database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Delay creation of SSL_CTX structure to allow cleanup

Browse Source 
Avoid initializing the OpenSSL SSL_CTX structure for a new host
until it has been checked for errors.  The cleanup can only see
hosts which were successfully added so the previous coding would
leak the SSL_CTX on failed reloads.

Author: Zsolt Parragi <zsolt.parragi@percona.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Rui Zhao <zhaorui126@gmail.com>
Discussion: https://postgr.es/m/A1745424-7110-41E9-B98C-3CED1A034A8F@yesql.se
Backpatch-through: 19
This commit is contained in:
Daniel Gustafsson
2026-10-06 13:27:12 +02:00
parent c7771f1ae4
commit bdf7f9b561
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/backend/libpq/be-secure-openssl.c
View File

@@ -255,9 +255,6 @@ be_tls_init(bool isServerStart)
{
HostsLine *host = lfirst(line);
if (!init_host_context(host, isServerStart))
goto error;
/*
* The hostname in the config will be set to NULL for the default
* host as well as in configs used for non-SNI connections. Lists
@@ -327,6 +324,14 @@ be_tls_init(bool isServerStart)
*/
new_hosts->sni = lappend(new_hosts->sni, host);
}
/*
* Create the SSL context only once the entry has been accepted
* and added to new_hosts, as the cleanup callback can only free
* contexts of entries it can reach from there.
*/
if (!init_host_context(host, isServerStart))
goto error;
}
}