Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1lorLu-00069i-AS
	for pgsql-hackers@arkaria.postgresql.org; Thu, 03 Jun 2021 17:41:54 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1lorLt-0001zf-1a
	for pgsql-hackers@arkaria.postgresql.org; Thu, 03 Jun 2021 17:41:53 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1lorLs-0001zX-QG
	for pgsql-hackers@lists.postgresql.org; Thu, 03 Jun 2021 17:41:52 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1lorLq-0006Fc-TF
	for pgsql-hackers@postgresql.org; Thu, 03 Jun 2021 17:41:52 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 153HfmCm014369;
	Thu, 3 Jun 2021 13:41:48 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
cc: "peter.eisentraut@enterprisedb.com" <peter.eisentraut@enterprisedb.com>,
        "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
In-reply-to: <504c276ab6eee000bb23d571ea9b0ced4250774e.camel@vmware.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
 <ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
 <9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
 <ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com>
 <4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
 <4bf3ae1c-b28e-8960-e89f-c390c5cf01a2@enterprisedb.com>
 <504c276ab6eee000bb23d571ea9b0ced4250774e.camel@vmware.com>
Comments: In-reply-to Jacob Champion <pchampion@vmware.com>
	message dated "Thu, 03 Jun 2021 17:25:24 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <14367.1622742108.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 03 Jun 2021 13:41:48 -0400
Message-ID: <14368.1622742108@sss.pgh.pa.us>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/14368.1622742108%40sss.pgh.pa.us>
Precedence: bulk

Jacob Champion <pchampion@vmware.com> writes:
> It looks like this code needs some guards for a NULL conn->pghost. For e=
xample when running
>     psql 'dbname=3Dpostgres sslmode=3Drequire hostaddr=3D127.0.0.1'
> with no PGHOST in the environment, psql is currently segfaulting for
> me.

Duplicated here:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f3adec47ec3 in __strspn_sse42 () from /lib64/libc.so.6
(gdb) bt
#0  0x00007f3adec47ec3 in __strspn_sse42 () from /lib64/libc.so.6
#1  0x00007f3adf6b7026 in initialize_SSL (conn=3D0xed4160)
    at fe-secure-openssl.c:1090
#2  0x00007f3adf6b8755 in pgtls_open_client (conn=3Dconn@entry=3D0xed4160)
    at fe-secure-openssl.c:132
#3  0x00007f3adf6b3955 in pqsecure_open_client (conn=3Dconn@entry=3D0xed41=
60)
    at fe-secure.c:180
#4  0x00007f3adf6a4808 in PQconnectPoll (conn=3Dconn@entry=3D0xed4160)
    at fe-connect.c:3102
#5  0x00007f3adf6a5b31 in connectDBComplete (conn=3Dconn@entry=3D0xed4160)
    at fe-connect.c:2219
#6  0x00007f3adf6a8968 in PQconnectdbParams (keywords=3Dkeywords@entry=3D0=
xed40c0, =

    values=3Dvalues@entry=3D0xed4110, expand_dbname=3Dexpand_dbname@entry=3D=
1)
    at fe-connect.c:669
#7  0x0000000000404db2 in main (argc=3D<optimized out>, argv=3D0x7ffc58477=
208)
    at startup.c:266

You don't seem to need the "sslmode=3Drequire" either, just an
SSL-enabled server.

			regards, tom lane