public inbox for [email protected]
help / color / mirror / Atom feedFrom: Jacob Champion <[email protected]>
To: David Christensen <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Cc: Stephen Frost <[email protected]>
Subject: Re: Moving forward with TDE
Date: Tue, 15 Nov 2022 12:08:40 -0800
Message-ID: <CAAWbhmiVCyYXp6TDkc+Ci9F0Ph8cdGDFA1D3MTVZimuqp5v3ag@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <CAAWbhmhtWPc9XbtVRbY3XFkDb9zGDukRofWvEWrSJAeVYjviXQ@mail.gmail.com>
<[email protected]>
On Tue, Nov 15, 2022 at 11:39 AM David Christensen
<[email protected]> wrote:
> Good to know about the next steps, thanks.
You're welcome!
> This was just a refresh of the old patches on the wiki to work as written on HEAD. If there are known TODOs here this then that work is still needing to be done.
>
> I was going to take 2) and Stephen was going to work on 3); I am not sure about the other two but will review the thread you pointed to. Thanks for pointing that out.
I've attached the diffs I'm carrying to build this under meson (as
well as -Wshadow; my removal of the two variables probably needs some
scrutiny). It looks like the testcrypto executable will need
substantial changes after the common/hex.h revert.
--Jacob
From eb4b55f5d03e362cf340f322c0cefbf95f53657a Mon Sep 17 00:00:00 2001
From: Jacob Champion <[email protected]>
Date: Mon, 14 Nov 2022 16:02:57 -0800
Subject: [PATCH] WIP: fix meson
Note that the testcrypto executable needs to be rewritten.
---
src/backend/bootstrap/bootstrap.c | 2 --
src/backend/crypto/kmgr.c | 1 -
src/backend/crypto/meson.build | 14 ++++++++++++++
src/backend/meson.build | 1 +
src/bin/meson.build | 1 +
src/bin/pg_alterckey/meson.build | 16 ++++++++++++++++
src/common/meson.build | 3 +++
7 files changed, 35 insertions(+), 3 deletions(-)
create mode 100644 src/backend/crypto/meson.build
create mode 100644 src/bin/pg_alterckey/meson.build
diff --git a/src/backend/bootstrap/bootstrap.c b/src/backend/bootstrap/bootstrap.c
index ffaf9c7cc4..07b2f15343 100644
--- a/src/backend/bootstrap/bootstrap.c
+++ b/src/backend/bootstrap/bootstrap.c
@@ -256,8 +256,6 @@ BootstrapModeMain(int argc, char *argv[], bool check_only)
break;
case 'K':
{
- int i;
-
/* method 0/disabled cannot be specified */
for (i = DISABLED_ENCRYPTION_METHOD + 1;
i < NUM_ENCRYPTION_METHODS; i++)
diff --git a/src/backend/crypto/kmgr.c b/src/backend/crypto/kmgr.c
index a83effbca8..b4248965f8 100644
--- a/src/backend/crypto/kmgr.c
+++ b/src/backend/crypto/kmgr.c
@@ -141,7 +141,6 @@ BootStrapKmgr(void)
if (bootstrap_old_key_datadir == NULL)
{
unsigned char *bootstrap_keys_wrap[KMGR_NUM_DATA_KEYS];
- int key_lens[KMGR_NUM_DATA_KEYS];
PgCipherCtx *cluster_key_ctx;
/* Create KEK encryption context */
diff --git a/src/backend/crypto/meson.build b/src/backend/crypto/meson.build
new file mode 100644
index 0000000000..2b72b26ebf
--- /dev/null
+++ b/src/backend/crypto/meson.build
@@ -0,0 +1,14 @@
+backend_sources += files(
+ 'bufenc.c',
+ 'kmgr.c',
+)
+
+install_data(
+ 'ckey_aws.sh.sample',
+ 'ckey_direct.sh.sample',
+ 'ckey_passphrase.sh.sample',
+ 'ckey_piv_nopin.sh.sample',
+ 'ckey_piv_pin.sh.sample',
+ 'ssl_passphrase.sh.sample',
+ install_dir: dir_data / 'auth_commands',
+)
diff --git a/src/backend/meson.build b/src/backend/meson.build
index 37562bae13..2162aef554 100644
--- a/src/backend/meson.build
+++ b/src/backend/meson.build
@@ -9,6 +9,7 @@ subdir('backup')
subdir('bootstrap')
subdir('catalog')
subdir('commands')
+subdir('crypto')
subdir('executor')
subdir('foreign')
subdir('jit')
diff --git a/src/bin/meson.build b/src/bin/meson.build
index 5fd5a9d2f9..8dd9133213 100644
--- a/src/bin/meson.build
+++ b/src/bin/meson.build
@@ -1,4 +1,5 @@
subdir('initdb')
+subdir('pg_alterckey')
subdir('pg_amcheck')
subdir('pg_archivecleanup')
subdir('pg_basebackup')
diff --git a/src/bin/pg_alterckey/meson.build b/src/bin/pg_alterckey/meson.build
new file mode 100644
index 0000000000..72ec8274c3
--- /dev/null
+++ b/src/bin/pg_alterckey/meson.build
@@ -0,0 +1,16 @@
+pg_alterckey_sources = files(
+ 'pg_alterckey.c',
+)
+
+if host_system == 'windows'
+ pg_alterckey_sources += rc_bin_gen.process(win32ver_rc, extra_args: [
+ '--NAME', 'pg_alterckey',
+ '--FILEDESC', 'pg_alterckey - alter the cluster key',])
+endif
+
+pg_alterckey = executable('pg_alterckey',
+ pg_alterckey_sources,
+ dependencies: [frontend_code, libpq],
+ kwargs: default_bin_args,
+)
+bin_targets += pg_alterckey
diff --git a/src/common/meson.build b/src/common/meson.build
index 1c9b8a3a01..102b4d7b23 100644
--- a/src/common/meson.build
+++ b/src/common/meson.build
@@ -12,6 +12,7 @@ common_sources = files(
'ip.c',
'jsonapi.c',
'keywords.c',
+ 'kmgr_utils.c',
'kwlookup.c',
'link-canary.c',
'md5_common.c',
@@ -34,12 +35,14 @@ common_sources = files(
if ssl.found()
common_sources += files(
+ 'cipher_openssl.c',
'cryptohash_openssl.c',
'hmac_openssl.c',
'protocol_openssl.c',
)
else
common_sources += files(
+ 'cipher.c',
'cryptohash.c',
'hmac.c',
'md5.c',
--
2.25.1
Attachments:
[text/plain] fix-meson.patch.txt (3.9K, ../CAAWbhmiVCyYXp6TDkc+Ci9F0Ph8cdGDFA1D3MTVZimuqp5v3ag@mail.gmail.com/2-fix-meson.patch.txt)
download | inline diff:
From eb4b55f5d03e362cf340f322c0cefbf95f53657a Mon Sep 17 00:00:00 2001
From: Jacob Champion <[email protected]>
Date: Mon, 14 Nov 2022 16:02:57 -0800
Subject: [PATCH] WIP: fix meson
Note that the testcrypto executable needs to be rewritten.
---
src/backend/bootstrap/bootstrap.c | 2 --
src/backend/crypto/kmgr.c | 1 -
src/backend/crypto/meson.build | 14 ++++++++++++++
src/backend/meson.build | 1 +
src/bin/meson.build | 1 +
src/bin/pg_alterckey/meson.build | 16 ++++++++++++++++
src/common/meson.build | 3 +++
7 files changed, 35 insertions(+), 3 deletions(-)
create mode 100644 src/backend/crypto/meson.build
create mode 100644 src/bin/pg_alterckey/meson.build
diff --git a/src/backend/bootstrap/bootstrap.c b/src/backend/bootstrap/bootstrap.c
index ffaf9c7cc4..07b2f15343 100644
--- a/src/backend/bootstrap/bootstrap.c
+++ b/src/backend/bootstrap/bootstrap.c
@@ -256,8 +256,6 @@ BootstrapModeMain(int argc, char *argv[], bool check_only)
break;
case 'K':
{
- int i;
-
/* method 0/disabled cannot be specified */
for (i = DISABLED_ENCRYPTION_METHOD + 1;
i < NUM_ENCRYPTION_METHODS; i++)
diff --git a/src/backend/crypto/kmgr.c b/src/backend/crypto/kmgr.c
index a83effbca8..b4248965f8 100644
--- a/src/backend/crypto/kmgr.c
+++ b/src/backend/crypto/kmgr.c
@@ -141,7 +141,6 @@ BootStrapKmgr(void)
if (bootstrap_old_key_datadir == NULL)
{
unsigned char *bootstrap_keys_wrap[KMGR_NUM_DATA_KEYS];
- int key_lens[KMGR_NUM_DATA_KEYS];
PgCipherCtx *cluster_key_ctx;
/* Create KEK encryption context */
diff --git a/src/backend/crypto/meson.build b/src/backend/crypto/meson.build
new file mode 100644
index 0000000000..2b72b26ebf
--- /dev/null
+++ b/src/backend/crypto/meson.build
@@ -0,0 +1,14 @@
+backend_sources += files(
+ 'bufenc.c',
+ 'kmgr.c',
+)
+
+install_data(
+ 'ckey_aws.sh.sample',
+ 'ckey_direct.sh.sample',
+ 'ckey_passphrase.sh.sample',
+ 'ckey_piv_nopin.sh.sample',
+ 'ckey_piv_pin.sh.sample',
+ 'ssl_passphrase.sh.sample',
+ install_dir: dir_data / 'auth_commands',
+)
diff --git a/src/backend/meson.build b/src/backend/meson.build
index 37562bae13..2162aef554 100644
--- a/src/backend/meson.build
+++ b/src/backend/meson.build
@@ -9,6 +9,7 @@ subdir('backup')
subdir('bootstrap')
subdir('catalog')
subdir('commands')
+subdir('crypto')
subdir('executor')
subdir('foreign')
subdir('jit')
diff --git a/src/bin/meson.build b/src/bin/meson.build
index 5fd5a9d2f9..8dd9133213 100644
--- a/src/bin/meson.build
+++ b/src/bin/meson.build
@@ -1,4 +1,5 @@
subdir('initdb')
+subdir('pg_alterckey')
subdir('pg_amcheck')
subdir('pg_archivecleanup')
subdir('pg_basebackup')
diff --git a/src/bin/pg_alterckey/meson.build b/src/bin/pg_alterckey/meson.build
new file mode 100644
index 0000000000..72ec8274c3
--- /dev/null
+++ b/src/bin/pg_alterckey/meson.build
@@ -0,0 +1,16 @@
+pg_alterckey_sources = files(
+ 'pg_alterckey.c',
+)
+
+if host_system == 'windows'
+ pg_alterckey_sources += rc_bin_gen.process(win32ver_rc, extra_args: [
+ '--NAME', 'pg_alterckey',
+ '--FILEDESC', 'pg_alterckey - alter the cluster key',])
+endif
+
+pg_alterckey = executable('pg_alterckey',
+ pg_alterckey_sources,
+ dependencies: [frontend_code, libpq],
+ kwargs: default_bin_args,
+)
+bin_targets += pg_alterckey
diff --git a/src/common/meson.build b/src/common/meson.build
index 1c9b8a3a01..102b4d7b23 100644
--- a/src/common/meson.build
+++ b/src/common/meson.build
@@ -12,6 +12,7 @@ common_sources = files(
'ip.c',
'jsonapi.c',
'keywords.c',
+ 'kmgr_utils.c',
'kwlookup.c',
'link-canary.c',
'md5_common.c',
@@ -34,12 +35,14 @@ common_sources = files(
if ssl.found()
common_sources += files(
+ 'cipher_openssl.c',
'cryptohash_openssl.c',
'hmac_openssl.c',
'protocol_openssl.c',
)
else
common_sources += files(
+ 'cipher.c',
'cryptohash.c',
'hmac.c',
'md5.c',
--
2.25.1
view thread (9+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected]
Subject: Re: Moving forward with TDE
In-Reply-To: <CAAWbhmiVCyYXp6TDkc+Ci9F0Ph8cdGDFA1D3MTVZimuqp5v3ag@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox