mirror of https://github.com/postgres/postgres
Conflicts - contrib/pg_tde/Makefile - contrib/pg_tde/expected/change_access_method.out - contrib/pg_tde/meson.build - contrib/pg_tde/src/access/pg_tde_tdemap.c - contrib/pg_tde/src/access/pg_tde_xlog_encrypt.c - contrib/pg_tde/src/keyring/keyring_vault.c - contrib/pg_tde/src/pg_tde.c - contrib/pg_tde/src/pg_tde_alter_key_provider.c - contrib/pg_tde/src/pg_tde_event_capture.c - src/bin/Makefile - src/bin/meson.build Deleted in TDE_REL_17_STABLE - contrib/pg_tde/expected/change_access_method_basic.out - contrib/pg_tde/expected/vault_v2_test_basic.out - contrib/pg_tde/sql/change_access_method.inc - contrib/pg_tde/sql/vault_v2_test.inc - src/bin/pg_tde_change_key_provider/Makefile - src/bin/pg_tde_change_key_provider/meson.buildpull/209/head
Andreas Karlsson
6 months ago
commit
3a6422b9f9
@ -1,5 +0,0 @@ |
|||||||
# Switch from Percona Server for PostgreSQL to PostgreSQL Community |
|
||||||
|
|
||||||
Percona Server for PostgreSQL and PostgreSQL Community are binary compatible and enable you to switch from one to another. Here's how: |
|
||||||
|
|
||||||
1. If you used the `tde_heap` (tech preview feature) access method for encryption, either re-encrypt the data using the `tde_heap_basic` access method, or [decrypt](decrypt.md) it completely |
|
||||||
@ -0,0 +1,74 @@ |
|||||||
|
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||||
|
SELECT * FROM pg_tde_principal_key_info(); |
||||||
|
ERROR: Principal key does not exists for the database |
||||||
|
HINT: Use set_principal_key interface to set the principal key |
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
pg_tde_add_key_provider_file |
||||||
|
------------------------------ |
||||||
|
1 |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+------------------------------------------------------------ |
||||||
|
1 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
pg_tde_delete_key_provider |
||||||
|
---------------------------- |
||||||
|
|
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+--------- |
||||||
|
(0 rows) |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
pg_tde_add_key_provider_file |
||||||
|
------------------------------ |
||||||
|
2 |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+------------------------------------------------------------ |
||||||
|
2 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
pg_tde_delete_key_provider |
||||||
|
---------------------------- |
||||||
|
|
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+--------- |
||||||
|
(0 rows) |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
pg_tde_add_key_provider_file |
||||||
|
------------------------------ |
||||||
|
3 |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+------------------------------------------------------------ |
||||||
|
3 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
pg_tde_delete_key_provider |
||||||
|
---------------------------- |
||||||
|
|
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
id | provider_name | provider_type | options |
||||||
|
----+---------------+---------------+--------- |
||||||
|
(0 rows) |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1,8 @@ |
|||||||
|
CREATE EXTENSION pg_tde; |
||||||
|
-- should fail |
||||||
|
CREATE TABLE t1 (n INT) USING tde_heap; |
||||||
|
ERROR: failed to retrieve principal key. Create one using pg_tde_set_principal_key before using encrypted tables. |
||||||
|
-- should work |
||||||
|
CREATE TABLE t2 (n INT) USING heap; |
||||||
|
DROP TABLE t2; |
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1,134 @@ |
|||||||
|
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||||
|
SELECT pg_tde_add_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per'); |
||||||
|
pg_tde_add_key_provider_file |
||||||
|
------------------------------ |
||||||
|
1 |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_set_principal_key('test-db-principal-key','file-vault'); |
||||||
|
pg_tde_set_principal_key |
||||||
|
-------------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SET default_table_access_method = "tde_heap"; |
||||||
|
CREATE TABLE t1(n integer); |
||||||
|
SELECT pg_tde_is_encrypted('t1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
VACUUM FULL t1; |
||||||
|
SELECT pg_tde_is_encrypted('t1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
CREATE TABLE test_tab1 AS SELECT generate_series(1,10) a; |
||||||
|
CREATE INDEX test_idx1 ON test_tab1(a); |
||||||
|
SELECT pg_tde_is_encrypted('test_tab1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_is_encrypted('test_idx1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
REINDEX index CONCURRENTLY test_idx1; |
||||||
|
SELECT pg_tde_is_encrypted('test_tab1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_is_encrypted('test_idx1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
CREATE TABLE mvtest_t (id int NOT NULL PRIMARY KEY, type text NOT NULL, amt numeric NOT NULL); |
||||||
|
INSERT INTO mvtest_t VALUES |
||||||
|
(1, 'x', 2), |
||||||
|
(2, 'x', 3), |
||||||
|
(3, 'y', 5), |
||||||
|
(4, 'y', 7), |
||||||
|
(5, 'z', 11); |
||||||
|
CREATE MATERIALIZED VIEW mvtest_tm AS SELECT type, sum(amt) AS totamt FROM mvtest_t GROUP BY type WITH NO DATA; |
||||||
|
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
REFRESH MATERIALIZED VIEW mvtest_tm; |
||||||
|
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
CREATE TYPE rewritetype AS (a int); |
||||||
|
CREATE TABLE rewritemetoo1 OF rewritetype; |
||||||
|
CREATE TABLE rewritemetoo2 OF rewritetype; |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
ALTER TYPE rewritetype ALTER ATTRIBUTE a TYPE text cascade; |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
CREATE TABLE encrypted_table ( |
||||||
|
id SERIAL, |
||||||
|
data TEXT, |
||||||
|
created_at DATE NOT NULL, |
||||||
|
PRIMARY KEY (id, created_at) |
||||||
|
) USING tde_heap; |
||||||
|
CREATE INDEX idx_date ON encrypted_table (created_at); |
||||||
|
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
CLUSTER encrypted_table USING idx_date; |
||||||
|
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||||
|
pg_tde_is_encrypted |
||||||
|
--------------------- |
||||||
|
t |
||||||
|
(1 row) |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde CASCADE; |
||||||
|
NOTICE: drop cascades to 7 other objects |
||||||
|
DETAIL: drop cascades to table t1 |
||||||
|
drop cascades to table test_tab1 |
||||||
|
drop cascades to table mvtest_t |
||||||
|
drop cascades to materialized view mvtest_tm |
||||||
|
drop cascades to table rewritemetoo1 |
||||||
|
drop cascades to table rewritemetoo2 |
||||||
|
drop cascades to table encrypted_table |
||||||
|
RESET default_table_access_method; |
||||||
@ -0,0 +1,8 @@ |
|||||||
|
CREATE EXTENSION pg_tde; |
||||||
|
SELECT pg_tde_version(); |
||||||
|
pg_tde_version |
||||||
|
----------------- |
||||||
|
pg_tde 1.0.0-rc |
||||||
|
(1 row) |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1,20 @@ |
|||||||
|
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||||
|
|
||||||
|
SELECT * FROM pg_tde_principal_key_info(); |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
SELECT pg_tde_delete_key_provider('file-provider'); |
||||||
|
SELECT * FROM pg_tde_list_all_key_providers(); |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1,11 @@ |
|||||||
|
CREATE EXTENSION pg_tde; |
||||||
|
|
||||||
|
-- should fail |
||||||
|
CREATE TABLE t1 (n INT) USING tde_heap; |
||||||
|
|
||||||
|
-- should work |
||||||
|
CREATE TABLE t2 (n INT) USING heap; |
||||||
|
|
||||||
|
DROP TABLE t2; |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1,54 @@ |
|||||||
|
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||||
|
|
||||||
|
SELECT pg_tde_add_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per'); |
||||||
|
SELECT pg_tde_set_principal_key('test-db-principal-key','file-vault'); |
||||||
|
|
||||||
|
SET default_table_access_method = "tde_heap"; |
||||||
|
|
||||||
|
CREATE TABLE t1(n integer); |
||||||
|
SELECT pg_tde_is_encrypted('t1'); |
||||||
|
VACUUM FULL t1; |
||||||
|
SELECT pg_tde_is_encrypted('t1'); |
||||||
|
|
||||||
|
CREATE TABLE test_tab1 AS SELECT generate_series(1,10) a; |
||||||
|
CREATE INDEX test_idx1 ON test_tab1(a); |
||||||
|
SELECT pg_tde_is_encrypted('test_tab1'); |
||||||
|
SELECT pg_tde_is_encrypted('test_idx1'); |
||||||
|
REINDEX index CONCURRENTLY test_idx1; |
||||||
|
SELECT pg_tde_is_encrypted('test_tab1'); |
||||||
|
SELECT pg_tde_is_encrypted('test_idx1'); |
||||||
|
|
||||||
|
CREATE TABLE mvtest_t (id int NOT NULL PRIMARY KEY, type text NOT NULL, amt numeric NOT NULL); |
||||||
|
INSERT INTO mvtest_t VALUES |
||||||
|
(1, 'x', 2), |
||||||
|
(2, 'x', 3), |
||||||
|
(3, 'y', 5), |
||||||
|
(4, 'y', 7), |
||||||
|
(5, 'z', 11); |
||||||
|
CREATE MATERIALIZED VIEW mvtest_tm AS SELECT type, sum(amt) AS totamt FROM mvtest_t GROUP BY type WITH NO DATA; |
||||||
|
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||||
|
REFRESH MATERIALIZED VIEW mvtest_tm; |
||||||
|
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||||
|
|
||||||
|
CREATE TYPE rewritetype AS (a int); |
||||||
|
CREATE TABLE rewritemetoo1 OF rewritetype; |
||||||
|
CREATE TABLE rewritemetoo2 OF rewritetype; |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||||
|
ALTER TYPE rewritetype ALTER ATTRIBUTE a TYPE text cascade; |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||||
|
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||||
|
|
||||||
|
CREATE TABLE encrypted_table ( |
||||||
|
id SERIAL, |
||||||
|
data TEXT, |
||||||
|
created_at DATE NOT NULL, |
||||||
|
PRIMARY KEY (id, created_at) |
||||||
|
) USING tde_heap; |
||||||
|
CREATE INDEX idx_date ON encrypted_table (created_at); |
||||||
|
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||||
|
CLUSTER encrypted_table USING idx_date; |
||||||
|
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||||
|
|
||||||
|
DROP EXTENSION pg_tde CASCADE; |
||||||
|
RESET default_table_access_method; |
||||||
@ -0,0 +1,3 @@ |
|||||||
|
CREATE EXTENSION pg_tde; |
||||||
|
SELECT pg_tde_version(); |
||||||
|
DROP EXTENSION pg_tde; |
||||||
@ -0,0 +1 @@ |
|||||||
|
/pg_tde_change_key_provider |
||||||
Loading…
Reference in new issue