From 399ed9bc6eb50a231ca681ccbafa10aacff4ee45 Mon Sep 17 00:00:00 2001 From: Cedric Staub Date: Tue, 3 Apr 2018 21:47:37 -0700 Subject: [PATCH] Fix SNI handling, set server name for connect --- starttls/starttls.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/starttls/starttls.go b/starttls/starttls.go index 0a167b6..9c935ac 100644 --- a/starttls/starttls.go +++ b/starttls/starttls.go @@ -42,11 +42,18 @@ type connectResult struct { err error } -func tlsConfigForConnect(connectName, clientCert, clientKey string) (*tls.Config, **tls.CertificateRequestInfo, error) { +func tlsConfigForConnect(connectName, connectTo, clientCert, clientKey string) (*tls.Config, **tls.CertificateRequestInfo, error) { + var hostname string + if connectName != "" { + hostname = connectName + } else { + hostname = strings.Split(connectTo, ":")[0] + } + conf := &tls.Config{ // We verify later manually so we can print results InsecureSkipVerify: true, - ServerName: connectName, + ServerName: hostname, MinVersion: tls.VersionSSL30, } @@ -128,7 +135,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, identity, clientCe case "postgres", "psql": // No tlsConfig needed for postgres, but all others do. default: - tlsConfig, cri, err = tlsConfigForConnect(connectName, clientCert, clientKey) + tlsConfig, cri, err = tlsConfigForConnect(connectName, connectTo, clientCert, clientKey) if err != nil { return nil, nil, err }