Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

26.0.x: DPY-6006 with TCPS + SCAN listener: server cert is checked against the redirect host, not the DSN host (regression of #415)

Aperta
  • Qualcosa non va?
#615 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
databases, python
Ambito
backend, database

Direzione di ricerca

Start in src/oracledb/impl/thin/connection.pyx at the redirect branch around line 284, then trace how tcp_connect_sub_op.address reaches TLS certificate validation in src/oracledb/impl/thin/crypto.pyx. Reproduce with the reported TCPS/SCAN setup and compare the original DSN host with the redirect host used for certificate checking. Done means the connection validates against the DSN host while Connection.host and port retain the connected node; verify the reported connection and pool cases.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
  1. What versions are you using?

connection.version: 19.32.0.0.0
oracledb.clientversion: 26.0.1
platform.platform: Linux-6.8.0-1067-azure-x86_64-with-glibc2.34
platform.python_version: 3.11.13

  1. Is it an error or a hang or a crash?

error

  1. What error(s) or behavior you are seeing?

Connecting over TCPS through a RAC SCAN listener fails during TLS negotiation. The failure happens after the SCAN listener redirects the client to a node listener:

File "src/oracledb/impl/thin/connection.pyx", line 192, in oracledb.thin_impl.ThinConnImpl._connect
File "src/oracledb/impl/thin/connection.pyx", line 292, in _connect_phase_one
File "src/oracledb/impl/base/connection.pyx", line 443, in oracledb.base_impl.BaseConnImpl.process_sync_operation
File "src/oracledb/impl/thin/connection.pyx", line 657, in oracledb.thin_impl.ThinConnImpl._process_sync_operation_sub_op
File "src/oracledb/impl/thin/connection.pyx", line 1304, in oracledb.thin_impl.TcpConnectSubOp.process
File "src/oracledb/impl/thin/protocol.pyx", line 175, in oracledb.thin_impl.Protocol._connect_tcp
File "src/oracledb/impl/thin/transport.pyx", line 270, in oracledb.thin_impl.Transport.negotiate_tls
File "src/oracledb/impl/thin/crypto.pyx", line 114, in oracledb.thin_impl.check_server_dn
...
oracledb.exceptions.OperationalError: DPY-6005: cannot connect to database (CONNECTION_ID=...).
DPY-6006: The name on the server certificate does not match the expected value: "10.x.x.x"

The "expected value" is the IP address from the listener's redirect, not the host in the DSN. The server certificate is issued for the SCAN hostname (the DSN host), so it can never match that IP. With the same DSN and certificate, 4.0.2 connects fine.

This looks like a regression of #415, which was fixed in 3.0.0. In 4.0.2, when a redirect happens, Protocol._connect_phase_one reconnects to the redirect host/port but still passes the original address to _connect_tcp. As a result, check_server_dn validates against the DSN host.

In 26.0.x, the connect logic moved to ThinConnImpl. The redirect branch (src/oracledb/impl/thin/connection.pyx, around line 284 at v26.0.1) now overwrites the host on the address that is later passed to negotiate_tls:

temp_address = temp_params._get_addresses()[0]
db_address = db_address.copy()
db_address.host = temp_address.host # <- redirect host replaces DSN host
db_address.port = temp_address.port
tcp_connect_sub_op.host = temp_address.host
tcp_connect_sub_op.port = temp_address.port
tcp_connect_sub_op.address = db_address # <- used by check_server_dn(..., address.host)

I'm guessing the copy is there so that Connection.host/port (new in 26.0.0) report the node actually connected to. If that's right, a fix could keep that behavior and still pass the original DSN host to check_server_dn.

  1. Does your application call init_oracle_client()?

No. This is Thin mode.

  1. Include a runnable Python script that shows the problem.

No schema is needed. To reproduce, you need a RAC database whose SCAN listener uses TCPS and redirects to the node listeners by IP address. The server certificate's CN/SAN must contain the SCAN hostname and not the node IPs. ssl_server_dn_match is left at its default (True).

import oracledb

conn = oracledb.connect(
user="...",
password="...",
dsn="my-cluster-scan.example.com:2484/my_service.example.com",
protocol="tcps",
)
print(conn.version) # works on 4.0.2; DPY-6006 on 26.0.0 / 26.0.1

The same failure happens with oracledb.create_pool(...) and pool.acquire().

Lingua principale
Python
Stelle
455
Fork
119
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di oracle/python-oracledb

Tutte le issue di oracle/python-oracledb

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.