Re: BUG #19815: 004_sni.pl fails deterministically with OpenSSL 1.1.1 (tests 75 and 86)

пт, 30 окт. 2026 г. в 12:14, PG Bug reporting form <noreply(at)postgresql(dot)org>:

> Result (5 of 5 runs identical, about 6 seconds each)
> # Failed test 'pg_hosts.conf: connect to default with sslmode=require:
> matches'
> # at t/004_sni.pl line 333.
> # 'psql: error: connection to server at "127.0.0.1",
> port 22348 failed: SSL SYSCALL error: EOF detected'
> # doesn't match '(?^:handshake failure)'
> # Failed test 'pg_hosts.conf: connect to default after failed reload
> with ssl_sni off: matches'
> # at t/004_sni.pl line 394.
> (same message)
> # Looks like you failed 2 tests of 129.
>
>
>
Hi, Ben!

Thanks for the report.

OpenSSL 1.1.1 has no mapping for missing_extension and returns -1 [1].
ssl3_send_alert() writes nothing [2], the socket closes and libpq reports
"SSL SYSCALL error: EOF detected". The attached patch requests
SSL_AD_HANDSHAKE_FAILURE instead. OpenSSL 1.1.1 sends that alert [3].
OpenSSL 3 already produces alert SSL_AD_HANDSHAKE_FAILURE for both values,
so the client text stays the same [4].

[1]
https://github.com/openssl/openssl/blob/OpenSSL_1_1_1k/ssl/t1_enc.c#L606-L677
[2]
https://github.com/openssl/openssl/blob/OpenSSL_1_1_1k/ssl/s3_msg.c#L49-L50
[3]
https://github.com/openssl/openssl/blob/OpenSSL_1_1_1k/ssl/t1_enc.c#L621-L622
[4]
https://github.com/openssl/openssl/blob/openssl-3.0.7/ssl/t1_enc.c#L798-L799

https://github.com/openssl/openssl/blob/openssl-3.0.7/ssl/t1_enc.c#L852-L853

Thoughts?

--
Regards,
Rachitskiy Andrey