Re: [PATCH] Accept IP addresses in server certificate SANs

Andres Freund <andres@anarazel.de>

From: Andres Freund <andres@anarazel.de>
To: Jacob Champion <pchampion@vmware.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2022-01-02T21:29:29Z
Lists: pgsql-hackers
Hi,

On 2021-12-16 01:13:57 +0000, Jacob Champion wrote:
> Attached is a patch for libpq to support IP addresses in the server's
> Subject Alternative Names, which would allow admins to issue certs for
> multiple IP addresses, both IPv4 and IPv6, and mix them with
> alternative DNS hostnames. These addresses are compared bytewise
> instead of stringwise, so the client can contact the server via
> alternative spellings of the same IP address.

This fails to build on windows:
https://cirrus-ci.com/task/6734650927218688?logs=build#L1029

[14:33:28.277] network.obj : error LNK2019: unresolved external symbol pg_inet_net_pton referenced in function network_in [c:\cirrus\postgres.vcxproj]

Greetings,

Andres Freund



Commits

  1. libpq: Allow IP address SANs in server certificates

  2. Add SSL tests for IP addresses in certificates

  3. Make JSON path numeric literals more correct