Re: [PATCH] Accept IP addresses in server certificate SANs
Jacob Champion <pchampion@vmware.com>
From: Jacob Champion <pchampion@vmware.com>
To: "horikyota.ntt@gmail.com" <horikyota.ntt@gmail.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2022-02-04T17:06:53Z
Lists: pgsql-hackers
Attachments
- v4-0001-Move-inet_net_pton-to-src-port.patch (text/x-patch) patch v4-0001
- v4-0002-libpq-allow-IP-address-SANs-in-server-certs.patch (text/x-patch) patch v4-0002
- v4-0003-squash-libpq-allow-IP-address-SANs-in-server-cert.patch (text/x-patch) patch v4-0003
On Thu, 2022-02-03 at 16:23 +0900, Kyotaro Horiguchi wrote: > At Wed, 2 Feb 2022 19:46:13 +0000, Jacob Champion <pchampion@vmware.com> wrote in > > On Mon, 2022-01-31 at 17:29 +0900, Kyotaro Horiguchi wrote: > > > +#define PGSQL_AF_INET (AF_INET + 0) > > > +#define PGSQL_AF_INET6 (AF_INET + 1) > > > + > > > > > > Now we have the same definition thrice in frontend code. Coulnd't we > > > define them in, say, libpq-fe.h or inet-fe.h (nonexistent) then > > > include it from the three files? > > > > I started down the inet-fe.h route, and then realized I didn't know > > where that should go. Does it need to be included in (or part of) > > port.h? And should it be installed as part of the logic in > > src/include/Makefile? > > I don't think it should be a part of port.h. Though I suggested > frontend-only header file by the name, isn't it enough to separate out > the definitions from utils/inet.h to common/inet-common.h then include > the inet-common.h from inet.h? That works a lot better than what I had in my head. Done that way in v4. Thanks! --Jacob
Commits
-
libpq: Allow IP address SANs in server certificates
- c1932e542863 15.0 landed
-
Add SSL tests for IP addresses in certificates
- af9e18049550 15.0 landed
-
Make JSON path numeric literals more correct
- e26114c817b6 15.0 cited