Skip to content

Commit

Permalink
Store proper name with version in fork file (#95)
Browse files Browse the repository at this point in the history
* Store proper name with version in fork file

Currently the fork file stores just the string "master-key", which is incorrect,
as it does not contain the version information. To counteract this, at read time
it loads the latest master key, but that can be different than the version which
was used to encrypt it.

These getLatestKey calls also lead to postgres making many unneccessary calls to
vault, making this bug partially responsible for #90.

The fix is simple, from now on we correctly write the entire string including the
version number, and read the specified version at read time.

Fixes #94.

* fixing review comment
  • Loading branch information
dutow authored Jan 8, 2024
1 parent 87f30bc commit f1fbee2
Showing 1 changed file with 5 additions and 7 deletions.
12 changes: 5 additions & 7 deletions src/access/pg_tde_tdemap.c
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ pg_tde_write_key_fork(const RelFileLocator *rlocator, InternalKey *key, const ch
* the cache as well */
data = (RelKeysData *) MemoryContextAlloc(TopMemoryContext, SizeOfRelKeysData(1));

strcpy(data->master_key_name, MasterKeyName);
strncpy(data->master_key_name, master_key_info->name.name, MASTER_KEY_NAME_LEN);
data->internal_key[0] = *key;
data->internal_keys_len = 1;

Expand Down Expand Up @@ -217,11 +217,9 @@ pg_tde_get_keys_from_fork(const RelFileLocator *rlocator)
// TODO: use proper iv stored in the file!
unsigned char iv[INTERNAL_KEY_LEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

master_key_info = keyringGetLatestKey(keys->master_key_name);
if(master_key_info == NULL)
{
master_key_info = keyringGenerateKey(keys->master_key_name, INTERNAL_KEY_LEN);
}
keyName master_key_name;
strncpy(master_key_name.name, keys->master_key_name, MASTER_KEY_NAME_LEN);
master_key_info = keyringGetKey(master_key_name);
if(master_key_info == NULL)
{
ereport(ERROR,
Expand Down Expand Up @@ -414,4 +412,4 @@ pg_tde_xlog_create_fork(XLogReaderState *record)
#endif

pg_tde_write_key_fork(&rlocator, &int_key, MasterKeyName);
}
}

0 comments on commit f1fbee2

Please sign in to comment.