Re: SSL SNI
Peter Eisentraut <peter.eisentraut@enterprisedb.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Matthias van de Meent <boekewurm+postgres@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2021-02-25T15:58:28Z
Lists: pgsql-hackers
Attachments
- v2-0001-Set-SNI-for-SSL-connections-from-the-client.patch (text/plain) patch v2-0001
On 15.02.21 15:28, Matthias van de Meent wrote: > + /* > + * Set Server Name Indication (SNI), but not if it's a literal IP address. > + * (RFC 6066) > + */ > + if (!((conn->pghost[0] >= '0' && conn->pghost[0] <= '9') || > strchr(conn->pghost, ':'))) > > '1one.example.com' is a valid hostname, but would fail this trivial > test, and thus would not have SNI enabled on its connection. Here is an updated patch that fixes this. If there are other ideas for how to tell apart literal IP addresses from host names that are less ad hoc, I would welcome them.
Commits
-
libpq: Fix SNI host handling
- 37e1cce4ddf0 14.0 landed
-
libpq: Set Server Name Indication (SNI) for SSL connections
- 5c55dc8b4733 14.0 landed