diff options
Diffstat (limited to 'src/backend/libpq/be-secure-openssl.c')
| -rw-r--r-- | src/backend/libpq/be-secure-openssl.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index fc46a335394..60cf68aac4a 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -1336,10 +1336,14 @@ alpn_cb(SSL *ssl, if (retval == OPENSSL_NPN_NEGOTIATED) return SSL_TLSEXT_ERR_OK; - else if (retval == OPENSSL_NPN_NO_OVERLAP) - return SSL_TLSEXT_ERR_NOACK; else - return SSL_TLSEXT_ERR_NOACK; + { + /* + * The client doesn't support our protocol. Reject the connection + * with TLS "no_application_protocol" alert, per RFC 7301. + */ + return SSL_TLSEXT_ERR_ALERT_FATAL; + } } |