Re: [PATCH] Accept IP addresses in server certificate SANs
Jacob Champion <pchampion@vmware.com>
From: Jacob Champion <pchampion@vmware.com>
To: "daniel@yesql.se" <daniel@yesql.se>, "peter.eisentraut@enterprisedb.com" <peter.eisentraut@enterprisedb.com>, "tgl@sss.pgh.pa.us" <tgl@sss.pgh.pa.us>
Cc: "stark@mit.edu" <stark@mit.edu>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>, "horikyota.ntt@gmail.com" <horikyota.ntt@gmail.com>
Date: 2022-03-31T18:15:25Z
Lists: pgsql-hackers
Attachments
- v12-0001-libpq-allow-IP-address-SANs-in-server-certs.patch (text/x-patch) patch v12-0001
On Thu, 2022-03-31 at 16:32 +0200, Peter Eisentraut wrote: > Why add a (failry complicated) pg_inet_pton() when a perfectly > reasonable inet_pton() exists? I think it was mostly just that inet_aton() and pg_inet_net_ntop() both had ports, and I figured I might as well port the other one since we already had the implementation. (I don't have a good intuition yet for the community's preference for port vs dependency.) > I would get rid of all that refactoring and just have your code call > inet_pton()/inet_ntop() directly. > > If you're worried about portability, and you don't want to go through > the effort of proving libpgport substitutes, just have your code raise > an error in the "#else" code paths. We can fill that in later if there > is demand. Switched to inet_pton() in v12, with no #if/else for now. I think this should work with Winsock as-is; let's see if the bot agrees... Thanks, --Jacob
Commits
-
libpq: Allow IP address SANs in server certificates
- c1932e542863 15.0 landed
-
Add SSL tests for IP addresses in certificates
- af9e18049550 15.0 landed
-
Make JSON path numeric literals more correct
- e26114c817b6 15.0 cited