Re: SSL SNI
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: Jacob Champion <pchampion@vmware.com>,
"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2021-06-03T17:52:41Z
Lists: pgsql-hackers
I wrote:
> Jacob Champion <pchampion@vmware.com> writes:
>> It looks like this code needs some guards for a NULL conn->pghost. For example when running
>> psql 'dbname=postgres sslmode=require hostaddr=127.0.0.1'
>> with no PGHOST in the environment, psql is currently segfaulting for
>> me.
> Duplicated here:
It looks like the immediate problem can be resolved by just adding
a check for conn->pghost not being NULL, since the comment above
says
* Per RFC 6066, do not set it if the host is a literal IP address (IPv4
* or IPv6).
and having only hostaddr certainly fits that case. But I didn't
check to see if any more problems arise later.
regards, tom lane
Commits
-
libpq: Fix SNI host handling
- 37e1cce4ddf0 14.0 landed
-
libpq: Set Server Name Indication (SNI) for SSL connections
- 5c55dc8b4733 14.0 landed