Skip to content

Remove RelFileLocator from the WAL key file #503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 7, 2025
Merged

Remove RelFileLocator from the WAL key file #503

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
832eb09
Use correct struct when calculating offset
jeltz Aug 7, 2025
57a7937
Remove RelFileLocator from the WAL key file
jeltz Aug 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 15 additions & 27 deletions contrib/pg_tde/src/access/pg_tde_xlog_keys.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,16 @@ static WALKeyCacheRec *tde_wal_key_last_rec = NULL;

static WALKeyCacheRec *pg_tde_add_wal_key_to_cache(WalEncryptionKey *cached_key, XLogRecPtr start_lsn);
static WalEncryptionKey *pg_tde_decrypt_wal_key(TDEPrincipalKey *principal_key, WalKeyFileEntry *entry);
static void pg_tde_initialize_wal_key_file_entry(WalKeyFileEntry *entry, const TDEPrincipalKey *principal_key, const RelFileLocator *rlocator, const WalEncryptionKey *rel_key_data);
static void pg_tde_initialize_wal_key_file_entry(WalKeyFileEntry *entry, const TDEPrincipalKey *principal_key, const WalEncryptionKey *rel_key_data);
static int pg_tde_open_wal_key_file_basic(const char *filename, int flags, bool ignore_missing);
static int pg_tde_open_wal_key_file_read(const char *filename, bool ignore_missing, off_t *curr_pos);
static int pg_tde_open_wal_key_file_write(const char *filename, const TDESignedPrincipalKeyInfo *signed_key_info, bool truncate, off_t *curr_pos);
static bool pg_tde_read_one_wal_key_file_entry(int fd, WalKeyFileEntry *entry, off_t *offset);
static void pg_tde_read_one_wal_key_file_entry2(int fd, int32 key_index, WalKeyFileEntry *entry, Oid databaseId);
static void pg_tde_read_one_wal_key_file_entry2(int fd, int32 key_index, WalKeyFileEntry *entry);
static void pg_tde_wal_key_file_header_read(const char *filename, int fd, WalKeyFileHeader *fheader, off_t *bytes_read);
static int pg_tde_wal_key_file_header_write(const char *filename, int fd, const TDESignedPrincipalKeyInfo *signed_key_info, off_t *bytes_written);
static void pg_tde_write_one_wal_key_file_entry(int fd, const WalKeyFileEntry *entry, off_t *offset, const char *db_map_path);
static void pg_tde_write_wal_key_file_entry(const RelFileLocator *rlocator, const WalEncryptionKey *rel_key_data, TDEPrincipalKey *principal_key);
static void pg_tde_write_wal_key_file_entry(const WalEncryptionKey *rel_key_data, TDEPrincipalKey *principal_key);

static char *
get_wal_key_file_path(void)
Expand Down Expand Up @@ -129,15 +129,13 @@ pg_tde_wal_last_key_set_lsn(XLogRecPtr lsn)
* with the actual lsn by the first WAL write.
*/
void
pg_tde_create_wal_key(WalEncryptionKey *rel_key_data,
const RelFileLocator *newrlocator,
TDEMapEntryType entry_type)
pg_tde_create_wal_key(WalEncryptionKey *rel_key_data, TDEMapEntryType entry_type)
{
TDEPrincipalKey *principal_key;

LWLockAcquire(tde_lwlock_enc_keys(), LW_EXCLUSIVE);

principal_key = GetPrincipalKey(newrlocator->dbOid, LW_EXCLUSIVE);
principal_key = GetPrincipalKey(GLOBAL_DATA_TDE_OID, LW_EXCLUSIVE);
if (principal_key == NULL)
{
ereport(ERROR,
Expand All @@ -160,7 +158,7 @@ pg_tde_create_wal_key(WalEncryptionKey *rel_key_data,
errmsg("could not generate IV for WAL encryption key: %s",
ERR_error_string(ERR_get_error(), NULL)));

pg_tde_write_wal_key_file_entry(newrlocator, rel_key_data, principal_key);
pg_tde_write_wal_key_file_entry(rel_key_data, principal_key);

#ifdef FRONTEND
free(principal_key);
Expand All @@ -186,7 +184,6 @@ pg_tde_get_wal_cache_keys(void)
WalEncryptionKey *
pg_tde_read_last_wal_key(void)
{
RelFileLocator rlocator = GLOBAL_SPACE_RLOCATOR(XLOG_TDE_OID);
off_t read_pos = 0;
LWLock *lock_pk = tde_lwlock_enc_keys();
TDEPrincipalKey *principal_key;
Expand All @@ -197,7 +194,7 @@ pg_tde_read_last_wal_key(void)
off_t fsize;

LWLockAcquire(lock_pk, LW_EXCLUSIVE);
principal_key = GetPrincipalKey(rlocator.dbOid, LW_EXCLUSIVE);
principal_key = GetPrincipalKey(GLOBAL_DATA_TDE_OID, LW_EXCLUSIVE);
if (principal_key == NULL)
{
LWLockRelease(lock_pk);
Expand All @@ -219,7 +216,7 @@ pg_tde_read_last_wal_key(void)
}

file_idx = ((fsize - sizeof(WalKeyFileHeader)) / sizeof(WalKeyFileEntry)) - 1;
pg_tde_read_one_wal_key_file_entry2(fd, file_idx, &entry, rlocator.dbOid);
pg_tde_read_one_wal_key_file_entry2(fd, file_idx, &entry);

rel_key_data = pg_tde_decrypt_wal_key(principal_key, &entry);
#ifdef FRONTEND
Expand All @@ -235,7 +232,6 @@ pg_tde_read_last_wal_key(void)
WALKeyCacheRec *
pg_tde_fetch_wal_keys(XLogRecPtr start_lsn)
{
RelFileLocator rlocator = GLOBAL_SPACE_RLOCATOR(XLOG_TDE_OID);
off_t read_pos = 0;
LWLock *lock_pk = tde_lwlock_enc_keys();
TDEPrincipalKey *principal_key;
Expand All @@ -244,7 +240,7 @@ pg_tde_fetch_wal_keys(XLogRecPtr start_lsn)
WALKeyCacheRec *return_wal_rec = NULL;

LWLockAcquire(lock_pk, LW_SHARED);
principal_key = GetPrincipalKey(rlocator.dbOid, LW_SHARED);
principal_key = GetPrincipalKey(GLOBAL_DATA_TDE_OID, LW_SHARED);
if (principal_key == NULL)
{
LWLockRelease(lock_pk);
Expand Down Expand Up @@ -283,7 +279,7 @@ pg_tde_fetch_wal_keys(XLogRecPtr start_lsn)
{
WalKeyFileEntry entry;

pg_tde_read_one_wal_key_file_entry2(fd, file_idx, &entry, rlocator.dbOid);
pg_tde_read_one_wal_key_file_entry2(fd, file_idx, &entry);

/*
* Skip new (just created but not updated by write) and invalid keys
Expand Down Expand Up @@ -496,8 +492,7 @@ pg_tde_read_one_wal_key_file_entry(int fd,
static void
pg_tde_read_one_wal_key_file_entry2(int fd,
int32 key_index,
WalKeyFileEntry *entry,
Oid databaseId)
WalKeyFileEntry *entry)
{
off_t read_pos;

Expand All @@ -512,17 +507,14 @@ pg_tde_read_one_wal_key_file_entry2(int fd,
}

static void
pg_tde_write_wal_key_file_entry(const RelFileLocator *rlocator,
const WalEncryptionKey *rel_key_data,
pg_tde_write_wal_key_file_entry(const WalEncryptionKey *rel_key_data,
TDEPrincipalKey *principal_key)
{
int fd;
off_t curr_pos = 0;
WalKeyFileEntry write_entry;
TDESignedPrincipalKeyInfo signed_key_Info;

Assert(rlocator);

pg_tde_sign_principal_key_info(&signed_key_Info, principal_key);

/* Open and validate file for basic correctness. */
Expand Down Expand Up @@ -552,7 +544,7 @@ pg_tde_write_wal_key_file_entry(const RelFileLocator *rlocator,
}

/* Initialize WAL key file entry and encrypt key */
pg_tde_initialize_wal_key_file_entry(&write_entry, principal_key, rlocator, rel_key_data);
pg_tde_initialize_wal_key_file_entry(&write_entry, principal_key, rel_key_data);

/* Write the given entry at curr_pos; i.e. the free entry. */
pg_tde_write_one_wal_key_file_entry(fd, &write_entry, &curr_pos, get_wal_key_file_path());
Expand All @@ -571,7 +563,7 @@ pg_tde_decrypt_wal_key(TDEPrincipalKey *principal_key, WalKeyFileEntry *entry)

if (!AesGcmDecrypt(principal_key->keyData,
entry->entry_iv, MAP_ENTRY_IV_SIZE,
(unsigned char *) entry, offsetof(TDEMapEntry, enc_key),
(unsigned char *) entry, offsetof(WalKeyFileEntry, enc_key),
entry->enc_key.key, INTERNAL_KEY_LEN,
key->key,
entry->aead_tag, MAP_ENTRY_AEAD_TAG_SIZE))
Expand Down Expand Up @@ -610,11 +602,8 @@ pg_tde_write_one_wal_key_file_entry(int fd,
static void
pg_tde_initialize_wal_key_file_entry(WalKeyFileEntry *entry,
const TDEPrincipalKey *principal_key,
const RelFileLocator *rlocator,
const WalEncryptionKey *rel_key_data)
{
entry->spcOid = rlocator->spcOid;
entry->relNumber = rlocator->relNumber;
entry->type = rel_key_data->type;
entry->enc_key = *rel_key_data;

Expand Down Expand Up @@ -663,7 +652,6 @@ pg_tde_perform_rotate_server_key(TDEPrincipalKey *principal_key,
WalEncryptionKey *key;
WalKeyFileEntry read_map_entry;
WalKeyFileEntry write_map_entry;
RelFileLocator rloc = GLOBAL_SPACE_RLOCATOR(XLOG_TDE_OID);

if (!pg_tde_read_one_wal_key_file_entry(old_fd, &read_map_entry, &old_curr_pos))
break;
Expand All @@ -673,7 +661,7 @@ pg_tde_perform_rotate_server_key(TDEPrincipalKey *principal_key,

/* Decrypt and re-encrypt key */
key = pg_tde_decrypt_wal_key(principal_key, &read_map_entry);
pg_tde_initialize_wal_key_file_entry(&write_map_entry, new_principal_key, &rloc, key);
pg_tde_initialize_wal_key_file_entry(&write_map_entry, new_principal_key, key);

pg_tde_write_one_wal_key_file_entry(new_fd, &write_map_entry, &new_curr_pos, tmp_path);

Expand Down
6 changes: 2 additions & 4 deletions contrib/pg_tde/src/access/pg_tde_xlog_smgr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,13 +207,11 @@ TDEXLogSmgrInitWrite(bool encrypt_xlog)
*/
if (encrypt_xlog)
{
pg_tde_create_wal_key(&EncryptionKey, &GLOBAL_SPACE_RLOCATOR(XLOG_TDE_OID),
TDE_KEY_TYPE_WAL_ENCRYPTED);
pg_tde_create_wal_key(&EncryptionKey, TDE_KEY_TYPE_WAL_ENCRYPTED);
}
else if (key && key->type == TDE_KEY_TYPE_WAL_ENCRYPTED)
{
pg_tde_create_wal_key(&EncryptionKey, &GLOBAL_SPACE_RLOCATOR(XLOG_TDE_OID),
TDE_KEY_TYPE_WAL_UNENCRYPTED);
pg_tde_create_wal_key(&EncryptionKey, TDE_KEY_TYPE_WAL_UNENCRYPTED);
}
else if (key)
{
Expand Down
5 changes: 1 addition & 4 deletions contrib/pg_tde/src/include/access/pg_tde_xlog_keys.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
#define PG_TDE_XLOG_KEYS_H

#include "access/xlog_internal.h"
#include "storage/relfilelocator.h"

#include "access/pg_tde_tdemap.h"
#include "catalog/tde_principal_key.h"
Expand All @@ -19,8 +18,6 @@ typedef struct WalEncryptionKey

typedef struct WalKeyFileEntry
{
Oid spcOid;
RelFileNumber relNumber;
uint32 type;
WalEncryptionKey enc_key;
/* IV and tag used when encrypting the key itself */
Expand Down Expand Up @@ -50,7 +47,7 @@ typedef struct WALKeyCacheRec
} WALKeyCacheRec;

extern int pg_tde_count_wal_keys_in_file(void);
extern void pg_tde_create_wal_key(WalEncryptionKey *rel_key_data, const RelFileLocator *newrlocator, TDEMapEntryType entry_type);
extern void pg_tde_create_wal_key(WalEncryptionKey *rel_key_data, TDEMapEntryType entry_type);
extern void pg_tde_delete_server_key(void);
extern WALKeyCacheRec *pg_tde_fetch_wal_keys(XLogRecPtr start_lsn);
extern WALKeyCacheRec *pg_tde_get_last_wal_key(void);
Expand Down
12 changes: 0 additions & 12 deletions contrib/pg_tde/src/include/catalog/tde_global_space.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,4 @@
#define GLOBAL_DATA_TDE_OID GLOBALTABLESPACE_OID
#define DEFAULT_DATA_TDE_OID DEFAULTTABLESPACE_OID

/*
* This oid can be anything since the database oid is gauranteed to not be a
* real database.
*/
#define XLOG_TDE_OID 1

#define GLOBAL_SPACE_RLOCATOR(_obj_oid) (RelFileLocator) { \
GLOBALTABLESPACE_OID, \
GLOBAL_DATA_TDE_OID, \
_obj_oid \
}

#endif /* TDE_GLOBAL_CATALOG_H */