From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Thomas Munro <thomas.munro@gmail.com>, Andres Freund <andres@anarazel.de>,
        byavuz81@gmail.com,
        PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>,
        Heikki Linnakangas <heikki.linnakangas@iki.fi>,
        Michael Paquier <michael@paquier.xyz>
Subject: Re: BUG #17391: While using --with-ssl=openssl and
 PG_TEST_EXTRA='ssl' options, SSL tests fail on OpenBSD 7.0
In-reply-to: <621771.1644098845@sss.pgh.pa.us>
References: <17391-304f81bcf724b58b@postgresql.org>
 <20220202213900.h7paogmcge2rtls6@alap3.anarazel.de>
 <CA+hUKGJ4+Ug16QU-PYGEZwUe2O69hdnCuyzLhMHHF02_uA4C5w@mail.gmail.com>
 <131329.1643851912@sss.pgh.pa.us> <203742.1643866877@sss.pgh.pa.us>
 <C44CE9FB-B37E-47D3-924B-4AF808AE98B1@yesql.se>
 <887CBA28-0942-4084-BE09-FBE0D6A1DB53@yesql.se>
 <621771.1644098845@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 05 Feb 2022 17:07:25 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <635759.1644108785.1@sss.pgh.pa.us>
Date: Sat, 05 Feb 2022 19:53:05 -0500
Message-ID: <635760.1644108785@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/635760.1644108785%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> I don't have any theory about why "host=localhost" helps.

Hah: now I do.  The initial connection string set up by
Cluster.pm is something like

Connection string: port=65130 host=/tmp/ShNzQo5mRv

and we happily pass that bogus host name to SSL_set_tlsext_host_name.
Apparently, openssl takes such a bogus setting in stride, but libressl
not so much.  It's not entirely clear to me why this doesn't cause
*every* connection attempt to fail, but at any rate Daniel's hack
causes this to be overridden with "localhost", keeping
SSL_set_tlsext_host_name happy.  You can get the same results by
setting host='' instead (preventing SSL_set_tlsext_host_name
from being called at all).  I'd backed into this by diking out
the SSL_set_tlsext_host_name call altogether and finding that
that also makes the tests pass (after groveling through the libpq
source code and finding that that's basically the only way we
could be exposing the host setting to libressl).

I'd recommend using host='' in the tests, as that more or less
replicates what the test author probably expected to happen.

The seeming timing problem with the two CRL tests remains.

			regards, tom lane