Skip to content

PG-1592 Return all nulls for key info when no key #391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 5, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions contrib/pg_tde/expected/default_principal_key.out
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,11 @@ ERROR: principal key not configured for current database
-- Should fail: no default principal key for the server yet
SELECT key_provider_id, key_provider_name, key_name
FROM pg_tde_default_key_info();
ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT pg_tde_set_default_key_using_global_key_provider('default-key', 'file-provider', false);
pg_tde_set_default_key_using_global_key_provider
--------------------------------------------------
Expand Down Expand Up @@ -48,8 +51,11 @@ SELECT id, provider_name FROM pg_tde_list_all_global_key_providers();
-- Should fail: no principal key for the database yet
SELECT key_provider_id, key_provider_name, key_name
FROM pg_tde_key_info();
ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

-- Should succeed: "localizes" the default principal key for the database
CREATE TABLE test_enc(
id SERIAL,
Expand All @@ -74,8 +80,11 @@ CREATE EXTENSION pg_buffercache;
-- Should fail: no principal key for the database yet
SELECT key_provider_id, key_provider_name, key_name
FROM pg_tde_key_info();
ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

-- Should succeed: "localizes" the default principal key for the database
CREATE TABLE test_enc(
id SERIAL,
Expand Down
7 changes: 5 additions & 2 deletions contrib/pg_tde/expected/key_provider.out
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT * FROM pg_tde_key_info();
ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_name | key_provider_name | key_provider_id | key_creation_time
----------+-------------------+-----------------+-------------------
| | |
(1 row)

SELECT pg_tde_add_database_key_provider_file('incorrect-file-provider', json_object('foo' VALUE '/tmp/pg_tde_test_keyring.per'));
ERROR: key provider value cannot be an object
SELECT pg_tde_add_database_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per');
Expand Down
61 changes: 26 additions & 35 deletions contrib/pg_tde/src/catalog/tde_principal_key.c
Original file line number Diff line number Diff line change
Expand Up @@ -625,64 +625,55 @@ pg_tde_get_key_info(PG_FUNCTION_ARGS, Oid dbOid)
Datum values[6];
bool isnull[6];
HeapTuple tuple;
Datum result;
TDEPrincipalKey *principal_key;
TimestampTz ts;
GenericKeyring *keyring;

/* Build a tuple descriptor for our result type */
if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
ereport(ERROR,
errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("function returning record called in context that cannot accept type record"));

LWLockAcquire(tde_lwlock_enc_keys(), LW_SHARED);

principal_key = GetPrincipalKeyNoDefault(dbOid, LW_SHARED);

if (principal_key == NULL)
{
ereport(ERROR,
errmsg("Principal key does not exists for the database"),
errhint("Use set_key interface to set the principal key"));
memset(isnull, true, sizeof(isnull));
}
else
{
GenericKeyring *keyring = GetKeyProviderByID(principal_key->keyInfo.keyringId, principal_key->keyInfo.databaseId);
TimestampTz ts;

keyring = GetKeyProviderByID(principal_key->keyInfo.keyringId, principal_key->keyInfo.databaseId);
values[0] = CStringGetTextDatum(principal_key->keyInfo.name);
isnull[0] = false;

/* Initialize the values and null flags */
if (keyring)
{
values[1] = CStringGetTextDatum(keyring->provider_name);
isnull[1] = false;
}
else
isnull[1] = true;

/* TEXT: Principal key name */
values[0] = CStringGetTextDatum(principal_key->keyInfo.name);
isnull[0] = false;
/* TEXT: Keyring provider name */
if (keyring)
{
values[1] = CStringGetTextDatum(keyring->provider_name);
isnull[1] = false;
}
else
isnull[1] = true;
values[2] = Int32GetDatum(principal_key->keyInfo.keyringId);
isnull[2] = false;

/* INTEGERT: key provider id */
values[2] = Int32GetDatum(principal_key->keyInfo.keyringId);
isnull[2] = false;
ts = (TimestampTz) principal_key->keyInfo.creationTime.tv_sec - ((POSTGRES_EPOCH_JDATE - UNIX_EPOCH_JDATE) * SECS_PER_DAY);
ts = (ts * USECS_PER_SEC) + principal_key->keyInfo.creationTime.tv_usec;
values[3] = TimestampTzGetDatum(ts);
isnull[3] = false;

/* TIMESTAMP TZ: Principal key creation time */
ts = (TimestampTz) principal_key->keyInfo.creationTime.tv_sec - ((POSTGRES_EPOCH_JDATE - UNIX_EPOCH_JDATE) * SECS_PER_DAY);
ts = (ts * USECS_PER_SEC) + principal_key->keyInfo.creationTime.tv_usec;
values[3] = TimestampTzGetDatum(ts);
isnull[3] = false;
pfree(keyring);
}

LWLockRelease(tde_lwlock_enc_keys());

/* Form the tuple */
tuple = heap_form_tuple(tupdesc, values, isnull);

/* Make the tuple into a datum */
result = HeapTupleGetDatum(tuple);

pfree(keyring);

PG_RETURN_DATUM(result);
PG_RETURN_DATUM(HeapTupleGetDatum(tuple));
}

#endif /* FRONTEND */

/*
Expand Down
42 changes: 30 additions & 12 deletions contrib/pg_tde/t/expected/rotate_key.out
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT * FROM test_enc ORDER BY id;
id | k
----+---
Expand Down Expand Up @@ -96,8 +99,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT * FROM test_enc ORDER BY id;
id | k
----+---
Expand Down Expand Up @@ -126,8 +132,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT * FROM test_enc ORDER BY id;
id | k
----+---
Expand Down Expand Up @@ -156,8 +165,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT * FROM test_enc ORDER BY id;
id | k
----+---
Expand All @@ -176,8 +188,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

SELECT pg_tde_set_key_using_database_key_provider('rotated-key2', 'file-2');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand All @@ -191,8 +206,11 @@ SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_key_info();
(1 row)

SELECT key_provider_id, key_provider_name, key_name FROM pg_tde_server_key_info();
psql:<stdin>:1: ERROR: Principal key does not exists for the database
HINT: Use set_key interface to set the principal key
key_provider_id | key_provider_name | key_name
-----------------+-------------------+----------
| |
(1 row)

DROP TABLE test_enc;
ALTER SYSTEM RESET pg_tde.inherit_global_providers;
-- server restart
Expand Down
12 changes: 12 additions & 0 deletions contrib/pg_tde/t/expected/wal_encrypt.out
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,12 @@ SELECT pg_tde_add_global_key_provider_file('file-keyring-010', '/tmp/pg_tde_test

SELECT pg_tde_verify_server_key();
psql:<stdin>:1: ERROR: principal key not configured for current database
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();
key_name | key_provider_name | key_provider_id
----------+-------------------+-----------------
| |
(1 row)

SELECT pg_tde_set_server_key_using_global_key_provider('server-key', 'file-keyring-010');
pg_tde_set_server_key_using_global_key_provider
-------------------------------------------------
Expand All @@ -19,6 +25,12 @@ SELECT pg_tde_verify_server_key();

(1 row)

SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();
key_name | key_provider_name | key_provider_id
------------+-------------------+-----------------
server-key | file-keyring-010 | -1
(1 row)

ALTER SYSTEM SET pg_tde.wal_encrypt = on;
-- server restart with wal encryption
SHOW pg_tde.wal_encrypt;
Expand Down
8 changes: 8 additions & 0 deletions contrib/pg_tde/t/wal_encrypt.pl
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,20 @@

PGTDE::psql($node, 'postgres', 'SELECT pg_tde_verify_server_key();');

PGTDE::psql($node, 'postgres',
'SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();'
);

PGTDE::psql($node, 'postgres',
"SELECT pg_tde_set_server_key_using_global_key_provider('server-key', 'file-keyring-010');"
);

PGTDE::psql($node, 'postgres', 'SELECT pg_tde_verify_server_key();');

PGTDE::psql($node, 'postgres',
'SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();'
);

PGTDE::psql($node, 'postgres', 'ALTER SYSTEM SET pg_tde.wal_encrypt = on;');

PGTDE::append_to_result_file("-- server restart with wal encryption");
Expand Down