From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
Cc: peter.eisentraut@enterprisedb.com <peter.eisentraut@enterprisedb.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
Date: Thu, 03 Jun 2021 13:41:48 -0400
Message-ID: <14368.1622742108@sss.pgh.pa.us> (raw)
In-Reply-To: <504c276ab6eee000bb23d571ea9b0ced4250774e.camel@vmware.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
<ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
<9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
<ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com>
<4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
<4bf3ae1c-b28e-8960-e89f-c390c5cf01a2@enterprisedb.com>
<504c276ab6eee000bb23d571ea9b0ced4250774e.camel@vmware.com>
Jacob Champion <pchampion@vmware.com> writes:
> It looks like this code needs some guards for a NULL conn->pghost. For example when running
> psql 'dbname=postgres sslmode=require hostaddr=127.0.0.1'
> with no PGHOST in the environment, psql is currently segfaulting for
> me.
Duplicated here:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f3adec47ec3 in __strspn_sse42 () from /lib64/libc.so.6
(gdb) bt
#0 0x00007f3adec47ec3 in __strspn_sse42 () from /lib64/libc.so.6
#1 0x00007f3adf6b7026 in initialize_SSL (conn=0xed4160)
at fe-secure-openssl.c:1090
#2 0x00007f3adf6b8755 in pgtls_open_client (conn=conn@entry=0xed4160)
at fe-secure-openssl.c:132
#3 0x00007f3adf6b3955 in pqsecure_open_client (conn=conn@entry=0xed4160)
at fe-secure.c:180
#4 0x00007f3adf6a4808 in PQconnectPoll (conn=conn@entry=0xed4160)
at fe-connect.c:3102
#5 0x00007f3adf6a5b31 in connectDBComplete (conn=conn@entry=0xed4160)
at fe-connect.c:2219
#6 0x00007f3adf6a8968 in PQconnectdbParams (keywords=keywords@entry=0xed40c0,
values=values@entry=0xed4110, expand_dbname=expand_dbname@entry=1)
at fe-connect.c:669
#7 0x0000000000404db2 in main (argc=<optimized out>, argv=0x7ffc58477208)
at startup.c:266
You don't seem to need the "sslmode=require" either, just an
SSL-enabled server.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pchampion@vmware.com, peter.eisentraut@enterprisedb.com
Subject: Re: SSL SNI
In-Reply-To: <14368.1622742108@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox