slachiewicz opened a new pull request, #3839: URL: https://github.com/apache/thrift/pull/3839
Follow-up agreed on #3818: `TSSLServerSocket` no longer matches a client certificate against the address the connection arrived from unless the caller asks for it. `validate_callback` now defaults to `None`; OpenSSL still verifies the certificate against `ca_certs` when `cert_reqs` asks for one, and `validate_callback=thrift.transport.sslcompat.match_peer_ipaddress` brings the address check back. `TSSLSocket` and `sslcompat._match_hostname` are unchanged. The `_match_has_ipaddress` guard in `TSSLServerSocket.__init__` goes with the default. Both readmes carry the note for servers on Python 3.11 or earlier that relied on the check. Two choices worth a look: - `test/py/TestServer.py` opts in with `validate_callback=match_peer_ipaddress`, so the cross-test keeps exercising the address path, including the IPv4-mapped form #3818 fixes. Dropping it would leave that path with unit coverage only. - The new tests name `ssl_version=ssl.PROTOCOL_TLS_SERVER`, as `TestServer.py` already does. A `TSSLServerSocket` built without `ssl_version` gets the class default `PROTOCOL_TLS_CLIENT`, whose context requires a `server_hostname`, and `accept()` fails with `ValueError: check_hostname requires server_hostname`. That is unchanged by this PR and may be why `TSSLSocketTest` is skipped; a separate ticket if you agree. Verified: `python test/test_sslsocket.py` → 20 tests, 3 new, OK with the 12 skips as before; with the library change stashed, `test_client_cert_without_address_accepted_by_default` fails. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
