A.94. Release 4.1.23

Abort SSL negotiation if backend sends an error message. (Tatsuo Ishii)

In the client side implementation of SSL negotiation (pool_ssl_negotiate_clientserver()), it was possible for a man-in-the-middle attacker to send a long error message to confuse Pgpool-II or client while in the SSL negotiation phase. This commit rejects the negotiation immediately (issue a FATAL error) and exits the session to prevent such an attack.

This resembles PostgreSQL's CVE-2024-10977.

Fix the watchdog process not reloading configurations. (Bo Peng)

The reload_config() function in Pgpool-II should send a SIGHUP signal to the watchdog process.

Fix bug in do_query. (Tatsuo Ishii)

Fix do_query to use ntohs/ntohl instead of htons/htonl.

Fix authentication failure after updating pool_passwd and reload. (Tatsuo Ishii)

If pool_hba.conf is disabled, updating pool_passwd was not recognized by Pgpool-II child process even if Pgpool-II reload was performed. The reload processing function check_config_reload() mistakenly assumed that reopening pool_passwd was only necessary when enable_pool_hba is on.

Discussion: https://www.pgpool.net/pipermail/pgpool-general/2024-November/001944.html"

Fix COPY hangs. (#79) (Tatsuo Ishii)

During COPY IN state (i.e. COPY FROM STDIN), frontend can send Flush or Sync messages. According to the F/B protocol specification, they should be ignored but Pgpool-II treated as an invalid message and this causes COPY hung.

Also a regression test is added for this issue.

Fix sporadic health check failures due to authentication failure. (Tatsuo Ishii)

When health_check_password is empty string, health check process looks for the password from pool_passwd file. Problem is, the file descriptor for the file is inherited from parent pgpool process. This means that pgpool main and health check process (possibly multiple process) share the same descriptor, which causes various problem including the issue reported here. To fix the problem, re-open the file when health check process starts so that each health check process owns its own file descriptor.

Note that pgpool child process (responsible for frontend sessions) already re-opens the file descriptor and they are not related to the issue.

Problem reported and analyzed by Emond Papegaaij.

Discussion: https://www.pgpool.net/pipermail/pgpool-general/2024-October/001913.html

Optimize query cache invalidation for ALTER ROLE. (Tatsuo Ishii)

Commit 6b7d585eb1c693e4ffb5b8e6ed9aa0f067fa1b89 invalidates query cache if any ALTER ROLE/USER statement is used. Actually this is an overkill. Because following queries do not affect the privilege of the role.

ALTER ROLE user WITH [ENCRYPTED] PASSWORD
ALTER ROLE user WITH CONNECTION LIMIT
    

So do not invalidate query cache if those commands are used.

Discussion: https://www.pgpool.net/pipermail/pgpool-hackers/2024-October/004532.html

Fix bug in replication/snapshot isolation mode. (#69) (Tatsuo Ishii)

When INSERT command is received, pgpool automatically issues table LOCK command to the target table but it forgot to send the command to other than main nodes. This only happened in extended query mode.

Fix another bug in native replication/snapshot isolation mode. (Tatsuo Ishii)

insert_lock() forgot to send row lock command (lock_kind == 3 case) to other than main node.

Fix resource leaks in pool_memqcache.c. (Tatsuo Ishii)

These leaks were brought in by commit 6fdba5c33.

Fix typos in the documentation and sample configuration files. (Bo Peng)