Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5f00ef0

Browse files
Set SNI ClientHello extension to localhost in tests
The connection strings in the SSL client tests were using the hostset up from Cluster.pm which is a temporary pathname. When SNI isenabled we pass the host to OpenSSL in order to set the server nameindication ClientHello extension via SSL_set_tlsext_host_name.OpenSSL doesn't validate the hostname apart from checking the maxlength, but LibreSSL checks for RFC 5890 conformance which resultsin errors during testing as the pathname from Cluster.pm is not avalid hostname.Fix by setting the host explicitly to localhost, as that's closerto the intent of the test.Backpatch through 14 where SNI support came in.Reported-by: Nazir Bilal Yavuz <byavuz81@gmail.com>Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>Discussion:https://postgr.es/m/17391-304f81bcf724b58b@postgresql.orgBackpatch-through: 14
1 parent1a83297 commit5f00ef0

File tree

2 files changed

+6
-6
lines changed

2 files changed

+6
-6
lines changed

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,7 @@
388388
note"running server tests";
389389

390390
$common_connstr =
391-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
391+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR host=localhost";
392392

393393
# no client cert
394394
$node->connect_fails(
@@ -538,7 +538,7 @@
538538
# works, iff username matches Common Name
539539
# fails, iff username doesn't match Common Name.
540540
$common_connstr =
541-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
541+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR host=localhost";
542542

543543
$node->connect_ok(
544544
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
@@ -565,7 +565,7 @@
565565
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
566566
switch_server_cert($node,'server-cn-only','root_ca');
567567
$common_connstr =
568-
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
568+
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR host=localhost";
569569

570570
$node->connect_ok(
571571
"$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",

‎src/test/ssl/t/002_scram.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
switch_server_cert($node,'server-cn-only');
5454
$ENV{PGPASSWORD} ="pass";
5555
$common_connstr =
56-
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR";
56+
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR host=localhost";
5757

5858
# Default settings
5959
$node->connect_ok(
@@ -99,15 +99,15 @@
9999
copy("ssl/client.key",$client_tmp_key);
100100
chmod 0600,$client_tmp_key;
101101
$node->connect_fails(
102-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=certdb user=ssltestuser channel_binding=require",
102+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDRhost=localhostdbname=certdb user=ssltestuser channel_binding=require",
103103
"Cert authentication and channel_binding=require",
104104
expected_stderr=>
105105
qr/channel binding required, but server authenticated client without channel binding/
106106
);
107107

108108
# Certificate verification at the connection level should still work fine.
109109
$node->connect_ok(
110-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=verifydb user=ssltestuser",
110+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDRhost=localhostdbname=verifydb user=ssltestuser",
111111
"SCRAM with clientcert=verify-full",
112112
log_like=> [
113113
qr/connection authenticated: identity="ssltestuser" method=scram-sha-256/

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp