From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Thomas Munro <thomas.munro@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: byavuz81@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Cc: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Cc: Michael Paquier <michael@paquier.xyz>
Subject: Re: BUG #17391: While using --with-ssl=openssl and PG_TEST_EXTRA='ssl' options, SSL tests fail on OpenBSD 7.0
Date: Sat, 05 Feb 2022 19:53:05 -0500
Message-ID: <635760.1644108785@sss.pgh.pa.us> (raw)
In-Reply-To: <621771.1644098845@sss.pgh.pa.us>
References: <17391-304f81bcf724b58b@postgresql.org>
<20220202213900.h7paogmcge2rtls6@alap3.anarazel.de>
<CA+hUKGJ4+Ug16QU-PYGEZwUe2O69hdnCuyzLhMHHF02_uA4C5w@mail.gmail.com>
<131329.1643851912@sss.pgh.pa.us>
<203742.1643866877@sss.pgh.pa.us>
<C44CE9FB-B37E-47D3-924B-4AF808AE98B1@yesql.se>
<887CBA28-0942-4084-BE09-FBE0D6A1DB53@yesql.se>
<621771.1644098845@sss.pgh.pa.us>
I wrote:
> I don't have any theory about why "host=localhost" helps.
Hah: now I do. The initial connection string set up by
Cluster.pm is something like
Connection string: port=65130 host=/tmp/ShNzQo5mRv
and we happily pass that bogus host name to SSL_set_tlsext_host_name.
Apparently, openssl takes such a bogus setting in stride, but libressl
not so much. It's not entirely clear to me why this doesn't cause
*every* connection attempt to fail, but at any rate Daniel's hack
causes this to be overridden with "localhost", keeping
SSL_set_tlsext_host_name happy. You can get the same results by
setting host='' instead (preventing SSL_set_tlsext_host_name
from being called at all). I'd backed into this by diking out
the SSL_set_tlsext_host_name call altogether and finding that
that also makes the tests pass (after groveling through the libpq
source code and finding that that's basically the only way we
could be exposing the host setting to libressl).
I'd recommend using host='' in the tests, as that more or less
replicates what the test author probably expected to happen.
The seeming timing problem with the two CRL tests remains.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, thomas.munro@gmail.com, andres@anarazel.de, pgsql-bugs@lists.postgresql.org, heikki.linnakangas@iki.fi, michael@paquier.xyz
Subject: Re: BUG #17391: While using --with-ssl=openssl and PG_TEST_EXTRA='ssl' options, SSL tests fail on OpenBSD 7.0
In-Reply-To: <635760.1644108785@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox