Keep current ssl_sni setting on SSL config reload failure When reloading the SSL configuration fails, the existing config is left in place to keep the server from being inaccessible. The GUC backing SNI, ssl_sni, was however changed. This could lead to new connections trying to access non-existing configurations. Fix by storing the ssl_sni setting at the time of initialization in the hosts context and only use the stored value during the handshake.
The patch submitted by the reporter has been significantly reworked and expanded. Additional test cases written by Rui Zhao. Author: Anthropic OSS program Co-authored-by: Daniel Gustafsson <[email protected]> Co-authored-by: Rui Zhao <[email protected]> Reported-by: Anthropic OSS program Reviewed-by: Zsolt Parragi <[email protected]> Reviewed-by: Jacob Champion <[email protected]> Reviewed-by: Rui Zhao <[email protected]> Discussion: https://postgr.es/m/[email protected] Backpatch-through: 19 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/72ffdffd1fcc53d6f950c35fbbe1079fbf9f15f4 Modified Files -------------- src/backend/libpq/be-secure-openssl.c | 26 +++++- src/test/ssl/t/004_sni.pl | 157 +++++++++++++++++++++++++++++++++- src/test/ssl/t/SSL/Server.pm | 4 + 3 files changed, 184 insertions(+), 3 deletions(-)
