slachiewicz opened a new pull request, #3818:
URL: https://github.com/apache/thrift/pull/3818
`match_peer_ipaddress` compares the peer address to the certificate's
`subjectAltName` entries without reducing IPv4-mapped IPv6 addresses. A
dual-stack listener reports an IPv4 peer as `::ffff:127.0.0.1`, a certificate
normally carries `IP Address:127.0.0.1`, and `ipaddress` treats those as
different addresses, so the peer is refused:
```
WARNING:thrift.transport.TSSLSocket:Failed to validate client certificate
address: ::ffff:127.0.0.1
File ".../thrift/transport/sslcompat.py", line 112, in match_peer_ipaddress
raise TTransportException(
TTransportException: Peer address "::ffff:127.0.0.1" is not covered by the
certificate it presented
```
They are the same address, so both sides are reduced with
`IPv6Address.ipv4_mapped` before comparing.
The test drives the matcher directly, in both directions and with two
negatives (a different IPv4 address, and `::1` against a certificate for
`127.0.0.1`).
Verified: `test_peer_address_matcher_unmaps_ipv4` raises the message quoted
above without the change and passes with it.
## Scope
This does not on its own turn the SSL cross tests green. They also fail
because `test/keys/client.crt` — which `client.p12` wraps, and which the
cross-test clients present — carries no extensions at all and therefore no
`subjectAltName`. That is deliberate: `test/keys/keygen/make-serverkey.sh:103`
signs it without `-extensions v3_req`, with `client_v3.crt` as the variant that
has them. Whether a server should match a client certificate against the
address the connection arrived from is a separate question and a separate
ticket.
The path only began running on Python 3.12 and later in 0.25.0; before that
the shim on those versions was a function returning `True`, so nothing reached
the comparison.
*This change was created with AI assistance.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
