Percona-Lab / pg_tde

MIT License
107 stars 19 forks source link

Fix compressed TOASTs encryption/decryption #76

Closed dAdAbird closed 10 months ago

dAdAbird commented 10 months ago

If TOAST data gets compressed, it has an extended header containing compression info. We used to encrypt this header along with the actual data which in turn caused a crash as PG needs this data in later stages. So it should be taken into account while encrypting data during externalisation.

Then, during detoasting, we should not decrypt this compression header as it is being extracted with the data with the first TOAST chunk. So, copy the first N bytes (now it is 4 bytes) of the first chunk as it is and decrypt the rest of the data.

Fixes https://github.com/Percona-Lab/postgres-tde-ext/issues/63