Feedback-ID: i131946ab:Fastmail
Message-ID: <dc372104-a17d-a2de-bd6a-d9b5b3c7a829@enterprisedb.com>
Date: Mon, 20 Jun 2022 14:22:09 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.10.0
Subject: Re: BUG #17522: While using --with-ssl=openssl and
 PG_TEST_EXTRA='ssl' options, SSL test fails on OpenBSD 7.1
Content-Language: de-DE
To: Michael Paquier <michael@paquier.xyz>, byavuz81@gmail.com,
 pgsql-bugs@lists.postgresql.org
References: <17522-bfcd5c603b5f4daa@postgresql.org>
 <Yq/j3FusKULwbFve@paquier.xyz>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: <Yq/j3FusKULwbFve@paquier.xyz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/dc372104-a17d-a2de-bd6a-d9b5b3c7a829%40enterprisedb.com>
Precedence: bulk

On 20.06.22 05:05, Michael Paquier wrote:
> On Fri, Jun 17, 2022 at 12:03:16PM +0000, PG Bug reporting form wrote:
> 
> Thanks for the report.
> 
>> [11:41:29.100](0.001s) not ok 77 - IPv4 host with CIDR mask does not match:
>> matches
>> [11:41:29.100](0.000s)
>> [11:41:29.100](0.000s) #   Failed test 'IPv4 host with CIDR mask does not
>> match: matches'
>> #   at t/001_ssltests.pl line 336.
>> [11:41:29.100](0.000s) #                   'psql: error: connection to
>> server at "127.0.0.1", port 60779 failed: could not set SSL Server Name
>> Indication (SNI): ssl3 ext invalid servername'
>> #     doesn't match '(?^:server\ certificate\ for\ \"192\.0\.2\.1\"\ \(and\
>> 1\ other\ name\)\ does\ not\ match\ host\ name\ \"192\.0\.2\.1\/32\")'
> 
> There is only one failure.  None of the buildfarm members running
> OpneBSD check the SSL tests, but this specific test has been
> introduced by c1932e5.
> 
> I am adding Peter and Jacob in CC.  This is a new open item for v15.

The test is

     $node->connect_fails(
         "$common_connstr host=192.0.2.1/32",
         "IPv4 host with CIDR mask does not match",
         expected_stderr =>
           qr/\Qserver certificate for "192.0.2.1" (and 1 other name) 
does not match host name "192.0.2.1\/32"\E/
     );

which is not using a valid host name to begin with.  What is the purpose 
of this test?