|
| 1 | + |
| 2 | +# Copyright (c) 2021, PostgreSQL Global Development Group |
| 3 | + |
| 4 | +use strict; |
| 5 | +use warnings; |
| 6 | +use PostgreSQL::Test::Cluster; |
| 7 | +use PostgreSQL::Test::Utils; |
| 8 | +use Test::More; |
| 9 | + |
| 10 | +use File::Copy; |
| 11 | + |
| 12 | +use FindBin; |
| 13 | +use lib$FindBin::RealBin; |
| 14 | + |
| 15 | +use SSLServer; |
| 16 | + |
| 17 | +if ($ENV{with_ssl}ne'openssl') |
| 18 | +{ |
| 19 | +planskip_all=>'OpenSSL not supported by this build'; |
| 20 | +} |
| 21 | +else |
| 22 | +{ |
| 23 | +plantests=> 13; |
| 24 | +} |
| 25 | + |
| 26 | +#### Some configuration |
| 27 | + |
| 28 | +# This is the hostname used to connect to the server. This cannot be a |
| 29 | +# hostname, because the server certificate is always for the domain |
| 30 | +# postgresql-ssl-regression.test. |
| 31 | +my$SERVERHOSTADDR ='127.0.0.1'; |
| 32 | +# This is the pattern to use in pg_hba.conf to match incoming connections. |
| 33 | +my$SERVERHOSTCIDR ='127.0.0.1/32'; |
| 34 | + |
| 35 | +# Allocation of base connection string shared among multiple tests. |
| 36 | +my$common_connstr; |
| 37 | + |
| 38 | +# The client's private key must not be world-readable, so take a copy |
| 39 | +# of the key stored in the code tree and update its permissions. |
| 40 | +my$client_tmp_key ="${PostgreSQL::Test::Utils::tmp_check}/client_ext.key"; |
| 41 | +copy("ssl/client_ext.key",$client_tmp_key) |
| 42 | +ordie"couldn't copy ssl/client_ext.key to$client_tmp_key for permissions change:$!"; |
| 43 | +chmod 0600,$client_tmp_key |
| 44 | +ordie"failed to change permissions on$client_tmp_key:$!"; |
| 45 | + |
| 46 | +#### Set up the server. |
| 47 | + |
| 48 | +note"setting up data directory"; |
| 49 | +my$node = PostgreSQL::Test::Cluster->new('primary'); |
| 50 | +$node->init; |
| 51 | + |
| 52 | +# PGHOST is enforced here to set up the node, subsequent connections |
| 53 | +# will use a dedicated connection string. |
| 54 | +$ENV{PGHOST} =$node->host; |
| 55 | +$ENV{PGPORT} =$node->port; |
| 56 | +$node->start; |
| 57 | + |
| 58 | +configure_test_server_for_ssl($node,$SERVERHOSTADDR,$SERVERHOSTCIDR, |
| 59 | +'trust',extensions=> [qw(sslinfo) ]); |
| 60 | + |
| 61 | +# We aren't using any CRL's in this suite so we can keep using server-revoked |
| 62 | +# as server certificate for simple client.crt connection much like how the |
| 63 | +# 001 test does. |
| 64 | +switch_server_cert($node,'server-revoked'); |
| 65 | + |
| 66 | +$common_connstr = |
| 67 | +"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR" . |
| 68 | +"user=ssltestuser sslcert=ssl/client_ext.crt sslkey=$client_tmp_key"; |
| 69 | + |
| 70 | +# Make sure we can connect even though previous test suites have established this |
| 71 | +$node->connect_ok( |
| 72 | +$common_connstr, |
| 73 | +"certificate authorization succeeds with correct client cert in PEM format", |
| 74 | +); |
| 75 | + |
| 76 | +my$result; |
| 77 | + |
| 78 | +$result =$node->safe_psql("certdb","SELECT ssl_is_used();", |
| 79 | +connstr=>$common_connstr); |
| 80 | +is($result,'t',"ssl_is_used() for TLS connection"); |
| 81 | + |
| 82 | +$result =$node->safe_psql("certdb","SELECT ssl_version();", |
| 83 | +connstr=>$common_connstr ." ssl_min_protocol_version=TLSv1.2" . |
| 84 | +"ssl_max_protocol_version=TLSv1.2"); |
| 85 | +is($result,'TLSv1.2',"ssl_version() correctly returning TLS protocol"); |
| 86 | + |
| 87 | +$result =$node->safe_psql("certdb", |
| 88 | +"SELECT ssl_cipher() = cipher FROM pg_stat_ssl WHERE pid = pg_backend_pid();", |
| 89 | +connstr=>$common_connstr); |
| 90 | +is($result,'t',"ssl_cipher() compared with pg_stat_ssl"); |
| 91 | + |
| 92 | +$result =$node->safe_psql("certdb","SELECT ssl_client_cert_present();", |
| 93 | +connstr=>$common_connstr); |
| 94 | +is($result,'t',"ssl_client_cert_present() for connection with cert"); |
| 95 | + |
| 96 | +$result =$node->safe_psql("trustdb","SELECT ssl_client_cert_present();", |
| 97 | +connstr=>"sslrootcert=ssl/root+server_ca.crt sslmode=require" . |
| 98 | +"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser"); |
| 99 | +is($result,'f',"ssl_client_cert_present() for connection without cert"); |
| 100 | + |
| 101 | +$result =$node->safe_psql("certdb", |
| 102 | +"SELECT ssl_client_serial() = client_serial FROM pg_stat_ssl WHERE pid = pg_backend_pid();", |
| 103 | +connstr=>$common_connstr); |
| 104 | +is($result,'t',"ssl_client_serial() compared with pg_stat_ssl"); |
| 105 | + |
| 106 | +# Must not use safe_psql since we expect an error here |
| 107 | +$result =$node->psql("certdb","SELECT ssl_client_dn_field('invalid');", |
| 108 | +connstr=>$common_connstr); |
| 109 | +is($result,'3',"ssl_client_dn_field() for an invalid field"); |
| 110 | + |
| 111 | +$result =$node->safe_psql("trustdb","SELECT ssl_client_dn_field('commonName');", |
| 112 | +connstr=>"sslrootcert=ssl/root+server_ca.crt sslmode=require" . |
| 113 | +"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser"); |
| 114 | +is($result,'',"ssl_client_dn_field() for connection without cert"); |
| 115 | + |
| 116 | +$result =$node->safe_psql("certdb", |
| 117 | +"SELECT '/CN=' || ssl_client_dn_field('commonName') = client_dn FROM pg_stat_ssl WHERE pid = pg_backend_pid();", |
| 118 | +connstr=>$common_connstr); |
| 119 | +is($result,'t',"ssl_client_dn_field() for commonName"); |
| 120 | + |
| 121 | +$result =$node->safe_psql("certdb", |
| 122 | +"SELECT ssl_issuer_dn() = issuer_dn FROM pg_stat_ssl WHERE pid = pg_backend_pid();", |
| 123 | +connstr=>$common_connstr); |
| 124 | +is($result,'t',"ssl_issuer_dn() for connection with cert"); |
| 125 | + |
| 126 | +$result =$node->safe_psql("certdb", |
| 127 | +"SELECT '/CN=' || ssl_issuer_field('commonName') = issuer_dn FROM pg_stat_ssl WHERE pid = pg_backend_pid();", |
| 128 | +connstr=>$common_connstr); |
| 129 | +is($result,'t',"ssl_issuer_field() for commonName"); |
| 130 | + |
| 131 | +$result =$node->safe_psql("certdb", |
| 132 | +"SELECT value, critical FROM ssl_extension_info() WHERE name = 'basicConstraints';", |
| 133 | +connstr=>$common_connstr); |
| 134 | +is($result,'CA:FALSE|t','extract extension from cert'); |