Disallow starting server with insufficient wal_level for existing slot.

Previously it was possible to create a slot, change wal_level, and
restart, even if the new wal_level was insufficient for the
slot. That's a problem for both logical and physical slots, because
the necessary WAL records are not generated.

This removes a few tests in newer versions that, somewhat
inexplicably, whether restarting with a too low wal_level worked (a
buggy behaviour!).

Reported-By: Joshua D. Drake
Author: Andres Freund
Discussion: https://postgr.es/m/20181029191304.lbsmhshkyymhw22w@alap3.anarazel.de
Backpatch: 9.4-, where replication slots where introduced

diff --git a/src/backend/replication/logical/logical.c b/src/backend/replication/logical/logical.c
index 855f0035410b36e3f07c9d7ec71a9dcc8b744b0a..77a73bd3d1ee87f57d257920df490a068d56e3e7 100644 (file)
--- a/src/backend/replication/logical/logical.c
+++ b/src/backend/replication/logical/logical.c
@@ -74,6 +74,11 @@ CheckLogicalDecodingRequirements(void)
 {
        CheckSlotRequirements();
 
+       /*
+        * NB: Adding a new requirement likely means that RestoreSlotFromDisk()
+        * needs the same check.
+        */
+
        if (wal_level < WAL_LEVEL_LOGICAL)
                ereport(ERROR,
                                (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),

diff --git a/src/backend/replication/slot.c b/src/backend/replication/slot.c
index aff100b192a93bf6b53d8b2a6b4c71d48a7d61ef..533e28dc23804c097abdfc073ad56962cf2c836b 100644 (file)
--- a/src/backend/replication/slot.c
+++ b/src/backend/replication/slot.c
@@ -797,6 +797,11 @@ ReplicationSlotsCountDBSlots(Oid dboid, int *nslots, int *nactive)
 void
 CheckSlotRequirements(void)
 {
+       /*
+        * NB: Adding a new requirement likely means that RestoreSlotFromDisk()
+        * needs the same check.
+        */
+
        if (max_replication_slots == 0)
                ereport(ERROR,
                                (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
@@ -1238,6 +1243,31 @@ RestoreSlotFromDisk(const char *name)
                return;
        }
 
+       /*
+        * Verify that requirements for the specific slot type are met. That's
+        * important because if these aren't met we're not guaranteed to retain
+        * all the necessary resources for the slot.
+        *
+        * NB: We have to do so *after* the above checks for ephemeral slots,
+        * because otherwise a slot that shouldn't exist anymore could prevent
+        * restarts.
+        *
+        * NB: Changing the requirements here also requires adapting
+        * CheckSlotRequirements() and CheckLogicalDecodingRequirements().
+        */
+       if (cp.slotdata.database != InvalidOid && wal_level < WAL_LEVEL_LOGICAL)
+               ereport(FATAL,
+                               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                errmsg("logical replication slots \"%s\" exists, but wal_level < logical",
+                                               NameStr(cp.slotdata.name)),
+                                errhint("Change wal_level to be replica or higher.")));
+       else if (wal_level < WAL_LEVEL_ARCHIVE)
+               ereport(FATAL,
+                               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                errmsg("physical replication slots \"%s\" exists, but wal_level < archive",
+                                               NameStr(cp.slotdata.name)),
+                                errhint("Change wal_level to be archive or higher.")));
+
        /* nothing can be active yet, don't lock anything */
        for (i = 0; i < max_replication_slots; i++)
        {