Re: [PATCH] Accept IP addresses in server certificate SANs

Jacob Champion <pchampion@vmware.com>

From: Jacob Champion <pchampion@vmware.com>

To: "daniel@yesql.se" <daniel@yesql.se>, "tgl@sss.pgh.pa.us" <tgl@sss.pgh.pa.us>

Cc: "stark@mit.edu" <stark@mit.edu>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>, "horikyota.ntt@gmail.com" <horikyota.ntt@gmail.com>

Date: 2022-03-28T20:21:17Z

Lists: pgsql-hackers

Attachments

v11-0001-Move-inet_net_pton-to-src-port.patch (text/x-patch) patch v11-0001
v11-0002-libpq-allow-IP-address-SANs-in-server-certs.patch (text/x-patch) patch v11-0002
v11-0003-squash-libpq-allow-IP-address-SANs-in-server-cer.patch (text/x-patch) patch v11-0003

On Mon, 2022-03-28 at 11:17 +0200, Daniel Gustafsson wrote:
> Fixing up the switch_server_cert() calls and using default_ssl_connstr makes
> the test pass for me.  The required fixes are in the supplied 0004 diff, I kept
> them separate to allow the original author to incorporate them without having
> to dig them out to see what changed (named to match the git format-patch output
> since I think the CFBot just applies the patches in alphabetical order).

Thanks! Those changes look good to me; I've folded them into v11. This
is rebased on a newer HEAD so it should fix the apply failures that
Greg pointed out.

--Jacob

Commits

libpq: Allow IP address SANs in server certificates
- c1932e542863 15.0 landed
Add SSL tests for IP addresses in certificates
- af9e18049550 15.0 landed
Make JSON path numeric literals more correct
- e26114c817b6 15.0 cited