Skip to content

PG-1605 Fix encryption with old keys with disabled WAL encryption #536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeltz merged 2 commits into from
Aug 14, 2025
Merged

PG-1605 Fix encryption with old keys with disabled WAL encryption #536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35978f1
PG-1605 Fix encryption with old keys with disabled WAL encryption
jeltz Aug 14, 2025
d2857e1
PG-1605 Fix issue with test which crashes when re-run
jeltz Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 6 additions & 17 deletions contrib/pg_tde/src/access/pg_tde_xlog_smgr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
#ifdef FRONTEND
#include "pg_tde_fe.h"
#else
#include "pg_tde_guc.h"
#include "port/atomics.h"
#endif

Expand Down Expand Up @@ -138,11 +137,8 @@ TDEXLogEncryptStateSize(void)
Size sz;

sz = sizeof(EncryptionStateData);
if (EncryptXLog)
{
sz = add_size(sz, TDEXLogEncryptBuffSize());
sz = add_size(sz, PG_IO_ALIGN_SIZE);
}
sz = add_size(sz, TDEXLogEncryptBuffSize());
sz = add_size(sz, PG_IO_ALIGN_SIZE);

return sz;
}
Expand All @@ -169,12 +165,9 @@ TDEXLogShmemInit(void)

memset(EncryptionState, 0, sizeof(EncryptionStateData));

if (EncryptXLog)
{
EncryptionBuf = (char *) TYPEALIGN(PG_IO_ALIGN_SIZE, ((char *) EncryptionState) + sizeof(EncryptionStateData));
EncryptionBuf = (char *) TYPEALIGN(PG_IO_ALIGN_SIZE, ((char *) EncryptionState) + sizeof(EncryptionStateData));

Assert((char *) EncryptionState + TDEXLogEncryptStateSize() >= (char *) EncryptionBuf + TDEXLogEncryptBuffSize());
}
Assert((char *) EncryptionState + TDEXLogEncryptStateSize() >= (char *) EncryptionBuf + TDEXLogEncryptBuffSize());

pg_atomic_init_u64(&EncryptionState->enc_key_lsn, 0);

Expand Down Expand Up @@ -367,12 +360,8 @@ tdeheap_xlog_seg_write(int fd, const void *buf, size_t count, off_t offset,
{
WALKeyCacheRec *last_key = pg_tde_get_last_wal_key();

if (!crashRecovery || EncryptionKey.type == WAL_KEY_TYPE_UNENCRYPTED)
if (!crashRecovery)
{
/*
* TODO: the unencrypted case is still not perfect, we need to
* report an error in some cornercases
*/
if (last_key == NULL || last_key->start.lsn < loc.lsn)
{
pg_tde_wal_last_key_set_location(loc);
Expand All @@ -383,7 +372,7 @@ tdeheap_xlog_seg_write(int fd, const void *buf, size_t count, off_t offset,
}
}

if ((!afterWriteKey || !lastKeyUsable) && EncryptionKey.type == WAL_KEY_TYPE_ENCRYPTED)
if ((!afterWriteKey || !lastKeyUsable) && EncryptionKey.type != WAL_KEY_TYPE_INVALID)
{
return TDEXLogWriteEncryptedPagesOldKeys(fd, buf, count, offset, tli, segno, segSize);
}
Expand Down
3 changes: 3 additions & 0 deletions contrib/pg_tde/t/2pc_replication.pl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ sub configure_and_reload
return;
}

unlink('/tmp/pg_global_keyring.file');
unlink('/tmp/pg_local_keyring.file');

# Set up two nodes, which will alternately be primary and replication standby.

# Setup london node
Expand Down
Loading