You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andrew Pogrebnoi d352e5af41 PG-1294 WAL: encrypt segment ranges ... This commit changes the approach to WAL encryption. Instead of encrypting each WAL page and keeping its header unencrypted with a special encrypted flag, this change moves encrypted/unencrypted bookkeeping to WAL internal keys. Now every [WAL] internal key has an additional field `start_lsn`. The field indicates the first WAL record that was encrypted with this key. This means everything starting from that LSN is encrypted with the key until the next or the end of the WAL. In order to have unencrypted WAL (when the user sets `pg_tde.wal_encrypt = off`), we insert a special key with the flag `TDE_KEY_TYPE_WAL_UNENCRYPTED`. The user can turn WAL encryption on and off, which will generate a new WAL key with the respective state (`TDE_KEY_TYPE_WAL_ENCRYPTED` or `TDE_KEY_TYPE_WAL_UNENCRYPTED `). If GUC pg_tde.wal_encrypt was changed, the server will generate a new WAL key with `start_lsn` set to `InvalidXLogRecPtr` on start. WAL writer, in turn, will update `start_lsn` with the actual LSN on the first write since the key creation. We use the current key _map and _dat files infrastructure along with the Internal key cache but with some special cases. There might be multiple internal keys for WAL but only one for the SMGR (relations, indexes etc). Creating a new WAL key, we write it the same as the SMGR key, so key rotation, for example, doesn't require any changes. But reads and start_lsn happen directly from/in _dat file (omitting _map). This needs revision and refactoring (along with _map, _dat files in general). As well as WAL keys cache, which is currently a simple linked list referencing the actual internal key case. That allows WAL key changing.		7 months ago
..
_images	Moved pg_tde to contrib/pg_tde	8 months ago
css	PG-1354: Update documentation with latest changes (#46)	7 months ago
fonts	Moved pg_tde to contrib/pg_tde	8 months ago
js	Moved pg_tde to contrib/pg_tde	8 months ago
release-notes	Moved pg_tde to contrib/pg_tde	8 months ago
apt.md	PG-854 Support for globalkeyring	7 months ago
contribute.md	PG-1355 Added the key points to consider when writing documentation (#52)	7 months ago
decrypt.md	PG-1303 Added deprecation label to PG community version and tde_heap_basic access method (#55)	7 months ago
external-parameters.md	Moved pg_tde to contrib/pg_tde	8 months ago
faq.md	PG-1294 WAL: encrypt segment ranges	7 months ago
features.md	PG-1303 Added deprecation label to PG community version and tde_heap_basic access method (#55)	7 months ago
functions.md	Fixed review comments	7 months ago
get-help.md	DOCS-159 Implemented lead generation form to docs (#79)	7 months ago
index.md	PG-1303 Added deprecation label to PG community version and tde_heap_basic access method (#55)	7 months ago
install.md	PG-854 Support for globalkeyring	7 months ago
multi-tenant-setup.md	Fixed review comments	7 months ago
setup.md	PG-1294 WAL: encrypt segment ranges	7 months ago
switch.md	Moved pg_tde to contrib/pg_tde	8 months ago
table-access-method.md	PG-1303 Added deprecation label to PG community version and tde_heap_basic access method (#55)	7 months ago
tde.md	Moved pg_tde to contrib/pg_tde	8 months ago
test.md	Write count(*) in a consistent way in our documentation	7 months ago
uninstall.md	Fixed review comments	7 months ago
wal-encryption.md	PG-1294 WAL: encrypt segment ranges	7 months ago
yum.md	PG-854 Support for globalkeyring	7 months ago