Jens-G opened a new pull request, #3831: URL: https://github.com/apache/thrift/pull/3831
The SSL cross tests against a Python server have failed since the Python client now verifies certificate names on Python 3.12 (`ssl.match_hostname` was removed there and had been standing in as a no-op). `TSSLServerSocket` validates a client certificate against the IP address the connection arrived from, and `test/keys/client.crt` carries no `subjectAltName`, so that check rejects it on the loopback address — every `*-ssl` case with a Python server fails (py-py, py-rb, py-rs, py-nodejs). `test/keys/client_v3.crt` already exists for exactly this case (added under THRIFT-3599 / THRIFT-3660): it carries `127.0.0.1`, `::1`, `::ffff:127.0.0.1` and `localhost`, and is signed by the same CA. This points the cross-test clients at it. `client.crt` is left unchanged so the Python unit tests (`test_sslsocket.py`, where it is `CLIENT_CERT_NO_IP`) keep exercising the rejection path. Verified by running the server-side check both bindings use against each certificate: `client.crt` is rejected and `client_v3.crt` accepted, under both `ssl.match_hostname` (< 3.12) and its `match_peer_ipaddress` replacement (>= 3.12). `client_v3` is a superset of `client.crt` (same CA, same common name, additional SANs), so servers that accepted the old certificate accept it too. --- Investigated and written with AI assistance (Claude Opus 4.8); reviewed and submitted by Jens Geyer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
