pgpool2.git / summary / log / commit / refs
commit 8a6477e1d56bf65bdfc2ef71b4002fb2662fabbf
Author: Tatsuo Ishii <ishii at sraoss.co.jp>
Date: Sun Jan 31 02:22:24 2010 +0000
Prepare 2.3.2.
NEWS | 55 +++++++++++++-
configure | 2 +-
configure.in | 2 +-
doc/pgpool-en.html | 155 +++++++++++++++++++++++++++++++++++++--
doc/pgpool-ja.html | 156 ++++++++++++++++++++++++++++++++++++++--
pgpool.conf.sample | 12 +++-
pgpool.conf.sample-master-slave | 12 +++-
pgpool.conf.sample-replication | 12 +++-
pool.h | 2 +
pool_config.c | 70 +++++++++++++++---
pool_config.l | 40 +++++++++++
pool_ssl.c | 17 +++++
12 files changed, 510 insertions(+), 25 deletions(-)
diff --git a/NEWS b/NEWS
index 358397b6f..42274fc99 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,54 @@
+2.3.2 (tomiteboshi) 2010/02/01
+
+ * Version 2.3.2
+
+ This version includes various fixes for bugs in 2.3.1 or before.
+ All 2.3.x users are encouraged to upgrade to 2.3.2 as soon as
+ possible.
+
+ Also this version enables long awaited SSL support and large
+ object support.
+
+ * Enhancements
+
+ - SSL support(Sean Finney)
+
+ - Large object replication support. You need PostgreSQL 8.1 or
+ later, however(Tatsuo)
+
+ - While health checking and recovery use postgres database if
+ possible. If postgres database does not exist, use template1
+ as it stands now. While connecting template1, certain
+ commands, for example DROP DATABASE cannot used. Using postgres
+ database allows to use these commands while recovery(Tatsuo)
+
+ * Bug fixes
+
+ - Fix errors in timestamp rewriting which occasionaly cause
+ broken packet sending to slave nodes(Tatsuo)
+
+ - Fix errors when timestamp rewriting is used with V2
+ protocol(Toshihiro Kitagawa)
+
+ - Propagate Bind, Describe and Close messages to only master
+ node if running in master/slave and in transaction (Tatsuo)
+
+ - Fix do_child() so that check_stop_request() exits immediately
+ when smart shutdown signal has been sent. This has been used
+ to work in 2.2(Toshihiro Kitagawa)
+
+ - Fix ProcessFrontendResponse not to accept invalid frotend
+ packet(Xavier Noguer)
+
+ - Use %dz for sizeof in fprintf for more portability(Tatsuo)
+
+ - Fix compiler warnings(Tatsuo)
+
+ - Do not force replication of DEALLOCATE if operated in
+ master/slave mode. Now that pgpool do not execute PARSE in all
+ nodes, this was pointless and caused problem (kind mismatch
+ when executing DEALLOCATE)(Tatuso)
+
2.3.1 (tomiteboshi) 2009/12/18
* Version 2.3.1
@@ -16,8 +67,8 @@
- INSERT or UPDATE are used which explicitly include now(),
- CURRENT_TIMESTAMP, CURRENT_DATE, CURRENT_TIME. Or the target
- Table's default value use above functions
- - The SQQL statement inclludes out of 32bit
- integer(-2147483648 to 2147483647 in decimal)
+ - The SQL statement inclludes out of 32bit
+ integer value(-2147483648 to 2147483647 in decimal)
Example SQL: INSERT INTO t1(id, regdate) VALUES(98887776655,
NOW());
diff --git a/configure b/configure
index 3e1761096..e0542de10 100755
--- a/configure
+++ b/configure
@@ -2805,7 +2805,7 @@ fi
# Define the identity of the package.
PACKAGE=pgpool-II
- VERSION=2.3.1
+ VERSION=2.3.2
cat >>confdefs.h <<_ACEOF
diff --git a/configure.in b/configure.in
index 8cb616717..c6f5f6ff9 100644
--- a/configure.in
+++ b/configure.in
@@ -4,7 +4,7 @@ AC_INIT
dnl Checks for programs.
AC_PROG_CC
-AM_INIT_AUTOMAKE(pgpool-II, 2.3.1)
+AM_INIT_AUTOMAKE(pgpool-II, 2.3.2)
AC_PROG_RANLIB
AC_PROG_LIBTOOL
diff --git a/doc/pgpool-en.html b/doc/pgpool-en.html
index a9e017997..afb3d6d55 100644
--- a/doc/pgpool-en.html
+++ b/doc/pgpool-en.html
@@ -7,7 +7,7 @@
</head>
<!-- hhmts start -->
-Last modified: Mon Dec 7 18:37:01 JST 2009
+Last modified: Sat Jan 30 19:41:07 JST 2010
<!-- hhmts end -->
<body bgcolor="#ffffff">
@@ -118,8 +118,10 @@ Also packages are provided for various platforms including CentOS, RedHat Enterp
</p>
<p>Installing pgpool-II from source code requires gcc 2.9 or higher, and GNU
-make. Also, pgpool-II links libpq library, so it must be installed on
-a machine used to build pgpool-II.</p>
+make. Also, pgpool-II links libpq library, so the libpq library and development
+headers must be installed on a machine used to build pgpool-II. Additionally
+the OpenSSL library and development headers must be present in order to
+enable OpenSSL support in pgpool-II</p>
<dl>
<dt>configure</dt>
@@ -140,6 +142,9 @@ directory. Default value is <code>/usr/local</code></li>
<li><code>--with-pgsql=path</code><br/>
Top directory where PostgreSQL's client libraries are
installed. Default value is obtained by <code>pg_config</code></li>
+ <li><code>--with-openssl</code><br/>
+ pgpool-II binaries will be built with OpenSSL support. The default
+ is that OpenSSL support is disabled.</li>
</ul>
</p>
</dd>
@@ -670,9 +675,60 @@ You need to reload pgpool.conf if you change the value.
</p>
</dd>
+ <dt>ssl</dt>
+ <dd>
+ <p>
+ If true, enable SSL support for both the frontend and backend
+ connections. Note that <code>ssl_key</code> and <code>ssl_cert</code>
+ must also be set in order for SSL to work in the frontend connections.
+ </p>
+
+ <p>
+ The default is that SSL is off. Note that OpenSSL support must also
+ have been configured at compilation time, as mentioned in the
+ <a href="#install">installation</a> section.
+ </p>
+
+ <p>
+ The pgpool-II daemon must be restarted when updating SSL related settings.
+ </p>
+ </dd>
+
+ <dt>ssl_key</dt>
+ <dd>
+ <p>
+ The path to the private key file to use for incoming frontend connections.
+ </p>
+
+ <p>
+ There is no default value for this option, and if left unset SSL will
+ be disabled for incoming frontend connections.
+ </p>
+ </dd>
+
+ <dt>ssl_cert</dt>
+ <dd>
+ <p>
+ The path to the public x509 certificate file to use for incoming
+ frontend connections.
+ </p>
+
+ <p>
+ There is no default value for this option, and if left unset SSL will
+ be disabled for incoming frontend connections.
+ </p>
+ </dd>
+ </dl>
</dl>
+<h4>Generating SSL certificates</h4>
+
+Certificate handling is outside the scope of this document. The
+<a href="http://developer.postgresql.org/pgdocs/postgres/ssl-tcp.html">
+Secure TCP/IP Connections with SSL</a> page at postgresql.org has pointers
+with sample commands for how to generate self-signed certificates.
+
<h4><p>Failover in the raw Mode</p></h4>
<p>Failover can be performed in the raw mode if multiple servers are
@@ -980,6 +1036,55 @@ It can be changed on service.
off. You need to reload pgpool.conf if you change
client_idle_limit_in_recovery.</p>
+<dt>lobj_lock_table
+<dd>
+<p>
+Specify table name used for large object replication control. If
+it is specified, pgpool will lock the table specified by
+lobj_lock_table and generate large object id by looking into
+pg_largeobject system catalog and call lo_create to create large object.
+This way, it's guaranteed to use same large object id in all DB nodes in
+replication mode. Please note that PostgreSQL 8.0 or before does not
+have lo_create, thus this functionality will not work.
+</p>
+<p>
+Libpq function lo_creat() call will trigger this functionality. Also
+large object creation through Java API (JDBC driver), PHP
+API(pg_lo_create, or similar API in PHP library such as PDO) and same
+API in various programing languages are known to use similar protocol,
+thus should work.
+</p>
+<p>
+Following large object create operation will not work:
+<p>
+<ul>
+<li>lo_create of libpq
+<li>Any API of any language using lo_create
+<li>lo_import function in backend
+<li>SELECT lo_creat
+</ul>
+</p>
+<p>
+It does not matter what lobj_lock_table's schema is, but it should be
+writable by any user. Here is an example to create such a table:
+</p>
+<p>
+<pre>
+CREATE TABLE public.my_lock_table ();
+GRANT ALL ON public.my_lock_table TO PUBLIC;
+</pre>
+</p>
+<p>
+The table specified by lobj_lock_table must be created beforehand. If
+you create the table in template1, any database created afterward will
+have the table.
+</p>
+<p>
+If lobj_lock_table has empty string(''), the functionality is disabled
+(thus large object replication will not work). The default value for
+lobj_lock_table is ''.
+</p>
+
</dl>
<h4><p>condition for load balance</p></h4>
@@ -1091,6 +1196,41 @@ pgpool-II. The System DB's configuration is done in
<p>The password for the System DB. If no password is set,
set the empty string ('').</p>
</dd>
+
+ <dt>ssl_ca_cert</dt>
+ <dd>
+ <p>
+ The path to a PEM format file containing one or more CA root
+ certificates, which can be used to verify the backend server
+ certificate. This is analagous to the <code>-CAfile</code> option
+ to the OpenSSL <code>verify(1)</code> command.
+ </p>
+
+ <p>
+ The default value for this option is unset, such that no
+ verification takes place. Verification will still occur if
+ this option is not set but a value has been given for
+ <code>ssl_ca_cert_dir</code>.
+ </p>
+ </dd>
+
+ <dt>ssl_ca_cert_dir</dt>
+ <dd>
+ <p>
+ The path to a directory containing PEM format CA certficate
+ files, which can be used to verify the backend server
+ certificate. This is analagous to the <code>-CApath</code> option
+ to the OpenSSL <code>verify(1)</code> command.
+ </p>
+
+ <p>
+ The default value for this option is unset, such that no
+ verification takes place. Verification will still occur if
+ this option is not set but a value has been given for
+ <code>ssl_ca_cert</code>.
+ </p>
+ </dd>
+
</dl>
<h4><p>Initial Configuration of the System DB</p></h4>
@@ -1650,6 +1790,13 @@ pgmgt.conf.php.
</ul>
</p>
+<h2>Large object</h2>
+<p>
+pgpool-II 2.3.2 or later supports large object replication. For this, you need to
+enable lobj_lock_table directive in pgpool.conf. Proper large object
+replication using backend function lo_import is not supported, however.
+</p>
+
<h2>Functions, etc. In Replication Mode</h2>
<p>There is no guarantee that the data, which returns different values
@@ -1699,7 +1846,7 @@ cannot to be transformed thus cannot be properly replicated in the current imple
</ul>
</p>
-<p>Tables created by <code>CREATE TEMP TABLE</code> will be delete at the end of
+<p>Tables created by <code>CREATE TEMP TABLE</code> will be deleted at the end of
session by specifying DISCARD ALL in reset_query_list if you are using PostgreSQL 8.3 or later.
</p>
<p>
diff --git a/doc/pgpool-ja.html b/doc/pgpool-ja.html
index 4168f549f..f89c90799 100644
--- a/doc/pgpool-ja.html
+++ b/doc/pgpool-ja.html
@@ -8,7 +8,7 @@
<body>
<!-- hhmts start -->
-Last modified: Fri Dec 18 17:05:42 JST 2009
+Last modified: Sat Jan 30 19:58:41 JST 2010
<!-- hhmts end -->
<body bgcolor="#ffffff">
@@ -121,12 +121,16 @@ pgpool-II$B$N%=!<%9%3!<%I$+$i$N%$%s%9%H!<%k$K$O!"(Bgcc 2.9$B0J>e!"$*$h$S(BGN
configure$B$K;XDj$G$-$k%*%W%7%g%s$O0J2<$G$9!#(B
<ul>
-<li>--prefix=path
+<li><code>--prefix=path</code><br/>
pgpool-II$BK\BN$d4XO"%U%!%$%k$r%$%s%9%H!<%k$9$k%H%C%W%G%#%l%/%H%j$r;XDj$7$^$9!#(B
-$B%G%U%)%k%H$O(B/usr/local$B$G$9!#(B
-<li>--with-pgsql=path
+$B%G%U%)%k%H$O(B/usr/local$B$G$9!#(B</li>
+<li><code>--with-pgsql=path</code><br/>
PostgreSQL$B$N%/%i%$%"%s%H%i%$%V%i%j$J$I$,%$%s%9%H!<%k$5$l$F$$$k%H%C%W%G%#(B
-$B%l%/%H%j$r;XDj$7$^$9!#%G%U%)%k%H$O(Bpg_config $B%3%^%s%I$G<hF@$G$-$k%Q%9$G$9!#(B
+$B%l%/%H%j$r;XDj$7$^$9!#%G%U%)%k%H$O(B<code>pg_config</code>$B%3%^%s%I$G<hF@$G$-$k%Q%9$G$9!#(B</li>
+ <li><code>--with-openssl</code><br/>
+ pgpool-II$B$r(BOpenSSL$B%5%]!<%HIU$G:n@.$7$^$9!#(B
+ $B%G%U%)%k%H$G$O(BOpenSSL$B%5%]!<%H$OL58z$G$9!#(B</li>
+
</ul>
</p>
@@ -640,8 +644,54 @@ backend_data_directory $B$O?7$7$/DI2C$7$?9T$r@_Dj%U%!%$%k:FFI$_9~$_$GDI2C$9$k(
$B$k>l9g$K$O(B pgpool-II $B$r:F5/F0$7$F$/$@$5$$!#(B
</p>
+ <dt>ssl</dt>
+ <dd>
+ <p>
+ true$B$J$i$P(Bpgpool-II$B$H%U%m%s%H%(%s%I!"(Bpgpool-II$B$H%P%C%/%(%s%I$N4V$N(BSSL$B@\B3$,2DG=$K$J$j$^$9!#(B
+ $B$J$*!"(Bpgpool-II$B$H%U%m%s%H%(%s%I$N@\B3$K(BSSL$B$,MxMQ$G$-$k$?$a$K$O!"(B<code>ssl_key</code>$B$H(B<code>ssl_cert</code>$B$,@_Dj$5$l$F$J$1$l$P$J$j$^$;$s!#(B
+ </p>
+
+ <p>
+ $B%G%U%)%k%H$G$O(BSSL$B%5%]!<%H$O%*%U$K$J$C$F$$$^$9!#(BSSL$B%5%]!<%H$rM-8z$K$9$k$?$a$K$O!"(Bconfigure$B;~$K(BOpenSSL$B%5%]!<%H$rM-8z$K$9$kI,MW$,$"$j$^$9!#>\:Y$O(B<a href="#install">$B%$%s%9%H!<%k(B</a>$B$N9`L\$r$4Mw2<$5$$!#(B
+ </p>
+
+ <p>
+ ssl$B$rM-8z$K@_Dj$7$?$i!"(Bpgpool$B$N:F5/F0$r$7$F$/$@$5$$!#(B
+ </p>
+ </dd>
+
+ <dt>ssl_key</dt>
+ <dd>
+ <p>
+ $B%U%m%s%H%(%s%I$H$N@\B3$K;HMQ$9$k%W%i%$%Y!<%H%-!<%U%!%$%k$N%U%k%Q%9$r;XDj$7$^$9!#(B
+ </p>
+
+ <p>
+ ssl_key$B$N%G%U%)%k%HCM$O$"$j$^$;$s!#(B
+ ssl_key$B$N@_Dj$,$J$$>l9g$O!"%U%m%s%H%(%s%I$H$N@\B3$G(BSSL$B$,;HMQ$5$l$J$/$J$j$^$9!#(B
+ </p>
+ </dd>
+
+ <dt>ssl_cert</dt>
+ <dd>
+ <p>
+ $B%U%m%s%H%(%s%I$H$N@\B3$K;HMQ$9$k8x3+(Bx509$B>ZL@=q$N%U%k%Q%9$r;XDj$7$^$9!#(B
+ </p>
+
+ <p>
+ ssl_cert$B$N%G%U%)%k%HCM$O$"$j$^$;$s!#(B
+ ssl_cert$B$N@_Dj$,$J$$>l9g$O!"%U%m%s%H%(%s%I$H$N@\B3$G(BSSL$B$,;HMQ$5$l$J$/$J$j$^$9!#(B
+ </p>
+ </dd>
+
</dl>
+<h4>SSL$B>ZL@=q$N@8@.(B</h4>
+<p>
+$B>ZL@=q$N07$$$K$D$$$F$O$3$N%^%K%e%"%k$NHO0O30$G$9!#(B
+PostgreSQL$B%I%-%e%a%s%H(B<a href="http://www.postgresql.jp/document/pg842doc/html/ssl-tcp.html">SSL$B$K$h$k0BA4$J(BTCP/IP$B@\B3(B</a>$B$N>O$K<+J,$GG'>Z$9$k>ZL@=q$r:n@.$9$k%3%^%s%I$NNc$,$"$j$^$9!#(B
+</p>
+
<h4><p>raw$B%b!<%I$K$*$1$k%U%'%$%k%*!<%PF0:n$K$D$$$F(B</p></h4>
<p>
raw$B%b!<%I$K$*$$$F!"(B2$BBf0J>e$N(BPostgreSQL$B%5!<%P$r;XDj$9$k$H!"%U%'%$%k%*!<%P(B
@@ -977,6 +1027,65 @@ recovery_timeout$B$r(B0$B$H$7$F$b%?%$%`%"%&%H$,L58z$K$J$k$o$1$G$O$J$/!"C1$KB(
$B$3$N%Q%i%a!<%?$rJQ99$7$?;~$K$O@_Dj%U%!%$%k$r:FFI$_9~$_$7$F$/$@$5$$!#(B
</p>
+<dt>lobj_lock_table
+<dd>
+<p>
+$B%i!<%8%*%V%8%'%/%H$N%l%W%j%1!<%7%g%s$r9T$$$?$$$H$-$K%m%C%/4IM}$K;H$&$?$a$N%F!<%V%kL>$r;XDj$7$^$9!#(B
+$B$3$N%F!<%V%k$,;XDj$5$l$F$$$F!"%i!<%8%*%V%8%'%/%H$N:n@.MW5a$,%/%i%$%"%s%H$+$iAw?.$5$l!"(B
+$B$+$D$=$NMW5a$NCf$K%i!<%8%*%V%8%'%/%H$N(BID$B$NL@<(E*$J;XDj$,4^$^$l$F$$$J$$>l9g(B($B$D$^$j!"(Blo_creat$B$G%i!<%8%*%V%8%'%/%H$r:n@.$9$k>l9g(B)$B!"(B
+pgpool-II$B$O!"GSB>@)8f$N$?$a$K$3$N%F!<%V%k$r%m%C%/$7$?8e!"(B
+$B%i!<%8%*%V%8%'%/%H$r3JG<$9$k%7%9%F%`%+%?%m%0(Bpg_largeobject$B$N%i!<%8%*%V%8%'%/%H$K3JG<$5$l$F$$$k(BID$B$N:GBgCM$r<h$j$@$7!"(B
+$B$=$NCM(B+1$B$N(BID$B$r;H$C$F(Blo_create()$B$r8F$S=P$7$F%i!<%8%*%V%8%'%/%H$N:n@.$r9T$$$^$9(B(lo_create()$B$r;}$?$J$$%P!<%8%g%s(B8.1$B$h$jA0$N(BPostgreSQL$B$G$O$3$N=hM}$O9T$o$l$^$;$s(B)$B!#(B
+$B$3$NJ}K!$K$h$j!"$9$Y$F$N(BDB$B%N!<%I$GF1$8(BID$B$r;}$D%i!<%8%*%V%8%'%/%H$,:n@.$5$l$k$3$H$,J]>Z$5$l$^$9!#(B
+</p>
+<p>
+$B$3$N$h$&$J=hM}$NBP>]$H$J$k%i!<%8%*%V%8%'%/%H$NA`:n$O!"(BPostgreSQL$B$N(BC$B8@8lMQ$N(BAPI(libpq)$B$G8@$&$H!"(Blo_creat()$B$G$9!#(B
+2010$BG/(B2$B7n;~E@$N2f!9$ND4::$G$O!"0J2<$N8@8l$N%i!<%8%*%V%8%'%/%H:n@.(BAPI$B$O!"$9$Y$F(Blo_creat()$B$r8F$S=P$9$+!"(B
+$B$^$?$O(Blo_creat()$B$HF1$8DL?.%W%m%H%3%k$r;H$C$F$$$k$N$G!"(Bpgpool-II$B$N>e5-$NA`:n$NBP>]$K$J$j!"%i!<%8%*%V%8%'%/%H$N%l%W%j%1!<%7%g%s$,0BA4$K9T$o$l$k$h$&$K$J$j$^$9!#(B
+</p>
+<p>
+<ul>
+<li>Java(JDBC$B%I%i%$%P(B)
+<li>PHP(pg_lo_create$B4X?t!"$^$?$O(BPDO$B$J$I$N3:Ev(BAPI)
+<li>psql$B$+$i(B\lo_import$B$r8F$S=P$9>l9g(B
+</ul>
+</p>
+<p>
+$B>e5-0J30$G$"$C$F$b!"%i!<%8%*%V%8%'%/%H$N:n@.(BAPI$B$G%i!<%8%*%V%8%'%/%H$N(BID$B$r0z?t$H$7$FEO$9$h$&$K$J$C$F$$$J$$$b$N$O4V0c$$$J$/(Blo_creat()$B$r;H$C$F$*$j!"(Bpgpool-II$B$N>e5-$NA`:n$NBP>]$K$J$k$H9M$($FNI$$$G$7$g$&!#(B
+</p>
+
+<p>
+pgpool-II$B$N>e5-=hM}$NBP>]$H$J$i$J$$$h$&$J%i!<%8%*%V%8%'%/%H$N:n@.=hM}$O0J2<$N$b$N$G$9!#(B
+</p>
+<p>
+<ul>
+<li>libpq$B$N(Blo_create()$B$r;HMQ$7$F$$$k(B
+<li>C$B8@8l0J30$N(BAPI$B$G!"(Blo_create()$B$r;HMQ$7$F$$$k$b$N(B
+<li>$B%P%C%/%(%s%I4X?t$N(Blo_import$B$r(BSELECT$B$G8F$S=P$9>l9g(B
+<li>$B%P%C%/%(%s%I4X?t$N(Blo_creat$B$r(BSELECT$B$G8F$S=P$9>l9g(B
+</ul>
+</p>
+<p>
+lobj_lock_table$B$G;XDj$9$k%F!<%V%k$O$I$N$h$&$JDj5A$N$b$N$G$b9=$$$^$;$s$,!"(B
+$B$"$i$+$8$a:n@.:Q$G$+$D$9$Y$F$N%f!<%6$,=q$-9~$_2DG=$G$J$1$l$P$J$j$^$;$s!#(B
+$B$=$N$h$&$J%F!<%V%k$r:n$kNc$r<($7$^$9!#(B
+</p>
+<p>
+<pre>
+CREATE TABLE public.my_lock_table ();
+GRANT ALL ON public.my_lock_table TO PUBLIC;
+</pre>
+</p>
+<p>
+$B$3$NA`:n$O(Bpgpool-II$B7PM3$G@\B3$9$k$9$Y$F$N%G!<%?%Y!<%9$KBP$7$F!"$"$i$+$8$a<B;\$7$F$*$+$J$1$l$P$J$j$^$;$s!#(B
+$B$7$+$7!"$3$NA`:n$r(Btemplate1$B%G!<%?%Y!<%9$KBP$7$F0lEY9T$C$F$*$1$P!"0J8e:n@.$5$l$k%G!<%?%Y!<%9$K$O$3$N%F!<%V%k$,4^$^$l$k$h$&$K$J$k$N$G!"4IM}$N<j4V$,>J$1$^$9!#(B
+</p>
+<p>
+lobj_lock_table$B$K;XDj$9$k%F!<%V%kL>$,6uJ8;z$N>l9g$O!"%i!<%8%*%V%8%'%/%H$K4X$9$k>e5-$N=hM}$O9T$$$^$;$s(B
+($B$7$?$,$C$F!"%i!<%8%*%V%8%'%/%H$N%l%W%j%1!<%7%g%s$OJ]>Z$5$l$^$;$s(B)$B!#(B
+lobj_lock_table$B$N%G%U%)%k%HCM$O6uJ8;z$G$9!#(B
+</p>
+
</dl>
<h4><p>$B%m!<%I%P%i%s%9$N>r7o$K$D$$$F(B</p></h4>
@@ -994,7 +1103,7 @@ load_balance_mode = true $B$r@_Dj$7$?>l9g!"0J2<$N>r7o$N$9$Y$F$rK~$?$7$?;~$K(BS
<p>
(<a href="#replicate_select">replicate_select$B$N9`L\(B</a>$B$b;29M$K$7$F$/$@$5$$(B)
-$B$^$?!"(B<a href="load_balance.png">$B>\:Y$JH=Dj>r7o$r%U%m!<%A%c!<%H$K$7$?$b(B</a>$B$N$b$4Mw2<$5$$!#(B
+$B$^$?!"(B<a href="load_balance.png">$B>\:Y$JH=Dj>r7o$r%U%m!<%A%c!<%H$K$7$?$b$N(B</a>$B$b$4Mw2<$5$$!#(B
$B$J$*!"(B
<pre>
@@ -2658,6 +2767,41 @@ pgpool-II$B$N%A%e!<%H%j%"%k$O(B<a href="tutorial-ja.html">$B$3$3(B<a/>$B$K$
<h1>$B%j%j!<%9%N!<%H(B<a name="release"></a></h1>
+<h2>2.3.2 (tomiteboshi) 2010/02/01</h2>
+<h3>$B35MW(B</h3>
+<p>
+$B$3$N%P!<%8%g%s$G$O!"(B2.3.1$B$N?'!9$J%P%0$,=$@5$5$l$F$$$^$9!#(B
+$BFC$K!"%?%$%`%9%?%s%W$N=q$-49$(5!G=$N%P%0$,=$@5$5$l$F$$$k$N$G!"(B2.3, 2.3.1$B%f!<%6$O$J$k$Y$/Aa$/(B2.3.2$B$K%"%C%W%0%l!<%I$9$k$3$H$r$*4+$a$7$^$9!#(B
+</p>
+<p>
+$B$^$?!"(B2.3.2$B$G$O(BSSL$B%5%]!<%H!"%i!<%8%*%V%8%'%/%H$N%l%W%j%1!<%7%g%s5!G=$,DI2C$5$l$F$$$^$9!#(B
+</p>
+
+<h3>$B2~NIE@(B</h3>
+<p>
+<ul>
+ <li>SSL$B$,%5%]!<%H$5$l$^$7$?(B((Sean Finney)
+ <li>$B%i!<%8%*%V%8%'%/%H$N%l%W%j%1!<%7%g%s$,%5%]!<%H$5$l$^$7$?(B(Tatsuo)
+ <li>$B%X%k%9%A%'%C%/$H%*%s%i%$%s%j%+%P%j$N:]$K2DG=$G$"$l$P(Bpostgres$B%G!<%?%Y!<%9$r;H$&$h$&$K$7$^$7$?!#(B
+ postgres$B%G!<%?%Y!<%9$,B8:_$7$J$$>l9g$O(Btemplate1$B$,;H$o$l$^$9(B($B0JA0$NF0:n$HF1$8(B)$B!#(B
+ $B$3$l$K$h$j!"(BDROP DATABASE$B$J$I$N%3%^%s%I$,%*%s%i%$%s%j%+%P%jCf$G$b;H$($k$h$&$K$J$j$^$7$?(B(Tatsuo)
+</ul>
+</p>
+
+<h3>$B%P%0=$@5(B</h3>
+<p>
+<ul>
+ <li>$B$?$^$K%?%$%`%9%?%s%W$r=q$-49$($?Ld$$9g$o$;$,%^%9%?0J30$N(BDB$B%N!<%I$KIT@5$J%Q%1%C%H$rAw$C$F$7$^$&LdBj$r=$@5$7$^$7$?(B(Tatsuo)
+ <li>V2$B%W%m%H%3%k$G%?%$%`%9%?%s%W$N=q$-49$(=hM}$,%(%i!<$K$J$k$N$r=$@5$7$^$7$?(B(Toshihiro Kitagawa)
+ <li>master/slave$B%b!<%I!"$+$D%H%i%s%6%/%7%g%sFb$GH/9T$5$l$k(BBind$B!"(BDescribe$B!"(BClose$B%a%C%;!<%8$O%^%9%?$@$1$KAw$k$h$&$K$7$^$7$?(B(Tatsuo)
+ <li>2.3$B$G(Bsmart shutdown$B$K$h$j$9$0$KDd;_$7$J$/$J$C$?%P%0$r=$@5$7$^$7$?(B(Toshihiro Kitagawa)
+ <li>$B%U%m%s%H%(%s%I$+$i$NIT@5$J%3%^%s%I$r<u$1IU$1$J$$$h$&$K$7$^$7$?(B(Xavier Noguer)
+ <li>$B0\?"@-$r9b$a$k$?$a$K!"(Bfprintf$B$N0z?t$K(B%dz$B$r;HMQ$9$k$h$&$K$7$^$7$?(B(Tatsuo)
+ <li>$B%3%s%Q%$%i%o!<%K%s%0$r=$@5$7$^$7$?(B(Tatsuo)
+ <li>master/slave$B%b!<%I$N:]$K!"(BDEALLOCATE$B$r$9$Y$F$N%N!<%I$KAw$i$J$$$h$&$K$7$F!"(Bkind mismatch$B%(%i!<$rKI$0$h$&$K$7$^$7$?(B(Tatsuo)
+</ul>
+</p>
+
<h2>2.3.1 (tomiteboshi) 2009/12/18</h2>
<h3>$B35MW(B</h3>
<p>
diff --git a/pgpool.conf.sample b/pgpool.conf.sample
index f49434795..ed2f3af43 100644
--- a/pgpool.conf.sample
+++ b/pgpool.conf.sample
@@ -227,4 +227,14 @@ ssl = false
# path to the SSL private key file
#ssl_key = './server.key'
# path to the SSL public certificate file
-#ssl_key = './server.cert'
+#ssl_cert = './server.cert'
+
+# If either ssl_ca_cert or ssl_ca_cert_dir is set, then certificate
+# verification will be performed to establish the authenticity of the
+# certificate. If neither is set to a nonempty string then no such
+# verification takes place. ssl_ca_cert should be a path to a single
+# PEM format file containing CA root certificate(s), whereas ssl_ca_cert_dir
+# should be a directory containing such files. These are analagous to the
+# -CAfile and -CApath options to openssl verify(1), respectively.
+#ssl_ca_cert = ''
+#ssl_ca_cert_dir = ''
diff --git a/pgpool.conf.sample-master-slave b/pgpool.conf.sample-master-slave
index 350d07604..b99116a4e 100644
--- a/pgpool.conf.sample-master-slave
+++ b/pgpool.conf.sample-master-slave
@@ -227,4 +227,14 @@ ssl = false
# path to the SSL private key file
#ssl_key = './server.key'
# path to the SSL public certificate file
-#ssl_key = './server.cert'
+#ssl_cert = './server.cert'
+
+# If either ssl_ca_cert or ssl_ca_cert_dir is set, then certificate
+# verification will be performed to establish the authenticity of the
+# certificate. If neither is set to a nonempty string then no such
+# verification takes place. ssl_ca_cert should be a path to a single
+# PEM format file containing CA root certificate(s), whereas ssl_ca_cert_dir
+# should be a directory containing such files. These are analagous to the
+# -CAfile and -CApath options to openssl verify(1), respectively.
+#ssl_ca_cert = ''
+#ssl_ca_cert_dir = ''
diff --git a/pgpool.conf.sample-replication b/pgpool.conf.sample-replication
index 5279bc919..41b8bdef4 100644
--- a/pgpool.conf.sample-replication
+++ b/pgpool.conf.sample-replication
@@ -227,4 +227,14 @@ ssl = false
# path to the SSL private key file
#ssl_key = './server.key'
# path to the SSL public certificate file
-#ssl_key = './server.cert'
+#ssl_cert = './server.cert'
+
+# If either ssl_ca_cert or ssl_ca_cert_dir is set, then certificate
+# verification will be performed to establish the authenticity of the
+# certificate. If neither is set to a nonempty string then no such
+# verification takes place. ssl_ca_cert should be a path to a single
+# PEM format file containing CA root certificate(s), whereas ssl_ca_cert_dir
+# should be a directory containing such files. These are analagous to the
+# -CAfile and -CApath options to openssl verify(1), respectively.
+#ssl_ca_cert = ''
+#ssl_ca_cert_dir = ''
diff --git a/pool.h b/pool.h
index 777de2f3a..57bddd321 100644
--- a/pool.h
+++ b/pool.h
@@ -221,6 +221,8 @@ typedef struct {
int ssl; /* if non 0, activate ssl support (frontend+backend) */
char *ssl_cert; /* path to ssl certificate (frontend only) */
char *ssl_key; /* path to ssl key (frontend only) */
+ char *ssl_ca_cert; /* path to root (CA) certificate */
+ char *ssl_ca_cert_dir; /* path to directory containing CA certificates */
} POOL_CONFIG;
#define MAX_PASSWORD_SIZE 1024
diff --git a/pool_config.c b/pool_config.c
index 9670a630a..022d972ed 100644
--- a/pool_config.c
+++ b/pool_config.c
@@ -53,7 +53,6 @@ typedef int flex_int32_t;
typedef unsigned char flex_uint8_t;
typedef unsigned short int flex_uint16_t;
typedef unsigned int flex_uint32_t;
-#endif /* ! C99 */
/* Limits of integral types. */
#ifndef INT8_MIN
@@ -84,6 +83,8 @@ typedef unsigned int flex_uint32_t;
#define UINT32_MAX (4294967295U)
#endif
+#endif /* ! C99 */
+
#endif /* ! FLEXINT_H */
#ifdef __cplusplus
@@ -140,7 +141,15 @@ typedef unsigned int flex_uint32_t;
/* Size of default input buffer. */
#ifndef YY_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k.
+ * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case.
+ * Ditto for the __ia64__ case accordingly.
+ */
+#define YY_BUF_SIZE 32768
+#else
#define YY_BUF_SIZE 16384
+#endif /* __ia64__ */
#endif
/* The state buf must be large enough to hold one state per character in the main buffer.
@@ -540,7 +549,7 @@ static char **extract_string_tokens(char *str, char *delim, int *n);
static int eval_logical(char *str);
static void clear_host_entry(int slot);
-#line 544 "pool_config.c"
+#line 553 "pool_config.c"
#define INITIAL 0
@@ -619,7 +628,12 @@ static int input (void );
/* Amount of stuff to slurp up with each read. */
#ifndef YY_READ_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k */
+#define YY_READ_BUF_SIZE 16384
+#else
#define YY_READ_BUF_SIZE 8192
+#endif /* __ia64__ */
#endif
/* Copy whatever the last rule matched to the standard output. */
@@ -627,7 +641,7 @@ static int input (void );
/* This used to be an fputs(), but since the string might contain NUL's,
* we now use fwrite().
*/
-#define ECHO fwrite( yytext, yyleng, 1, yyout )
+#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
#endif
/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL,
@@ -638,7 +652,7 @@ static int input (void );
if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \
{ \
int c = '*'; \
- int n; \
+ size_t n; \
for ( n = 0; n < max_size && \
(c = getc( yyin )) != EOF && c != '\n'; ++n ) \
buf[n] = (char) c; \
@@ -723,7 +737,7 @@ YY_DECL
#line 84 "pool_config.l"
-#line 727 "pool_config.c"
+#line 741 "pool_config.c"
if ( !(yy_init) )
{
@@ -861,7 +875,7 @@ YY_RULE_SETUP
#line 99 "pool_config.l"
ECHO;
YY_BREAK
-#line 865 "pool_config.c"
+#line 879 "pool_config.c"
case YY_STATE_EOF(INITIAL):
yyterminate();
@@ -1579,8 +1593,8 @@ YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
/** Setup the input buffer state to scan the given bytes. The next call to yylex() will
* scan from a @e copy of @a bytes.
- * @param bytes the byte buffer to scan
- * @param len the number of bytes in the buffer pointed to by @a bytes.
+ * @param yybytes the byte buffer to scan
+ * @param _yybytes_len the number of bytes in the buffer pointed to by @a bytes.
*
* @return the newly allocated buffer state object.
*/
@@ -1905,6 +1919,8 @@ int pool_init_config(void)
pool_config->ssl = 0;
pool_config->ssl_cert = "";
pool_config->ssl_key = "";
+ pool_config->ssl_ca_cert = "";
+ pool_config->ssl_ca_cert_dir = "";
res = gethostname(localhostname,sizeof(localhostname));
if(res !=0 )
@@ -3008,6 +3024,44 @@ int pool_get_config(char *confpath, POOL_CONFIG_CONTEXT context)
}
pool_config->ssl_key = str;
}
+ else if (!strcmp(key, "ssl_ca_cert") &&
+ CHECK_CONTEXT(INIT_CONFIG, context))
+ {
+ char *str;
+
+ if (token != POOL_STRING && token != POOL_UNQUOTED_STRING && token != POOL_KEY)
+ {
+ PARSE_ERROR();
+ fclose(fd);
+ return(-1);
+ }
+ str = extract_string(yytext, token);
+ if (str == NULL)
+ {
+ fclose(fd);
+ return(-1);
+ }
+ pool_config->ssl_ca_cert = str;
+ }
+ else if (!strcmp(key, "ssl_ca_cert_dir") &&
+ CHECK_CONTEXT(INIT_CONFIG, context))
+ {
+ char *str;
+
+ if (token != POOL_STRING && token != POOL_UNQUOTED_STRING && token != POOL_KEY)
+ {
+ PARSE_ERROR();
+ fclose(fd);
+ return(-1);
+ }
+ str = extract_string(yytext, token);
+ if (str == NULL)
+ {
+ fclose(fd);
+ return(-1);
+ }
+ pool_config->ssl_ca_cert_dir = str;
+ }
}
fclose(fd);
diff --git a/pool_config.l b/pool_config.l
index adb0c71fc..1104ddc0c 100644
--- a/pool_config.l
+++ b/pool_config.l
@@ -180,6 +180,8 @@ int pool_init_config(void)
pool_config->ssl = 0;
pool_config->ssl_cert = "";
pool_config->ssl_key = "";
+ pool_config->ssl_ca_cert = "";
+ pool_config->ssl_ca_cert_dir = "";
res = gethostname(localhostname,sizeof(localhostname));
if(res !=0 )
@@ -1283,6 +1285,44 @@ int pool_get_config(char *confpath, POOL_CONFIG_CONTEXT context)
}
pool_config->ssl_key = str;
}
+ else if (!strcmp(key, "ssl_ca_cert") &&
+ CHECK_CONTEXT(INIT_CONFIG, context))
+ {
+ char *str;
+
+ if (token != POOL_STRING && token != POOL_UNQUOTED_STRING && token != POOL_KEY)
+ {
+ PARSE_ERROR();
+ fclose(fd);
+ return(-1);
+ }
+ str = extract_string(yytext, token);
+ if (str == NULL)
+ {
+ fclose(fd);
+ return(-1);
+ }
+ pool_config->ssl_ca_cert = str;
+ }
+ else if (!strcmp(key, "ssl_ca_cert_dir") &&
+ CHECK_CONTEXT(INIT_CONFIG, context))
+ {
+ char *str;
+
+ if (token != POOL_STRING && token != POOL_UNQUOTED_STRING && token != POOL_KEY)
+ {
+ PARSE_ERROR();
+ fclose(fd);
+ return(-1);
+ }
+ str = extract_string(yytext, token);
+ if (str == NULL)
+ {
+ fclose(fd);
+ return(-1);
+ }
+ pool_config->ssl_ca_cert_dir = str;
+ }
}
fclose(fd);
diff --git a/pool_ssl.c b/pool_ssl.c
index fcae52a8b..c9d5fa8e1 100644
--- a/pool_ssl.c
+++ b/pool_ssl.c
@@ -113,6 +113,7 @@ int pool_ssl_write(POOL_CONNECTION *cp, const void *buf, int size) {
static int init_ssl_ctx(POOL_CONNECTION *cp, enum ssl_conn_type conntype) {
int error = 0;
+ char *cacert = NULL, *cacert_dir = NULL;
/* initialize SSL members */
cp->ssl_ctx = SSL_CTX_new(TLSv1_method());
@@ -135,6 +136,22 @@ static int init_ssl_ctx(POOL_CONNECTION *cp, enum ssl_conn_type conntype) {
pool_error("pool_ssl: SSL key failure: %ld", ERR_get_error());
error = -1;
}
+ } else {
+ /* set extra verification if ssl_ca_cert or ssl_ca_cert_dir are set */
+ if (strlen(pool_config->ssl_ca_cert))
+ cacert = pool_config->ssl_ca_cert;
+ if (strlen(pool_config->ssl_ca_cert_dir))
+ cacert_dir = pool_config->ssl_ca_cert_dir;
+
+ if ( (!error) && (cacert || cacert_dir) ) {
+ if (! SSL_CTX_load_verify_locations(cp->ssl_ctx, cacert, cacert_dir)) {
+ pool_error("pool_ssl: SSL CA load error: %ld", ERR_get_error());
+ error = -1;
+ } else {
+ SSL_CTX_set_verify(cp->ssl_ctx, SSL_VERIFY_PEER, NULL);
+ }
+ }
+
}
if (! error) {
[parent: 0920be83a880]