Keep current ssl_sni setting on SSL config reload failure When reloading the SSL configuration fails, the existing config is left in place to keep the server from being inaccessible. The GUC backing SNI, ssl_sni, was however changed. This could lead to new connections trying to access non-existing configurations. Fix by storing the ssl_sni setting at the time of initialization in the hosts context and only use the stored value during the handshake.
The patch submitted by the reporter has been significantly reworked and expanded. Additional test cases written by Rui Zhao. Author: Anthropic OSS program Co-authored-by: Daniel Gustafsson <[email protected]> Co-authored-by: Rui Zhao <[email protected]> Reported-by: Anthropic OSS program Reviewed-by: Zsolt Parragi <[email protected]> Reviewed-by: Jacob Champion <[email protected]> Reviewed-by: Rui Zhao <[email protected]> Discussion: https://postgr.es/m/[email protected] Backpatch-through: 19 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b6adefc659c70a371d860f5a90160af2c254f357 Modified Files -------------- src/backend/libpq/be-secure-openssl.c | 26 +++++- src/test/ssl/t/004_sni.pl | 157 +++++++++++++++++++++++++++++++++- src/test/ssl/t/SSL/Server.pm | 4 + 3 files changed, 184 insertions(+), 3 deletions(-)
