slachiewicz commented on PR #3818:
URL: https://github.com/apache/thrift/pull/3818#issuecomment-5584852041
Heads-up for committers: this PR fixes a regression currently breaking the
`Build` workflow on `master`.
Commit d6782a879 ("Check the server host name whatever protocol the Python
client asks for") added `match_peer_ipaddress()` in
`lib/py/src/transport/sslcompat.py`, which compares the client certificate's
`IP Address` SAN entries against the socket peer address using plain
`ipaddress.ip_address()` equality. On a dual-stack listener the peer arrives as
an IPv4-mapped IPv6 address (`::ffff:127.0.0.1`), and
`IPv6Address('::ffff:127.0.0.1') == IPv4Address('127.0.0.1')` is `False` in
Python, so the server rejects every client whose certificate carries the plain
`127.0.0.1`:
```
thrift.transport.TTransport.TTransportException: Peer address
"::ffff:127.0.0.1" is not covered by the certificate it presented
at lib/py/src/transport/sslcompat.py:112 in match_peer_ipaddress
```
Evidence from the latest `master` Build run
([34190474984](https://github.com/apache/thrift/actions/runs/34190474984)):
- master went green at 22:52 UTC Sep 7
([34168141419](https://github.com/apache/thrift/actions/runs/34168141419),
ef3ac768) and red at 22:57 UTC
([34168417880](https://github.com/apache/thrift/actions/runs/34168417880)),
exactly when d6782a879 landed
- 178 `py-*-ssl` server logs in the cross-test artifacts contain the
exception above; all non-SSL combinations pass
- every open PR based on current master (regardless of content) fails the
same two `cross-test` jobs
This PR reduces IPv4-mapped addresses to their IPv4 form on both sides
before comparing, and adds unit tests covering exactly this case. Merging it
should turn the cross-test jobs green again on master and on dependent PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
