Commit Graph

28763 Commits

Author SHA1 Message Date
Tom Lane
db13a81ab4 Revert ill-considered restriction of dtrace support to Solaris only. 2009-09-04 23:11:05 +00:00
Tom Lane
47ef623c0b Remove pgstat's discrimination against MsgVacuum and MsgAnalyze messages.
Formerly, these message types would be discarded unless there was already
a stats hash table entry for the target table.  However, the intent of
saving hash table space for unused tables was subverted by the fact that
the physical I/O done by the vacuum or analyze would result in an immediately
following tabstat message, which would create the hash table entry anyway.
All that we had left was surprising loss of statistical data, as in a recent
complaint from Jaime Casanova.

It seems unlikely that a real database would have many tables that go totally
untouched over the long haul, so the consensus is that this "optimization"
serves little purpose anyhow.  Remove it, and just create the hash table
entry on demand in all cases.
2009-09-04 22:32:33 +00:00
Heikki Linnakangas
7be39bb0be Tigthen binary receive functions so that they reject values that the text
input functions don't accept either. While the backend can handle such
values fine, they can cause trouble in clients and in pg_dump/restore.

This is followup to the original issue on time datatype reported by Andrew
McNamara a while ago. Like that one, none of these seem worth
back-patching.
2009-09-04 11:20:23 +00:00
Heikki Linnakangas
237859e4fb Fix encoding handling in xml binary input function. If the XML header didn't
specify an encoding explicitly, we used to treat it as being in database
encoding when we parsed it, but then perform a UTF-8 -> database encoding
conversion on it, which was completely bogus. It's now consistently treated as
UTF-8.
2009-09-04 10:49:29 +00:00
Tom Lane
1608489b2d Final updates of release notes for 8.4.1, 8.3.8, 8.2.14, 8.1.18, 8.0.22,
7.4.26.
2009-09-03 22:13:47 +00:00
Tom Lane
602a9ef5a7 Make LOAD of an already-loaded library into a no-op, instead of attempting
to unload and re-load the library.

The difficulty with unloading a library is that we haven't defined safe
protocols for doing so.  In particular, there's no safe mechanism for
getting out of a "hook" function pointer unless libraries are unloaded
in reverse order of loading.  And there's no mechanism at all for undefining
a custom GUC variable, so GUC would be left with a pointer to an old value
that might or might not still be valid, and very possibly wouldn't be in
the same place anymore.

While the unload and reload behavior had some usefulness in easing
development of new loadable libraries, it's of no use whatever to normal
users, so just disabling it isn't giving up that much.  Someday we might
care to expend the effort to develop safe unload protocols; but even if
we did, there'd be little certainty that every third-party loadable module
was following them, so some security restrictions would still be needed.

Back-patch to 8.2; before that, LOAD was superuser-only anyway.

Security: unprivileged users could crash backend.  CVE not assigned yet
2009-09-03 22:11:07 +00:00
Tom Lane
187e5d8981 Disallow RESET ROLE and RESET SESSION AUTHORIZATION inside security-definer
functions.

This extends the previous patch that forbade SETting these variables inside
security-definer functions.  RESET is equally a security hole, since it
would allow regaining privileges of the caller; furthermore it can trigger
Assert failures and perhaps other internal errors, since the code is not
expecting these variables to change in such contexts.  The previous patch
did not cover this case because assign hooks don't really have enough
information, so move the responsibility for preventing this into guc.c.

Problem discovered by Heikki Linnakangas.

Security: no CVE assigned yet, extends CVE-2007-6600
2009-09-03 22:08:05 +00:00
Tom Lane
d0a368c656 Install a workaround for a longstanding gcc bug that allows SIGFPE traps
to occur for division by zero, even though the code is carefully avoiding
that.  All available evidence is that the only functions affected are
int24div, int48div, and int28div, so patch just those three functions to
include a "return" after the ereport() call.

Backpatch to 8.4 so that the fix can be tested in production builds.
For older branches our recommendation will continue to be to use -O1
on affected platforms (which are mostly non-mainstream anyway).
2009-09-03 18:48:14 +00:00
Michael Meskes
fc19373993 Fixed incorrect memory management. 2009-09-03 10:24:48 +00:00
Michael Meskes
2720c57005 Removed some variables no longer needed. 2009-09-03 09:59:20 +00:00
Michael Meskes
fe35c8e145 Do not set connection values if no connection is open. 2009-09-03 09:09:01 +00:00
Tom Lane
49d960c4d9 Update time zone data files to tzdata release 2009l: DST law changes in
Egypt, Mauritius, Bangladesh.
2009-09-03 04:44:35 +00:00
Tom Lane
b02c32e11b Remove initdb's rather gratuitous check to see if the backend created a
flat password file, because it never will anymore.  We had managed to
miss this during the recent flat-file-ectomy because it only happens if
--pwfile or --pwprompt is specified to initdb.  Apparently, few hackers
use those.  Reported by Erik Rijkers.
2009-09-03 01:40:11 +00:00
Magnus Hagander
5c709eecdc Revert Makefile modification that broke the MSVC build. 2009-09-02 19:14:14 +00:00
Tom Lane
57c9dff9d1 Fix subquery pullup to wrap a PlaceHolderVar around the entire RowExpr
that's generated for a whole-row Var referencing the subquery, when the
subquery is in the nullable side of an outer join.  The previous coding
instead put PlaceHolderVars around the elements of the RowExpr.  The effect
was that when the outer join made the subquery outputs go to null, the
whole-row Var produced ROW(NULL,NULL,...) rather than just NULL.  There
are arguments afoot about whether those things ought to be semantically
indistinguishable, but for the moment they are not entirely so, and the
planner needs to take care that its machinations preserve the difference.
Per bug #5025.

Making this feasible required refactoring ResolveNew() to allow more caller
control over what is substituted for a Var.  I chose to make ResolveNew()
a wrapper around a new general-purpose function replace_rte_variables().
I also fixed the ancient bogosity that ResolveNew might fail to set
a query's hasSubLinks field after inserting a SubLink in it.  Although
all current callers make sure that happens anyway, we've had bugs of that
sort before, and it seemed like a good time to install a proper solution.

Back-patch to 8.4.  The problem can be demonstrated clear back to 8.0,
but the fix would be too invasive in earlier branches; not to mention
that people may be depending on the subtly-incorrect behavior.  The
8.4 series is new enough that fixing this probably won't cause complaints,
but it might in older branches.  Also, 8.4 shows the incorrect behavior
in more cases than older branches do, because it is able to flatten
subqueries in more cases.
2009-09-02 17:52:24 +00:00
Tom Lane
040f28b4b0 Fix pg_ctl's readfile() to not go into infinite loop on an empty file
(could happen if either postgresql.conf or postmaster.opts is empty).
It's been broken since the C version was written for 8.0, so patch
all the way back.

initdb's copy of the function is broken in the same way, but it's
less important there since the input files should never be empty.
Patch that in HEAD only, and also fix some cosmetic differences that
crept into that copy of the function.

Per report from Corry Haines and Jeff Davis.
2009-09-02 02:40:52 +00:00
Tom Lane
794e3e81a0 Force VACUUM to recalculate oldestXmin even when we haven't changed our
own database's datfrozenxid, if the current value is old enough to be
forcing autovacuums or warning messages.  This ensures that a bogus
value is replaced as soon as possible.  Per a comment from Heikki.
2009-09-01 04:46:49 +00:00
Tom Lane
14f445fccf Actually, we need to bump the format identifier on twophase files
because of readjustment of 2PC rmgr IDs for flatfile removal.
2009-09-01 04:15:45 +00:00
Tom Lane
b92f7a22b9 Bump catversion for flat-file-ectomy. Also remove a missed dead extern
declaration.
2009-09-01 03:53:08 +00:00
Alvaro Herrera
a8bb8eb583 Remove flatfiles.c, which is now obsolete.
Recent commits have removed the various uses it was supporting.  It was a
performance bottleneck, according to bug report #4919 by Lauris Ulmanis; seems
it slowed down user creation after a billion users.
2009-09-01 02:54:52 +00:00
Tom Lane
0905e8aeeb Move processing of startup-packet switches and GUC settings into InitPostgres,
to fix the problem that SetClientEncoding needs to be done before
InitializeClientEncoding, as reported by Zdenek Kotala.  We get at least
the small consolation of being able to remove the bizarre API detail that
had InitPostgres returning whether user is a superuser.
2009-09-01 00:09:42 +00:00
Tom Lane
00e6a16d01 Change the autovacuum launcher to read pg_database directly, rather than
via the "flat files" facility.  This requires making it enough like a backend
to be able to run transactions; it's no longer an "auxiliary process" but
more like the autovacuum worker processes.  Also, its signal handling has
to be brought into line with backends/workers.  In particular, since it
now has to handle procsignal.c processing, the special autovac-launcher-only
signal conditions are moved to SIGUSR2.

Alvaro, with some cleanup from Tom
2009-08-31 19:41:00 +00:00
Tom Lane
25ec228ef7 Track the current XID wrap limit (or more accurately, the oldest unfrozen
XID) in checkpoint records.  This eliminates the need to recompute the value
from scratch during database startup, which is one of the two remaining
reasons for the flatfile code to exist.  It should also simplify life for
hot-standby operation.

To avoid bloating the checkpoint records unreasonably, I switched from
tracking the oldest database by name to tracking it by OID.  This turns
out to save cycles in general (everywhere but the warning-generating
paths, which we hardly care about) and also helps us deal with the case
that the oldest database got dropped instead of being vacuumed.  The prior
coding might go for a long time without updating the wrap limit in that case,
which is bad because it might result in a lot of useless autovacuum activity.
2009-08-31 02:23:23 +00:00
Tom Lane
e1cc64197b Remove some useless assignments of the result of fread(). Quiets warnings
from clang static checker, and makes the code more readable anyway IMO.
2009-08-30 17:18:52 +00:00
Tom Lane
dd6de24e69 Remove duplicate variable initializations identified by clang static checker.
One of these represents a nontrivial bug (a promptly-leaked palloc), so
backpatch.

Greg Stark
2009-08-30 16:53:31 +00:00
Tom Lane
e710b65c1c Remove the use of the pg_auth flat file for client authentication.
(That flat file is now completely useless, but removal will come later.)

To do this, postpone client authentication into the startup transaction
that's run by InitPostgres.  We still collect the startup packet and do
SSL initialization (if needed) at the same time we did before.  The
AuthenticationTimeout is applied separately to startup packet collection
and the actual authentication cycle.  (This is a bit annoying, since it
means a couple extra syscalls; but the signal handling requirements inside
and outside a transaction are sufficiently different that it seems best
to treat the timeouts as completely independent.)

A small security disadvantage is that if the given database name is invalid,
this will be reported to the client before any authentication happens.
We could work around that by connecting to database "postgres" instead,
but consensus seems to be that it's not worth introducing such surprising
behavior.

Processing of all command-line switches and GUC options received from the
client is now postponed until after authentication.  This means that
PostAuthDelay is much less useful than it used to be --- if you need to
investigate problems during InitPostgres you'll have to set PreAuthDelay
instead.  However, allowing an unauthenticated user to set any GUC options
whatever seems a bit too risky, so we'll live with that.
2009-08-29 19:26:52 +00:00
Bruce Momjian
585806cb9f Remove handling of CVS entries for TODO/FAQ, because they are removed
now.
2009-08-29 17:09:20 +00:00
Peter Eisentraut
234c7ce9f2 Derived files that are shipped in the distribution used to be built in the
source directory even for out-of-tree builds.  They are now alsl built in
the build tree.  This should be more convenient for certain developers'
workflows, and shouldn't really break anything else.
2009-08-28 20:26:19 +00:00
Tom Lane
0a00c9a8ef Remove useless code that propagated FrontendProtocol to a backend via a
PostgresMain switch.  In point of fact, FrontendProtocol is already set
in a backend process, since ProcessStartupPacket() is executed inside
the backend --- it hasn't been run by the postmaster for many years.
And if it were, we'd still certainly want FrontendProtocol to be set before
we get as far as PostgresMain, so that startup errors get reported in the
right protocol.

-v might have some future use in standalone backends, so I didn't go so
far as to remove the switch outright.

Also, initialize FrontendProtocol to 0 not PG_PROTOCOL_LATEST.  The only
likely result of presetting it like that is to mask failure-to-set-it
mistakes.
2009-08-28 18:23:53 +00:00
Tom Lane
c66d9ce774 Non-Windows EXEC_BACKEND path was broken by recent write_inheritable_socket
change ... it's got to return true.
2009-08-28 17:42:54 +00:00
Tom Lane
bb16dc49ab Modify the definition of window-function PARTITION BY and ORDER BY clauses
so that their elements are always taken as simple expressions over the
query's input columns.  It originally seemed like a good idea to make them
act exactly like GROUP BY and ORDER BY, right down to the SQL92-era behavior
of accepting output column names or numbers.  However, that was not such a
great idea, for two reasons:

1. It permits circular references, as exhibited in bug #5018: the output
column could be the one containing the window function itself.  (We actually
had a regression test case illustrating this, but nobody thought twice about
how confusing that would be.)

2. It doesn't seem like a good idea for, eg, "lead(foo) OVER (ORDER BY foo)"
to potentially use two completely different meanings for "foo".

Accordingly, narrow down the behavior of window clauses to use only the
SQL99-compliant interpretation that the expressions are simple expressions.
2009-08-27 20:08:03 +00:00
Alvaro Herrera
f065b17d9f Fix broken markup
Jan Urbański
2009-08-27 20:05:28 +00:00
Tom Lane
3d167209a7 Make the .DEF file generation rules safe against tabs in exports.txt.
Per bug #5016, although I think the MSVC build scripts may need a similar fix.
2009-08-27 17:55:53 +00:00
Alvaro Herrera
53af86c55c Fix handling of autovacuum reloptions.
In the original coding, setting a single reloption would cause default
values to be used for all the other reloptions.  This is a problem
particularly for autovacuum reloptions.

Itagaki Takahiro
2009-08-27 17:18:44 +00:00
Tom Lane
8f5500e6bd Make it reasonably safe to use pg_ctl to start the postmaster from a boot-time
script.

To do this, have pg_ctl pass down its parent shell's PID in an environment
variable PG_GRANDPARENT_PID, and teach CreateLockFile() to disregard that PID
as a false match if it finds it in postmaster.pid.  This allows us to cope
with one level of postgres-owned shell process even with pg_ctl in the way,
so it's just as safe as starting the postmaster directly.  You still have to
be careful about how you write the initscript though.

Adjust the comments in contrib/start-scripts/ to not deprecate use of
pg_ctl.  Also, fix the ROTATELOGS option in the OSX script, which was
indulging in exactly the sort of unsafe coding that renders this fix
pointless :-(.  A pipe inside the "sudo" will probably result in more
than one postgres-owned process hanging around.
2009-08-27 16:59:38 +00:00
Magnus Hagander
0e3f0cbddc exports.txt needs to use spaces as separators, not tabs, to work properly
with the sed rules.
2009-08-27 16:49:41 +00:00
Tom Lane
aaa9f7d495 Remove some unnecessary variable assignments, per results of "clang"
static checker.  Paul Matthews
2009-08-27 15:59:22 +00:00
Heikki Linnakangas
9cd6685f91 In the checkpoint written at the end of archive recovery, the WAL page header
was incorrectly initialized with timeline ID 0. That rendered the WAL page
unrecoverable, making a subsequent archive recovery stop at that point.
ThisTimeLineID needs to be initialized before calling AdvanceXLInsertBuffer().

This fixes bug #5011 reported by James Bardin. Backpatch to 8.4, as the bug
was introduced by the changes to use of bgwriter for writing the
end-of-archive-recovery checkpoint. Patch by Tom Lane.
2009-08-27 07:15:41 +00:00
Bruce Momjian
a814170d89 Update release notes for 7.4.26, 8.0.22, 8.1.18, 8.2.14, 8.3.8, 8.4.1. 2009-08-27 01:27:34 +00:00
Peter Eisentraut
9d182ef002 Update of install-sh, mkinstalldirs, and associated configury
Update install-sh to that from Autoconf 2.63, plus our Darwin-specific
changes (which I simplified a bit).  install-sh is now able to install
multiple files in one run, so we could simplify our makefiles sometime.

install-sh also now has a -d option to create directories, so we don't need
mkinstalldirs anymore.

Use AC_PROG_MKDIR_P in configure.in, so we can use mkdir -p when available
instead of install-sh -d.  For consistency with the rest of the world,
the corresponding make variable has been renamed from $(mkinstalldirs) to
$(MKDIR_P).
2009-08-26 22:24:44 +00:00
Peter Eisentraut
7ca774a873 Add -Wno-error to CFLAGS from gram.o as long as it's broken. 2009-08-26 22:15:59 +00:00
Peter Eisentraut
6c74c9dad8 Correct my overly enthusiastic CSS simplification. 2009-08-26 21:18:29 +00:00
Peter Eisentraut
ae3da8ad40 Update the documentation CSS stylesheet to current web site style 2009-08-26 13:56:24 +00:00
Peter Eisentraut
27c405d61a Enhanced error context support in PL/Python
Extract the "while creating return value" and "while modifying trigger
row" parts of some error messages into another layer of error context.
This will simplify the upcoming patch to improve data type support, but
it can stand on its own.
2009-08-25 12:44:59 +00:00
Peter Eisentraut
983d10833e Use generic attribute management in PL/Python
Switch the implementation of the plan and result types to generic attribute
management, as described at <http://docs.python.org/extending/newtypes.html>.
This modernizes and simplifies the code a bit and prepares for Python 3.1,
where the old way doesn't work anymore.
2009-08-25 08:14:42 +00:00
Peter Eisentraut
5dff93638c Make PL/Python tests more compatible with Python 3
This changes a bunch of incidentially used constructs in the PL/Python
regression tests to equivalent constructs in cases where Python 3 no longer
supports the old syntax.  Support for older Python versions is unchanged.
2009-08-24 20:25:25 +00:00
Tom Lane
8bed238c87 Try to make silent_mode behave somewhat reasonably.
Instead of sending stdout/stderr to /dev/null after forking away from the
terminal, send them to postmaster.log within the data directory.  Since
this opens the door to indefinite logfile bloat, recommend even more
strongly that log output be redirected when using silent_mode.

Move the postmaster's initial calls of load_hba() and load_ident() down
to after we have started the log collector, if we are going to.  This
is so that errors reported by them will appear in the "usual" place.

Reclassify silent_mode as a LOGGING_WHERE, not LOGGING_WHEN, parameter,
since it's got absolutely nothing to do with the latter category.

In passing, fix some obsolete references to -S ... this option hasn't
had that switch letter for a long time.

Back-patch to 8.4, since as of 8.4 load_hba() and load_ident() are more
picky (and thus more likely to fail) than they used to be.  This entire
change was driven by a complaint about those errors disappearing into
the bit bucket.
2009-08-24 20:08:32 +00:00
Tom Lane
5a4f763841 Small correction to previous patch: we shouldn't ReleasePostmasterChildSlot
for a dead_end child, because we didn't AssignPostmasterChildSlot.
2009-08-24 18:09:37 +00:00
Alvaro Herrera
45f9b4646f Avoid calling kill() in a postmaster signal handler.
This causes problems when the system load is high, per report from Zdenek
Kotala in <1250860954.1239.114.camel@localhost>; instead of calling kill
directly, have the signal handler set a flag which is checked in ServerLoop.
This way, the handler can return before being called again by a subsequent
signal sent from the autovacuum launcher.  Also, increase the sleep in the
launcher in this failure path to 1 second.

Backpatch to 8.3, which is when the signalling between autovacuum
launcher/postmaster was introduced.

Also, add a couple of ReleasePostmasterChildSlot calls in error paths; this
part backpatched to 8.4 which is when the child slot stuff was introduced.
2009-08-24 17:23:02 +00:00
Tom Lane
9b708f1f57 Fix inclusions of readline/editline header files so that we only attempt to
#include the version of history.h that is in the same directory as the
readline.h we are using.  This avoids problems in some scenarios where both
readline and editline are installed.  Report and patch by Zdenek Kotala.
2009-08-24 16:18:13 +00:00