diff options
| author | Peter Eisentraut <peter@eisentraut.org> | 2021-06-08 15:37:54 +0200 |
|---|---|---|
| committer | Peter Eisentraut <peter@eisentraut.org> | 2021-06-08 16:01:05 +0200 |
| commit | 37e1cce4ddf0be362e3093cee55493aee41bc423 (patch) | |
| tree | 1a012dc0d87164fd45faf5fbd0f2f8caff6b957b | |
| parent | eab81953682d5087295afb911c93f36cb1533bd9 (diff) | |
libpq: Fix SNI host handling
Fix handling of NULL host name (possibly by using hostaddr). It
previously crashed. Also, we should look at connhost, not pghost, to
handle multi-host specifications.
Also remove an unnecessary SSL_CTX_free().
Reported-by: Jacob Champion <pchampion@vmware.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://www.postgresql.org/message-id/504c276ab6eee000bb23d571ea9b0ced4250774e.camel@vmware.com
| -rw-r--r-- | src/interfaces/libpq/fe-secure-openssl.c | 26 |
1 files changed, 15 insertions, 11 deletions
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index 00d43f3efff..67feaedc4e0 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1087,20 +1087,24 @@ initialize_SSL(PGconn *conn) * Per RFC 6066, do not set it if the host is a literal IP address (IPv4 * or IPv6). */ - if (conn->sslsni && conn->sslsni[0] && - !(strspn(conn->pghost, "0123456789.") == strlen(conn->pghost) || - strchr(conn->pghost, ':'))) + if (conn->sslsni && conn->sslsni[0]) { - if (SSL_set_tlsext_host_name(conn->ssl, conn->pghost) != 1) + const char *host = conn->connhost[conn->whichhost].host; + + if (host && host[0] && + !(strspn(host, "0123456789.") == strlen(host) || + strchr(host, ':'))) { - char *err = SSLerrmessage(ERR_get_error()); + if (SSL_set_tlsext_host_name(conn->ssl, host) != 1) + { + char *err = SSLerrmessage(ERR_get_error()); - appendPQExpBuffer(&conn->errorMessage, - libpq_gettext("could not set SSL Server Name Indication (SNI): %s\n"), - err); - SSLerrfree(err); - SSL_CTX_free(SSL_context); - return -1; + appendPQExpBuffer(&conn->errorMessage, + libpq_gettext("could not set SSL Server Name Indication (SNI): %s\n"), + err); + SSLerrfree(err); + return -1; + } } } |