Broken SSL tests in master

From: Andreas Karlsson <andreas(at)proxel(dot)se>
To: PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>
Subject: Broken SSL tests in master
Date: 2016-11-24 21:38:23
Message-ID: ff2518d8-3609-c910-ec5d-ce6ecad8f75b@proxel.se
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

The SSL test suite (src/test/ssl) is broken in the master since commit
9a1d0af4ad2cbd419115b453d811c141b80d872b, which is Robert's refactoring
of getting the server hostname for GSS, SSPI, and SSL in libpq.

The error we get in the test suite:

# Running: psql -X -A -t -c SELECT 'connected with user=ssltestuser
dbname=trustdb sslcert=invalid hostaddr=127.0.0.1
host=common-name.pg-ssltest.test sslrootcert=ssl/root+server_ca.crt
sslmode=verify-full' -d user=ssltestuser dbname=trustdb sslcert=invalid
hostaddr=127.0.0.1 host=common-name.pg-ssltest.test
sslrootcert=ssl/root+server_ca.crt sslmode=verify-full
psql: server certificate for "common-name.pg-ssltest.test" does not
match host name "127.0.0.1"

As you can see, after the patch libpq will now look at hostaddr rather
than host when validating the server certificate because that is what is
stored in the first (and only) entry of conn->connhost, and therefore
what PQhost() return.

To me it feels like the proper fix would be to make PQHost() return the
value of the host parameter rather than the hostaddr (maybe add a new
field in the pg_conn_host struct). But would be a behaviour change which
might break someones application. Thoughts?

Andreas

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Andreas Seltenreich 2016-11-24 21:56:14 Re: [sqlsmith] Failed assertion in parallel worker in ExecInitSubPlan
Previous Message Alvaro Herrera 2016-11-24 20:39:12 Re: pg_dump / copy bugs with "big lines" ?