#!/bin/bash
# Minimal: SNI-only pg_hosts.conf, ssl_sni on->off with a failing reload, then one TLS handshake.
BIN=/src/build/install/bin; D=/tmp/sni-mini; L=/tmp/sni-mini.log; P=5498
id pgtest >/dev/null 2>&1 || useradd -m pgtest
su pgtest -c "$BIN/pg_ctl -D $D -m immediate stop" >/dev/null 2>&1; rm -rf $D $L
su pgtest -c "$BIN/initdb -D $D -A trust --no-locale -E UTF8 >/dev/null" || exit 1
cd $D || exit 1
su pgtest -c "openssl req -new -x509 -days 30 -nodes -subj /CN=myhost -keyout myhost.key -out myhost.crt 2>/dev/null; chmod 600 myhost.key"
echo 'myhost myhost.crt myhost.key' > pg_hosts.conf          # named host only, no '*' line -> default_host == NULL
cat >> postgresql.conf <<EOC
ssl = on
ssl_sni = on
port = $P
listen_addresses = '127.0.0.1'
unix_socket_directories = '/tmp'
EOC
su pgtest -c "$BIN/pg_ctl -D $D -l $L -w start >/dev/null" || { cat $L; exit 1; }
hs() { timeout 10 openssl s_client -connect 127.0.0.1:$P -starttls postgres "$@" </dev/null 2>&1 | grep -E '^Protocol|^New,|alert|errno|unexpected eof' | head -1; }
echo "--- before reload (ssl_sni=on):     $(hs -servername myhost)"
sed -i 's/^ssl_sni = on/ssl_sni = off/' postgresql.conf         # no server.crt exists -> be_tls_init() fails on reload
su pgtest -c "$BIN/pg_ctl -D $D reload >/dev/null"
sleep 1
grep -E '"ssl_sni"|server.crt|not reloaded' $L
echo "--- after failed reload (ssl_sni=off): $(hs -servername myhost)"
sleep 1
grep -E 'signal 11|terminating any other' $L
su pgtest -c "$BIN/pg_ctl -D $D -m immediate stop" >/dev/null 2>&1
grep -q 'was terminated by signal 11' $L && { echo BUG; exit 0; }
echo OK