Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6d503d2

Browse files
Set SNI ClientHello extension to localhost in tests
The connection strings in the SSL client tests were using the hostset up from Cluster.pm which is a temporary pathname. When SNI isenabled we pass the host to OpenSSL in order to set the server nameindication ClientHello extension via SSL_set_tlsext_host_name.OpenSSL doesn't validate the hostname apart from checking the maxlength, but LibreSSL checks for RFC 5890 conformance which resultsin errors during testing as the pathname from Cluster.pm is not avalid hostname.Fix by setting the host explicitly to localhost, as that's closerto the intent of the test.Backpatch through 14 where SNI support came in.Reported-by: Nazir Bilal Yavuz <byavuz81@gmail.com>Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>Discussion:https://postgr.es/m/17391-304f81bcf724b58b@postgresql.orgBackpatch-through: 14
1 parent4c5c41b commit6d503d2

File tree

3 files changed

+9
-9
lines changed

3 files changed

+9
-9
lines changed

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -396,7 +396,7 @@
396396
note"running server tests";
397397

398398
$common_connstr =
399-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
399+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR host=localhost";
400400

401401
# no client cert
402402
$node->connect_fails(
@@ -573,7 +573,7 @@
573573
# works, iff username matches Common Name
574574
# fails, iff username doesn't match Common Name.
575575
$common_connstr =
576-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
576+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR host=localhost";
577577

578578
$node->connect_ok(
579579
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
@@ -600,7 +600,7 @@
600600
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
601601
switch_server_cert($node,'server-cn-only','root_ca');
602602
$common_connstr =
603-
"user=ssltestuser dbname=certdb sslkey=$key{'client.key'} sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
603+
"user=ssltestuser dbname=certdb sslkey=$key{'client.key'} sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR host=localhost";
604604

605605
$node->connect_ok(
606606
"$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",

‎src/test/ssl/t/002_scram.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
switch_server_cert($node,'server-cn-only');
5454
$ENV{PGPASSWORD} ="pass";
5555
$common_connstr =
56-
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR";
56+
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR host=localhost";
5757

5858
# Default settings
5959
$node->connect_ok(
@@ -104,15 +104,15 @@
104104
ordie"failed to change permissions on$cert_tempdir/client_scram.key:$!";
105105
$client_tmp_key =~s!\\!/!gif$PostgreSQL::Test::Utils::windows_os;
106106
$node->connect_fails(
107-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=certdb user=ssltestuser channel_binding=require",
107+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDRhost=localhostdbname=certdb user=ssltestuser channel_binding=require",
108108
"Cert authentication and channel_binding=require",
109109
expected_stderr=>
110110
qr/channel binding required, but server authenticated client without channel binding/
111111
);
112112

113113
# Certificate verification at the connection level should still work fine.
114114
$node->connect_ok(
115-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=verifydb user=ssltestuser",
115+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDRhost=localhostdbname=verifydb user=ssltestuser",
116116
"SCRAM with clientcert=verify-full",
117117
log_like=> [
118118
qr/connection authenticated: identity="ssltestuser" method=scram-sha-256/

‎src/test/ssl/t/003_sslinfo.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
switch_server_cert($node,'server-revoked');
6868

6969
$common_connstr =
70-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR" .
70+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDRhost=localhost" .
7171
"user=ssltestuser sslcert=ssl/client_ext.crt sslkey=$client_tmp_key";
7272

7373
# Make sure we can connect even though previous test suites have established this
@@ -98,7 +98,7 @@
9898

9999
$result =$node->safe_psql("trustdb","SELECT ssl_client_cert_present();",
100100
connstr=>"sslrootcert=ssl/root+server_ca.crt sslmode=require" .
101-
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser");
101+
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser host=localhost");
102102
is($result,'f',"ssl_client_cert_present() for connection without cert");
103103

104104
$result =$node->safe_psql("certdb",
@@ -113,7 +113,7 @@
113113

114114
$result =$node->safe_psql("trustdb","SELECT ssl_client_dn_field('commonName');",
115115
connstr=>"sslrootcert=ssl/root+server_ca.crt sslmode=require" .
116-
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser");
116+
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser host=localhost");
117117
is($result,'',"ssl_client_dn_field() for connection without cert");
118118

119119
$result =$node->safe_psql("certdb",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp