26.0.x: DPY-6006 with TCPS + SCAN listener: server cert is checked against the redirect host, not the DSN host (regression of #415)
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 48/100
调研方向
Start in src/oracledb/impl/thin/connection.pyx at the redirect branch around line 284, then trace how tcp_connect_sub_op.address reaches TLS certificate validation in src/oracledb/impl/thin/crypto.pyx. Reproduce with the reported TCPS/SCAN setup and compare the original DSN host with the redirect host used for certificate checking. Done means the connection validates against the DSN host while Connection.host and port retain the connected node; verify the reported connection and pool cases.
由索引模型根据 Issue 内容生成。
描述
- What versions are you using?
connection.version: 19.32.0.0.0
oracledb.clientversion: 26.0.1
platform.platform: Linux-6.8.0-1067-azure-x86_64-with-glibc2.34
platform.python_version: 3.11.13
- Is it an error or a hang or a crash?
error
- What error(s) or behavior you are seeing?
Connecting over TCPS through a RAC SCAN listener fails during TLS negotiation. The failure happens after the SCAN listener redirects the client to a node listener:
File "src/oracledb/impl/thin/connection.pyx", line 192, in oracledb.thin_impl.ThinConnImpl._connect
File "src/oracledb/impl/thin/connection.pyx", line 292, in _connect_phase_one
File "src/oracledb/impl/base/connection.pyx", line 443, in oracledb.base_impl.BaseConnImpl.process_sync_operation
File "src/oracledb/impl/thin/connection.pyx", line 657, in oracledb.thin_impl.ThinConnImpl._process_sync_operation_sub_op
File "src/oracledb/impl/thin/connection.pyx", line 1304, in oracledb.thin_impl.TcpConnectSubOp.process
File "src/oracledb/impl/thin/protocol.pyx", line 175, in oracledb.thin_impl.Protocol._connect_tcp
File "src/oracledb/impl/thin/transport.pyx", line 270, in oracledb.thin_impl.Transport.negotiate_tls
File "src/oracledb/impl/thin/crypto.pyx", line 114, in oracledb.thin_impl.check_server_dn
...
oracledb.exceptions.OperationalError: DPY-6005: cannot connect to database (CONNECTION_ID=...).
DPY-6006: The name on the server certificate does not match the expected value: "10.x.x.x"
The "expected value" is the IP address from the listener's redirect, not the host in the DSN. The server certificate is issued for the SCAN hostname (the DSN host), so it can never match that IP. With the same DSN and certificate, 4.0.2 connects fine.
This looks like a regression of #415, which was fixed in 3.0.0. In 4.0.2, when a redirect happens, Protocol._connect_phase_one reconnects to the redirect host/port but still passes the original address to _connect_tcp. As a result, check_server_dn validates against the DSN host.
In 26.0.x, the connect logic moved to ThinConnImpl. The redirect branch (src/oracledb/impl/thin/connection.pyx, around line 284 at v26.0.1) now overwrites the host on the address that is later passed to negotiate_tls:
temp_address = temp_params._get_addresses()[0]
db_address = db_address.copy()
db_address.host = temp_address.host # <- redirect host replaces DSN host
db_address.port = temp_address.port
tcp_connect_sub_op.host = temp_address.host
tcp_connect_sub_op.port = temp_address.port
tcp_connect_sub_op.address = db_address # <- used by check_server_dn(..., address.host)
I'm guessing the copy is there so that Connection.host/port (new in 26.0.0) report the node actually connected to. If that's right, a fix could keep that behavior and still pass the original DSN host to check_server_dn.
- Does your application call init_oracle_client()?
No. This is Thin mode.
- Include a runnable Python script that shows the problem.
No schema is needed. To reproduce, you need a RAC database whose SCAN listener uses TCPS and redirects to the node listeners by IP address. The server certificate's CN/SAN must contain the SCAN hostname and not the node IPs. ssl_server_dn_match is left at its default (True).
import oracledb
conn = oracledb.connect(
user="...",
password="...",
dsn="my-cluster-scan.example.com:2484/my_service.example.com",
protocol="tcps",
)
print(conn.version) # works on 4.0.2; DPY-6006 on 26.0.0 / 26.0.1
The same failure happens with oracledb.create_pool(...) and pool.acquire().
- 主要语言
- Python
- 星标
- 455
- 派生
- 119
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
oracle/python-oracledb 的其他 Issue
-
Client Library or Database
难度 4/5 3-5 天 新手友好度 25/100
oracle/python-oracledb#620 · 2 条评论 ·
-
难度 4/5 3-5 天 新手友好度 42/100
oracle/python-oracledb#619 ·
-
asyncio: DPY-4011 on connect_async() when the listener closes the original socket after a redirect可能已有人在做 @AlexGracas 于 8 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 35/100
oracle/python-oracledb#616 ·
-
Fetch character columns as raw bytes in the database character set into data frames (Thick mode)未关闭enhancement
难度 5/5 一周以上 新手友好度 35/100
oracle/python-oracledb#614 · 1 条评论 ·
-
Client Library or Database
难度 4/5 3-5 天 新手友好度 35/100
oracle/python-oracledb#613 · 3 条评论 ·
查看 oracle/python-oracledb 的全部 Issue
相似的 Issue
-
fix formatting of the sample database page of the docs可能已有人在做 @Aaqibhafeezkhan 今天认领。 未关闭documentation good first issue help wanted
难度 1/5 1 小时以内 新手友好度 72/100
chaoss/CollectOSS#544 · 1 条评论 ·
维护者通常 1 天内回复
-
area/plugin good first issue
难度 2/5 1-3 小时 新手友好度 85/100
kestra-io/plugin-soda#137 ·
-
难度 2/5 半天 新手友好度 62/100
ibm-granite/granite.build#504 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复