Re: SSL SNI

Peter Eisentraut <peter.eisentraut@enterprisedb.com>

From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Matthias van de Meent <boekewurm+postgres@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2021-02-25T15:58:28Z
Lists: pgsql-hackers

Attachments

On 15.02.21 15:28, Matthias van de Meent wrote:
> +    /*
> +     * Set Server Name Indication (SNI), but not if it's a literal IP address.
> +     * (RFC 6066)
> +     */
> +    if (!((conn->pghost[0] >= '0' && conn->pghost[0] <= '9') ||
> strchr(conn->pghost, ':')))
> 
> '1one.example.com' is a valid hostname, but would fail this trivial
> test, and thus would not have SNI enabled on its connection.

Here is an updated patch that fixes this.  If there are other ideas for 
how to tell apart literal IP addresses from host names that are less ad 
hoc, I would welcome them.

Commits

  1. libpq: Fix SNI host handling

  2. libpq: Set Server Name Indication (SNI) for SSL connections