Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

26.0.x: DPY-6006 with TCPS + SCAN listener: server cert is checked against the redirect host, not the DSN host (regression of #415)

Đang mở
  • Có gì không ổn?
#615 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
databases, python
Lĩnh vực
backend, database

Hướng nghiên cứu

Start in src/oracledb/impl/thin/connection.pyx at the redirect branch around line 284, then trace how tcp_connect_sub_op.address reaches TLS certificate validation in src/oracledb/impl/thin/crypto.pyx. Reproduce with the reported TCPS/SCAN setup and compare the original DSN host with the redirect host used for certificate checking. Done means the connection validates against the DSN host while Connection.host and port retain the connected node; verify the reported connection and pool cases.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

bug
  1. What versions are you using?

connection.version: 19.32.0.0.0
oracledb.clientversion: 26.0.1
platform.platform: Linux-6.8.0-1067-azure-x86_64-with-glibc2.34
platform.python_version: 3.11.13

  1. Is it an error or a hang or a crash?

error

  1. What error(s) or behavior you are seeing?

Connecting over TCPS through a RAC SCAN listener fails during TLS negotiation. The failure happens after the SCAN listener redirects the client to a node listener:

File "src/oracledb/impl/thin/connection.pyx", line 192, in oracledb.thin_impl.ThinConnImpl._connect
File "src/oracledb/impl/thin/connection.pyx", line 292, in _connect_phase_one
File "src/oracledb/impl/base/connection.pyx", line 443, in oracledb.base_impl.BaseConnImpl.process_sync_operation
File "src/oracledb/impl/thin/connection.pyx", line 657, in oracledb.thin_impl.ThinConnImpl._process_sync_operation_sub_op
File "src/oracledb/impl/thin/connection.pyx", line 1304, in oracledb.thin_impl.TcpConnectSubOp.process
File "src/oracledb/impl/thin/protocol.pyx", line 175, in oracledb.thin_impl.Protocol._connect_tcp
File "src/oracledb/impl/thin/transport.pyx", line 270, in oracledb.thin_impl.Transport.negotiate_tls
File "src/oracledb/impl/thin/crypto.pyx", line 114, in oracledb.thin_impl.check_server_dn
...
oracledb.exceptions.OperationalError: DPY-6005: cannot connect to database (CONNECTION_ID=...).
DPY-6006: The name on the server certificate does not match the expected value: "10.x.x.x"

The "expected value" is the IP address from the listener's redirect, not the host in the DSN. The server certificate is issued for the SCAN hostname (the DSN host), so it can never match that IP. With the same DSN and certificate, 4.0.2 connects fine.

This looks like a regression of #415, which was fixed in 3.0.0. In 4.0.2, when a redirect happens, Protocol._connect_phase_one reconnects to the redirect host/port but still passes the original address to _connect_tcp. As a result, check_server_dn validates against the DSN host.

In 26.0.x, the connect logic moved to ThinConnImpl. The redirect branch (src/oracledb/impl/thin/connection.pyx, around line 284 at v26.0.1) now overwrites the host on the address that is later passed to negotiate_tls:

temp_address = temp_params._get_addresses()[0]
db_address = db_address.copy()
db_address.host = temp_address.host # <- redirect host replaces DSN host
db_address.port = temp_address.port
tcp_connect_sub_op.host = temp_address.host
tcp_connect_sub_op.port = temp_address.port
tcp_connect_sub_op.address = db_address # <- used by check_server_dn(..., address.host)

I'm guessing the copy is there so that Connection.host/port (new in 26.0.0) report the node actually connected to. If that's right, a fix could keep that behavior and still pass the original DSN host to check_server_dn.

  1. Does your application call init_oracle_client()?

No. This is Thin mode.

  1. Include a runnable Python script that shows the problem.

No schema is needed. To reproduce, you need a RAC database whose SCAN listener uses TCPS and redirects to the node listeners by IP address. The server certificate's CN/SAN must contain the SCAN hostname and not the node IPs. ssl_server_dn_match is left at its default (True).

import oracledb

conn = oracledb.connect(
user="...",
password="...",
dsn="my-cluster-scan.example.com:2484/my_service.example.com",
protocol="tcps",
)
print(conn.version) # works on 4.0.2; DPY-6006 on 26.0.0 / 26.0.1

The same failure happens with oracledb.create_pool(...) and pool.acquire().

Ngôn ngữ chính
Python
Star
455
Fork
119
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của oracle/python-oracledb

Tất cả issue của oracle/python-oracledb

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.