diff options
Diffstat (limited to 'src/interfaces/libpq/fe-secure-openssl.c')
| -rw-r--r-- | src/interfaces/libpq/fe-secure-openssl.c | 26 |
1 files changed, 15 insertions, 11 deletions
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index 00d43f3efff..67feaedc4e0 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1087,20 +1087,24 @@ initialize_SSL(PGconn *conn) * Per RFC 6066, do not set it if the host is a literal IP address (IPv4 * or IPv6). */ - if (conn->sslsni && conn->sslsni[0] && - !(strspn(conn->pghost, "0123456789.") == strlen(conn->pghost) || - strchr(conn->pghost, ':'))) + if (conn->sslsni && conn->sslsni[0]) { - if (SSL_set_tlsext_host_name(conn->ssl, conn->pghost) != 1) + const char *host = conn->connhost[conn->whichhost].host; + + if (host && host[0] && + !(strspn(host, "0123456789.") == strlen(host) || + strchr(host, ':'))) { - char *err = SSLerrmessage(ERR_get_error()); + if (SSL_set_tlsext_host_name(conn->ssl, host) != 1) + { + char *err = SSLerrmessage(ERR_get_error()); - appendPQExpBuffer(&conn->errorMessage, - libpq_gettext("could not set SSL Server Name Indication (SNI): %s\n"), - err); - SSLerrfree(err); - SSL_CTX_free(SSL_context); - return -1; + appendPQExpBuffer(&conn->errorMessage, + libpq_gettext("could not set SSL Server Name Indication (SNI): %s\n"), + err); + SSLerrfree(err); + return -1; + } } } |