Re: [PATCH] Accept IP addresses in server certificate SANs

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Tom Lane <tgl@sss.pgh.pa.us>

Cc: Jacob Champion <pchampion@vmware.com>, "horikyota.ntt@gmail.com" <horikyota.ntt@gmail.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>

Date: 2022-03-28T09:17:25Z

Lists: pgsql-hackers

Attachments

v10-0001-Move-inet_net_pton-to-src-port.patch (application/octet-stream) patch v10-0001
v10-0003-squash-libpq-allow-IP-address-SANs-in-server-cer.patch (application/octet-stream) patch v10-0003
v10-0003-squash-libpq-allow-IP-address-SANs-in-server-cer-1.patch (application/octet-stream) patch v10-0003
v10-0004-fix-tests.diff (application/octet-stream) patch v10-0004

> On 28 Mar 2022, at 00:44, Daniel Gustafsson <daniel@yesql.se> wrote:

> I'll take a look at fixing up the test in this patch tomorrow.

Fixing up the switch_server_cert() calls and using default_ssl_connstr makes
the test pass for me.  The required fixes are in the supplied 0004 diff, I kept
them separate to allow the original author to incorporate them without having
to dig them out to see what changed (named to match the git format-patch output
since I think the CFBot just applies the patches in alphabetical order).

--
Daniel Gustafsson		https://vmware.com/

Commits

libpq: Allow IP address SANs in server certificates
- c1932e542863 15.0 landed
Add SSL tests for IP addresses in certificates
- af9e18049550 15.0 landed
Make JSON path numeric literals more correct
- e26114c817b6 15.0 cited