Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5c55dc8

Browse files
committed
libpq: Set Server Name Indication (SNI) for SSL connections
By default, have libpq set the TLS extension "Server Name Indication" (SNI).This allows an SNI-aware SSL proxy to route connections. (Thisrequires a proxy that is aware of the PostgreSQL protocol, not justany SSL proxy.)In the future, this could also allow the server to use different SSLcertificates for different host specifications. (That would requirenew server functionality. This would be the client-side functionalityfor that.)Since SNI makes the host name appear in cleartext in the networktraffic, this might be undesirable in some cases. Therefore, also adda libpq connection option "sslsni" to turn it off.Discussion:https://www.postgresql.org/message-id/flat/7289d5eb-62a5-a732-c3b9-438cee2cb709%40enterprisedb.com
1 parentc196842 commit5c55dc8

File tree

5 files changed

+61
-1
lines changed

5 files changed

+61
-1
lines changed

‎contrib/postgres_fdw/expected/postgres_fdw.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8917,7 +8917,7 @@ DO $d$
89178917
END;
89188918
$d$;
89198919
ERROR: invalid option "password"
8920-
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size, async_capable, keep_connections
8920+
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir,sslsni,requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size, async_capable, keep_connections
89218921
CONTEXT: SQL statement "ALTER SERVER loopback_nopw OPTIONS (ADD password 'dummypw')"
89228922
PL/pgSQL function inline_code_block line 3 at EXECUTE
89238923
-- If we add a password for our user mapping instead, we should get a different

‎doc/src/sgml/libpq.sgml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1777,6 +1777,27 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
17771777
</listitem>
17781778
</varlistentry>
17791779

1780+
<varlistentry id="libpq-connect-sslsni" xreflabel="sslsni">
1781+
<term><literal>sslsni</literal><indexterm><primary>Server Name Indication</primary></indexterm></term>
1782+
<listitem>
1783+
<para>
1784+
By default, libpq sets the TLS extension <quote>Server Name
1785+
Indication</quote> (SNI) on SSL-enabled connections. See <ulink
1786+
url="https://tools.ietf.org/html/rfc6066#section-3">RFC 6066</ulink>
1787+
for details. By setting this parameter to 0, this is turned off.
1788+
</para>
1789+
1790+
<para>
1791+
The Server Name Indication can be used by SSL-aware proxies to route
1792+
connections without having to decrypt the SSL stream. (Note that this
1793+
requires a proxy that is aware of the PostgreSQL protocol handshake,
1794+
not just any SSL proxy.) However, SNI makes the destination host name
1795+
appear in cleartext in the network traffic, so it might be undesirable
1796+
in some cases.
1797+
</para>
1798+
</listitem>
1799+
</varlistentry>
1800+
17801801
<varlistentry id="libpq-connect-requirepeer" xreflabel="requirepeer">
17811802
<term><literal>requirepeer</literal></term>
17821803
<listitem>
@@ -7797,6 +7818,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
77977818
</para>
77987819
</listitem>
77997820

7821+
<listitem>
7822+
<para>
7823+
<indexterm>
7824+
<primary><envar>PGSSLSNI</envar></primary>
7825+
</indexterm>
7826+
<envar>PGSSLSNI</envar> behaves the same as the <xref
7827+
linkend="libpq-connect-sslsni"/> connection parameter.
7828+
</para>
7829+
</listitem>
7830+
78007831
<listitem>
78017832
<para>
78027833
<indexterm>

‎src/interfaces/libpq/fe-connect.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
303303
"SSL-Revocation-List-Dir","",64,
304304
offsetof(structpg_conn,sslcrldir)},
305305

306+
{"sslsni","PGSSLSNI","1",NULL,
307+
"SSL-SNI","",1,
308+
offsetof(structpg_conn,sslsni)},
309+
306310
{"requirepeer","PGREQUIREPEER",NULL,NULL,
307311
"Require-Peer","",10,
308312
offsetof(structpg_conn,requirepeer)},
@@ -4095,6 +4099,8 @@ freePGconn(PGconn *conn)
40954099
free(conn->sslcrldir);
40964100
if (conn->sslcompression)
40974101
free(conn->sslcompression);
4102+
if (conn->sslsni)
4103+
free(conn->sslsni);
40984104
if (conn->requirepeer)
40994105
free(conn->requirepeer);
41004106
if (conn->ssl_min_protocol_version)

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1082,6 +1082,28 @@ initialize_SSL(PGconn *conn)
10821082
SSL_CTX_free(SSL_context);
10831083
SSL_context=NULL;
10841084

1085+
/*
1086+
* Set Server Name Indication (SNI), if enabled by connection parameters.
1087+
* Per RFC 6066, do not set it if the host is a literal IP address (IPv4
1088+
* or IPv6).
1089+
*/
1090+
if (conn->sslsni&&conn->sslsni[0]&&
1091+
!(strspn(conn->pghost,"0123456789.")==strlen(conn->pghost)||
1092+
strchr(conn->pghost,':')))
1093+
{
1094+
if (SSL_set_tlsext_host_name(conn->ssl,conn->pghost)!=1)
1095+
{
1096+
char*err=SSLerrmessage(ERR_get_error());
1097+
1098+
appendPQExpBuffer(&conn->errorMessage,
1099+
libpq_gettext("could not set SSL Server Name Indication (SNI): %s\n"),
1100+
err);
1101+
SSLerrfree(err);
1102+
SSL_CTX_free(SSL_context);
1103+
return-1;
1104+
}
1105+
}
1106+
10851107
/*
10861108
* Read the SSL key. If a key is specified, treat it as an engine:key
10871109
* combination if there is colon present - we don't support files with

‎src/interfaces/libpq/libpq-int.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,7 @@ struct pg_conn
383383
char*sslrootcert;/* root certificate filename */
384384
char*sslcrl;/* certificate revocation list filename */
385385
char*sslcrldir;/* certificate revocation list directory name */
386+
char*sslsni;/* use SSL SNI extension (0 or 1) */
386387
char*requirepeer;/* required peer credentials for local sockets */
387388
char*gssencmode;/* GSS mode (require,prefer,disable) */
388389
char*krbsrvname;/* Kerberos service name */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp