Understand the dense support functions / stored procedures of opengauss

In the last issue, we introduced the secret query and usage jdbc The operation of connecting to the dense database . In this issue, we will introduce the dense state support function / stored procedure .openGauss 3.0.0 Version support only sql and PL/pgsql Two languages . Because the secret state supports the creation and execution of functions in stored procedures / Stored procedures are insensitive to users , Therefore, there is no difference between syntax and unclassified state .

The stored procedure feature of the dense equivalent query support function adds a system table gs_encrypted_proc, Used to store the original data type returned by the parameter . Here are some examples .

Create and execute functions involving encrypted Columns / stored procedure

1. Create key , Please refer to Use gsql Operate the dense database and use JDBC Operating dense database .

2. Create encryption table .

openGauss=# CREATE TABLE creditcard_info (
    id_number int,
     name  text,
    credit_card varchar(19) encrypted with (column_encryption_key = ImgCEK1, encryption_type = DETERMINISTIC)
    ) with (orientation=row);
CREATE TABLE

3. insert data .

openGauss=# insert into creditcard_info values(1, 'Avi', '1234567890123456');
INSERT 0 1
openGauss=# insert into creditcard_info values(2, 'Eli', '2345678901234567');
INSERT 0 1

4. The creation function supports dense equivalent query .

openGauss=# CREATE FUNCTION f_encrypt_in_sql(val1 text, val2 varchar(19)) RETURNS text AS 'SELECT name from creditcard_info where name=$1 or credit_card=$2 LIMIT 1' LANGUAGE SQL;
CREATE FUNCTION
openGauss=# CREATE FUNCTION f_encrypt_in_plpgsql (val1 text, val2 varchar(19))
RETURNS text AS $$
DECLARE
c text;
BEGIN
 SELECT into c name from creditcard_info where name=$1 or credit_card =$2 LIMIT 1;
  RETURN c;
END; $$
LANGUAGE plpgsql;
CREATE FUNCTION

5. Execute function .

openGauss=# SELECT f_encrypt_in_sql('Avi','1234567890123456');
 f_encrypt_in_sql
------------------
 Avi
(1 row)
    
openGauss=# SELECT f_encrypt_in_plpgsql('Avi', val2=>'1234567890123456');
 f_encrypt_in_plpgsql
----------------------
 Avi
(1 row)

However, there are some precautions when using .

• function / In a stored procedure “ Execute dynamic query statement ” Queries in are compiled during execution , So function / Table name in stored procedure 、 The column name cannot be unknown at the creation stage , Input parameters cannot be used for table names 、 Column name or connect in any way .
• stay RETURNS、IN and OUT The parameters of the , Mixing encrypted and unencrypted type parameters is not supported . Although the parameter types are original data types , But the actual type is different .
• For high-level package interface , Such as dbe_output.print_line() The interface waiting for the server printout will not decrypt , When the encrypted data type is forcibly converted to the plaintext original data type, the default value of the data type will be printed .
• Function of current version / Stored procedure's LANGUAGE Only support SQL and PL/pgSQL, I won't support it C and JAVA Other process languages .
• Not supported in function / Execute other functions in the stored procedure to query the encrypted column / stored procedure .
• Current version not supported default、DECLARE Assign default values to variables in , And does not support DECLARE Decrypt the return value in , The user can use the input parameters when executing the function 、 Output parameters instead of using .
• I won't support it gs_dump For those involving encrypted Columns function Make a backup .
• Not supported in function / Create a key in a stored procedure .
• This version of dense state function / Stored procedures do not support triggers .
• Dense equivalent query function / Stored procedures do not support for plpgsql Language escapes grammar , For syntax with quotation marks in the main body CREATE FUNCTION AS ‘ Grammatical subject ’, It can be used CREATE FUNCTION AS ‘ Grammatical subject ’ Instead of .
• The dense equivalent query function is not supported / Perform the operation of modifying the encrypted column definition in the stored procedure , Including creating encrypted tables 、 Add encrypted Columns , Because the execution function is on the server side , The client cannot determine whether it needs to refresh the cache , The column can be encrypted only after the connection is disconnected or the client encryption column cache is refreshed .