *db_map_path, TDEMapEntry *map_entry);
7473
static InternalKey *tde_decrypt_rel_key(TDEPrincipalKey *principal_key, TDEMapEntry *map_entry);
7574
static int pg_tde_open_file_basic(const char *tde_filename, int fileFlags, bool ignore_missing);
@@ -645,59 +644,6 @@ pg_tde_open_file_write(const char *tde_filename, const TDESignedPrincipalKeyInfo
645644

646645
#endif /* !FRONTEND */
647646

648-
/*
649-
* Reads the key of the required relation. It identifies its map entry and then simply
650-
* reads the key data from the keydata file.
651-
*/
652-
static InternalKey *
653-
pg_tde_get_key_from_file(const RelFileLocator *rlocator, TDEMapEntryType key_type)
654-
{
655-
TDEMapEntry map_entry;
656-
TDEPrincipalKey *principal_key;
657-
LWLock *lock_pk = tde_lwlock_enc_keys();
658-
char db_map_path[MAXPGPATH];
659-
InternalKey *rel_key;
660-
661-
Assert(rlocator);
662-
663-
pg_tde_set_db_file_path(rlocator->dbOid, db_map_path);
664-
665-
if (access(db_map_path, F_OK) == -1)
666-
return NULL;
667-
668-
LWLockAcquire(lock_pk, LW_SHARED);
669-
670-
if (!pg_tde_find_map_entry(rlocator, key_type, db_map_path, &map_entry))
671-
{
672-
LWLockRelease(lock_pk);
673-
return NULL;
674-
}
675-
676-
/*
677-
* Get/generate a principal key, create the key for relation and get the
678-
* encrypted key with bytes to write
679-
*
680-
* We should hold the lock until the internal key is loaded to be sure the
681-
* retrieved key was encrypted with the obtained principal key. Otherwise,
682-
* the next may happen: - GetPrincipalKey returns key "PKey_1". - Some
683-
* other process rotates the Principal key and re-encrypt an Internal key
684-
* with "PKey_2". - We read the Internal key and decrypt it with "PKey_1"
685-
* (that's what we've got). As the result we return an invalid Internal
686-
* key.
687-
*/
688-
principal_key = GetPrincipalKey(rlocator->dbOid, LW_SHARED);
689-
if (principal_key == NULL)
690-
ereport(ERROR,
691-
errmsg("principal key not configured"),
692-
errhint("create one using pg_tde_set_key before using encrypted tables"));
693-
694-
rel_key = tde_decrypt_rel_key(principal_key, &map_entry);
695-
696-
LWLockRelease(lock_pk);
697-
698-
return rel_key;
699-
}
700-
701647
/*
702648
* Returns true if we find a valid match; e.g. type is not set to
703649
* MAP_ENTRY_EMPTY and the relNumber and spcOid matches the one provided in
@@ -986,14 +932,55 @@ pg_tde_has_smgr_key(RelFileLocator rel)
986932
}
987933

988934
/*
989-
* Returns TDE key for a given relation.
935+
* Reads the map entry of the relation and decrypts the key.
990936
*/
991937
InternalKey *
992938
pg_tde_get_smgr_key(RelFileLocator rel)
993939
{
940+
TDEMapEntry map_entry;
941+
TDEPrincipalKey *principal_key;
942+
LWLock *lock_pk = tde_lwlock_enc_keys();
943+
char db_map_path[MAXPGPATH];
944+
InternalKey *rel_key;
945+
994946
Assert(rel.relNumber != InvalidRelFileNumber);
995947

996-
return pg_tde_get_key_from_file(&rel, TDE_KEY_TYPE_SMGR);
948+
pg_tde_set_db_file_path(rel.dbOid, db_map_path);
949+
950+
if (access(db_map_path, F_OK) == -1)
951+
return NULL;
952+
953+
LWLockAcquire(lock_pk, LW_SHARED);
954+
955+
if (!pg_tde_find_map_entry(&rel, TDE_KEY_TYPE_SMGR, db_map_path, &map_entry))
956+
{
957+
LWLockRelease(lock_pk);
958+
return NULL;
959+
}
960+
961+
/*
962+
* Get/generate a principal key, create the key for relation and get the
963+
* encrypted key with bytes to write
964+
*
965+
* We should hold the lock until the internal key is loaded to be sure the
966+
* retrieved key was encrypted with the obtained principal key. Otherwise,
967+
* the next may happen: - GetPrincipalKey returns key "PKey_1". - Some
968+
* other process rotates the Principal key and re-encrypt an Internal key
969+
* with "PKey_2". - We read the Internal key and decrypt it with "PKey_1"
970+
* (that's what we've got). As the result we return an invalid Internal
971+
* key.
972+
*/
973+
principal_key = GetPrincipalKey(rel.dbOid, LW_SHARED);
974+
if (principal_key == NULL)
975+
ereport(ERROR,
976+
errmsg("principal key not configured"),
977+
errhint("create one using pg_tde_set_key before using encrypted tables"));
978+
979+
rel_key = tde_decrypt_rel_key(principal_key, &map_entry);
980+
981+
LWLockRelease(lock_pk);
982+
983+
return rel_key;
997984
}
998985

999986
/*

0 commit comments

Comments
 (0)