Re: SSL SNI

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: Jacob Champion <pchampion@vmware.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2021-06-03T17:52:41Z
Lists: pgsql-hackers
I wrote:
> Jacob Champion <pchampion@vmware.com> writes:
>> It looks like this code needs some guards for a NULL conn->pghost. For example when running
>> psql 'dbname=postgres sslmode=require hostaddr=127.0.0.1'
>> with no PGHOST in the environment, psql is currently segfaulting for
>> me.

> Duplicated here:

It looks like the immediate problem can be resolved by just adding
a check for conn->pghost not being NULL, since the comment above
says

     * Per RFC 6066, do not set it if the host is a literal IP address (IPv4
     * or IPv6).

and having only hostaddr certainly fits that case.  But I didn't
check to see if any more problems arise later.

			regards, tom lane



Commits

  1. libpq: Fix SNI host handling

  2. libpq: Set Server Name Indication (SNI) for SSL connections