Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita12c75a

Browse files
committed
Fix SSL test for libpq connection parameter channel_binding
When compiling Postgres with OpenSSL 1.0.1 or older versions, SCRAM'schannel binding cannot be supported as X509_get_signature_nid() isneeded, which causes a regression test with channel_binding='require' tofail as the server cannot publish SCRAM-SHA-256-PLUS as SASL mechanismover an SSL connection.Fix the issue by using a method similar toc3d41cc, making the testresult conditional. The test passes if X509_get_signature_nid() ispresent, and when missing we test for a connection failure. Testing aconnection failure is more useful than skipping the test as we shouldfail the connection if channel binding is required by the client but theserver does not support it.Reported-by: Tom Lane, Michael PaquierAuthor: Michael PaquierDiscussion:https://postgr.es/m/20190927024457.GA8485@paquier.xyzDiscussion:https://postgr.es/m/24857.1569775891@sss.pgh.pa.us
1 parent7acf8a8 commita12c75a

File tree

1 file changed

+21
-6
lines changed

1 file changed

+21
-6
lines changed

‎src/test/ssl/t/002_scram.pl

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,15 @@
1818
planskip_all=>'SSL not supported by this build';
1919
}
2020

21-
my$number_of_tests = 9;
22-
2321
# This is the hostname used to connect to the server.
2422
my$SERVERHOSTADDR ='127.0.0.1';
2523

24+
# Determine whether build supports tls-server-end-point.
25+
my$supports_tls_server_end_point =
26+
check_pg_config("#define HAVE_X509_GET_SIGNATURE_NID 1");
27+
28+
my$number_of_tests =$supports_tls_server_end_point ? 9 : 10;
29+
2630
# Allocation of base connection string shared among multiple tests.
2731
my$common_connstr;
2832

@@ -60,10 +64,21 @@
6064
$common_connstr,
6165
"user=ssltestuser channel_binding=disable",
6266
"SCRAM with SSL and channel_binding=disable");
63-
test_connect_ok(
64-
$common_connstr,
65-
"user=ssltestuser channel_binding=require",
66-
"SCRAM with SSL and channel_binding=require");
67+
if ($supports_tls_server_end_point)
68+
{
69+
test_connect_ok(
70+
$common_connstr,
71+
"user=ssltestuser channel_binding=require",
72+
"SCRAM with SSL and channel_binding=require");
73+
}
74+
else
75+
{
76+
test_connect_fails(
77+
$common_connstr,
78+
"user=ssltestuser channel_binding=require",
79+
qr/could not connect to server: channel binding is required, but server did not offer an authentication method that supports channel binding/,
80+
"SCRAM with SSL and channel_binding=require");
81+
}
6782

6883
# Now test when the user has an MD5-encrypted password; should fail
6984
test_connect_fails(

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp