From: Francis Dupont <fdupont@isc.org>
Date: Wed, 9 Jul 2025 13:57:32 +0000 (+0200)
Subject: [#3927] Updated pgsql ssslmode code
X-Git-Tag: Kea-3.1.0~43
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=3c8b1d4b8ca24bcfc33ec47d344e106170a74f60;p=thirdparty%2Fkea.git

[#3927] Updated pgsql ssslmode code
---

diff --git a/src/lib/pgsql/pgsql_connection.cc b/src/lib/pgsql/pgsql_connection.cc
index 7cb17dac0f..65284f12c3 100644
--- a/src/lib/pgsql/pgsql_connection.cc
+++ b/src/lib/pgsql/pgsql_connection.cc
@@ -411,9 +411,9 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
 
     bool tls = false;
 
-    string sslmode;
+    string ssslmode;
     try {
-        sslmode = getParameter("ssl-mode");
+        ssslmode = getParameter("ssl-mode");
         tls = true;
     } catch (...) {
         // No strict ssl mode
@@ -423,8 +423,8 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
     try {
         sca = getParameter("trust-anchor");
         tls = true;
-        if (sslmode.empty()) {
-            sslmode = "verify-ca";
+        if (ssslmode.empty()) {
+            ssslmode = "verify-ca";
         }
         dbconnparameters += " sslrootcert = " + sca;
     } catch (...) {
@@ -450,17 +450,15 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
     }
 
     if (tls) {
-        if (sslmode.empty()) {
-            sslmode = "require";
+        if (ssslmode.empty()) {
+            ssslmode = "require";
         }
         dbconnparameters += " gssencmode = disable";
-    } else {
-        if (sslmode.empty()) {
-            sslmode = "prefer";
-        }
     }
 
-    dbconnparameters += " sslmode = " + sslmode;
+    if (!ssslmode.empty()) {
+        dbconnparameters += " sslmode = " + ssslmode;
+    }
 
     return (dbconnparameters);
 }