Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb3a101e

Browse files
committed
Refine SSL tests test name reporting
Instead of using the psql/libpq connection string as the displayed testname and relying on "notes" and source code comments to explain thetests, give the tests self-explanatory names, like we do elsewhere.Reviewed-by: Michael Paquier <michael.paquier@gmail.com>Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
1 parent882ea50 commitb3a101e

File tree

2 files changed

+89
-68
lines changed

2 files changed

+89
-68
lines changed

‎src/test/ssl/ServerSetup.pm

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ our @EXPORT = qw(
3939
subrun_test_psql
4040
{
4141
my$connstr =$_[0];
42-
my$logstring =$_[1];
4342

4443
my$cmd = [
4544
'psql','-X','-A','-t','-c',"SELECT\$\$connected with$connstr\$\$",
@@ -49,19 +48,15 @@ sub run_test_psql
4948
return$result;
5049
}
5150

52-
#
5351
# The first argument is a base connection string to use for connection.
54-
# The second argument is a complementary connection string, and it's also
55-
# printed out as the test case name.
52+
# The second argument is a complementary connection string.
5653
subtest_connect_ok
5754
{
5855
my$common_connstr =$_[0];
5956
my$connstr =$_[1];
6057
my$test_name =$_[2];
6158

62-
my$result =
63-
run_test_psql("$common_connstr$connstr","(should succeed)");
64-
ok($result,$test_name ||$connstr);
59+
ok(run_test_psql("$common_connstr$connstr"),$test_name);
6560
}
6661

6762
subtest_connect_fails
@@ -70,8 +65,7 @@ sub test_connect_fails
7065
my$connstr =$_[1];
7166
my$test_name =$_[2];
7267

73-
my$result = run_test_psql("$common_connstr$connstr","(should fail)");
74-
ok(!$result,$test_name ||"$connstr (should fail)");
68+
ok(!run_test_psql("$common_connstr$connstr"),$test_name);
7569
}
7670

7771
# Copy a set of files, taking into account wildcards
@@ -151,9 +145,6 @@ sub switch_server_cert
151145
my$cafile =$_[2] ||"root+client_ca";
152146
my$pgdata =$node->data_dir;
153147

154-
note
155-
"reloading server with certfile\"$certfile\" and cafile\"$cafile\"";
156-
157148
openmy$sslconf,'>',"$pgdata/sslconfig.conf";
158149
print$sslconf"ssl=on\n";
159150
print$sslconf"ssl_ca_file='$cafile.crt'\n";

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 86 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -47,113 +47,134 @@
4747
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
4848

4949
# The server should not accept non-SSL connections.
50-
note"test that the server doesn't accept non-SSL connections";
51-
test_connect_fails($common_connstr,"sslmode=disable");
50+
test_connect_fails($common_connstr,"sslmode=disable",
51+
"server doesn't accept non-SSL connections");
5252

5353
# Try without a root cert. In sslmode=require, this should work. In verify-ca
5454
# or verify-full mode it should fail.
55-
note"connect without server root cert";
56-
test_connect_ok($common_connstr,"sslrootcert=invalid sslmode=require");
57-
test_connect_fails($common_connstr,"sslrootcert=invalid sslmode=verify-ca");
58-
test_connect_fails($common_connstr,"sslrootcert=invalid sslmode=verify-full");
55+
test_connect_ok($common_connstr,"sslrootcert=invalid sslmode=require",
56+
"connect without server root cert sslmode=require");
57+
test_connect_fails($common_connstr,"sslrootcert=invalid sslmode=verify-ca",
58+
"connect without server root cert sslmode=verify-ca");
59+
test_connect_fails($common_connstr,"sslrootcert=invalid sslmode=verify-full",
60+
"connect without server root cert sslmode=verify-full");
5961

6062
# Try with wrong root cert, should fail. (We're using the client CA as the
6163
# root, but the server's key is signed by the server CA.)
62-
note"connect with wrong server root cert";
6364
test_connect_fails($common_connstr,
64-
"sslrootcert=ssl/client_ca.crt sslmode=require");
65+
"sslrootcert=ssl/client_ca.crt sslmode=require",
66+
"connect with wrong server root cert sslmode=require");
6567
test_connect_fails($common_connstr,
66-
"sslrootcert=ssl/client_ca.crt sslmode=verify-ca");
68+
"sslrootcert=ssl/client_ca.crt sslmode=verify-ca",
69+
"connect with wrong server root cert sslmode=verify-ca");
6770
test_connect_fails($common_connstr,
68-
"sslrootcert=ssl/client_ca.crt sslmode=verify-full");
71+
"sslrootcert=ssl/client_ca.crt sslmode=verify-full",
72+
"connect with wrong server root cert sslmode=verify-full");
6973

7074
# Try with just the server CA's cert. This fails because the root file
7175
# must contain the whole chain up to the root CA.
72-
note"connect with server CA cert, without root CA";
7376
test_connect_fails($common_connstr,
74-
"sslrootcert=ssl/server_ca.crt sslmode=verify-ca");
77+
"sslrootcert=ssl/server_ca.crt sslmode=verify-ca",
78+
"connect with server CA cert, without root CA");
7579

7680
# And finally, with the correct root cert.
77-
note"connect with correct server CA cert file";
7881
test_connect_ok($common_connstr,
79-
"sslrootcert=ssl/root+server_ca.crt sslmode=require");
82+
"sslrootcert=ssl/root+server_ca.crt sslmode=require",
83+
"connect with correct server CA cert file sslmode=require");
8084
test_connect_ok($common_connstr,
81-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca");
85+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
86+
"connect with correct server CA cert file sslmode=verify-ca");
8287
test_connect_ok($common_connstr,
83-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full");
88+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full",
89+
"connect with correct server CA cert file sslmode=verify-full");
8490

8591
# Test with cert root file that contains two certificates. The client should
8692
# be able to pick the right one, regardless of the order in the file.
8793
test_connect_ok($common_connstr,
88-
"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca");
94+
"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca",
95+
"cert root file that contains two certificates, order 1");
8996
test_connect_ok($common_connstr,
90-
"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca");
97+
"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca",
98+
"cert root file that contains two certificates, order 2");
9199

92-
note"testing sslcrl option with a non-revoked cert";
100+
# CRL tests
93101

94102
# Invalid CRL filename is the same as no CRL, succeeds
95103
test_connect_ok($common_connstr,
96-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid");
104+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid",
105+
"sslcrl option with invalid file name");
97106

98107
# A CRL belonging to a different CA is not accepted, fails
99108
test_connect_fails($common_connstr,
100-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl");
109+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl",
110+
"CRL belonging to a different CA");
101111

102112
# With the correct CRL, succeeds (this cert is not revoked)
103113
test_connect_ok($common_connstr,
104-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl"
105-
);
114+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
115+
"CRL with a non-revoked cert");
106116

107117
# Check that connecting with verify-full fails, when the hostname doesn't
108118
# match the hostname in the server's certificate.
109-
note"test mismatch between hostname and server certificate";
110119
$common_connstr =
111-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
120+
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
121+
122+
test_connect_ok($common_connstr,"sslmode=require host=wronghost.test",
123+
"mismatch between host name and server certificate sslmode=require");
124+
test_connect_ok($common_connstr,"sslmode=verify-ca host=wronghost.test",
125+
"mismatch between host name and server certificate sslmode=verify-ca");
126+
test_connect_fails($common_connstr,"sslmode=verify-full host=wronghost.test",
127+
"mismatch between host name and server certificate sslmode=verify-full");
112128

113-
test_connect_ok($common_connstr,"sslmode=require host=wronghost.test");
114-
test_connect_ok($common_connstr,"sslmode=verify-ca host=wronghost.test");
115-
test_connect_fails($common_connstr,"sslmode=verify-full host=wronghost.test");
116129

117130
# Test Subject Alternative Names.
118131
switch_server_cert($node,'server-multiple-alt-names');
119132

120-
note"test hostname matching with X.509 Subject Alternative Names";
121133
$common_connstr =
122134
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
123135

124-
test_connect_ok($common_connstr,"host=dns1.alt-name.pg-ssltest.test");
125-
test_connect_ok($common_connstr,"host=dns2.alt-name.pg-ssltest.test");
126-
test_connect_ok($common_connstr,"host=foo.wildcard.pg-ssltest.test");
136+
test_connect_ok($common_connstr,"host=dns1.alt-name.pg-ssltest.test",
137+
"host name matching with X.509 Subject Alternative Names 1");
138+
test_connect_ok($common_connstr,"host=dns2.alt-name.pg-ssltest.test",
139+
"host name matching with X.509 Subject Alternative Names 2");
140+
test_connect_ok($common_connstr,"host=foo.wildcard.pg-ssltest.test",
141+
"host name matching with X.509 Subject Alternative Names wildcard");
127142

128-
test_connect_fails($common_connstr,"host=wronghost.alt-name.pg-ssltest.test");
143+
test_connect_fails($common_connstr,"host=wronghost.alt-name.pg-ssltest.test",
144+
"host name not matching with X.509 Subject Alternative Names");
129145
test_connect_fails($common_connstr,
130-
"host=deep.subdomain.wildcard.pg-ssltest.test");
146+
"host=deep.subdomain.wildcard.pg-ssltest.test",
147+
"host name not matching with X.509 Subject Alternative Names wildcard");
131148

132149
# Test certificate with a single Subject Alternative Name. (this gives a
133150
# slightly different error message, that's all)
134151
switch_server_cert($node,'server-single-alt-name');
135152

136-
note"test hostname matching with a single X.509 Subject Alternative Name";
137153
$common_connstr =
138154
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
139155

140-
test_connect_ok($common_connstr,"host=single.alt-name.pg-ssltest.test");
156+
test_connect_ok($common_connstr,"host=single.alt-name.pg-ssltest.test",
157+
"host name matching with a single X.509 Subject Alternative Name");
141158

142-
test_connect_fails($common_connstr,"host=wronghost.alt-name.pg-ssltest.test");
159+
test_connect_fails($common_connstr,"host=wronghost.alt-name.pg-ssltest.test",
160+
"host name not matching with a single X.509 Subject Alternative Name");
143161
test_connect_fails($common_connstr,
144-
"host=deep.subdomain.wildcard.pg-ssltest.test");
162+
"host=deep.subdomain.wildcard.pg-ssltest.test",
163+
"host name not matching with a single X.509 Subject Alternative Name wildcard");
145164

146165
# Test server certificate with a CN and SANs. Per RFCs 2818 and 6125, the CN
147166
# should be ignored when the certificate has both.
148167
switch_server_cert($node,'server-cn-and-alt-names');
149168

150-
note"test certificate with both a CN and SANs";
151169
$common_connstr =
152170
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
153171

154-
test_connect_ok($common_connstr,"host=dns1.alt-name.pg-ssltest.test");
155-
test_connect_ok($common_connstr,"host=dns2.alt-name.pg-ssltest.test");
156-
test_connect_fails($common_connstr,"host=common-name.pg-ssltest.test");
172+
test_connect_ok($common_connstr,"host=dns1.alt-name.pg-ssltest.test",
173+
"certificate with both a CN and SANs 1");
174+
test_connect_ok($common_connstr,"host=dns2.alt-name.pg-ssltest.test",
175+
"certificate with both a CN and SANs 2");
176+
test_connect_fails($common_connstr,"host=common-name.pg-ssltest.test",
177+
"certificate with both a CN and SANs ignores CN");
157178

158179
# Finally, test a server certificate that has no CN or SANs. Of course, that's
159180
# not a very sensible certificate, but libpq should handle it gracefully.
@@ -162,56 +183,65 @@
162183
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
163184

164185
test_connect_ok($common_connstr,
165-
"sslmode=verify-ca host=common-name.pg-ssltest.test");
186+
"sslmode=verify-ca host=common-name.pg-ssltest.test",
187+
"server certificate without CN or SANs sslmode=verify-ca");
166188
test_connect_fails($common_connstr,
167-
"sslmode=verify-full host=common-name.pg-ssltest.test");
189+
"sslmode=verify-full host=common-name.pg-ssltest.test",
190+
"server certificate without CN or SANs sslmode=verify-full");
168191

169192
# Test that the CRL works
170-
note"testing client-side CRL";
171193
switch_server_cert($node,'server-revoked');
172194

173195
$common_connstr =
174196
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
175197

176198
# Without the CRL, succeeds. With it, fails.
177199
test_connect_ok($common_connstr,
178-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca");
200+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
201+
"connects without client-side CRL");
179202
test_connect_fails($common_connstr,
180-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl"
181-
);
203+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
204+
"does not connect with client-side CRL");
182205

183206
### Part 2. Server-side tests.
184207
###
185208
### Test certificate authorization.
186209

187-
note"testing certificate authorization";
210+
note"running server tests";
211+
188212
$common_connstr =
189213
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
190214

191215
# no client cert
192-
test_connect_fails($common_connstr,"user=ssltestuser sslcert=invalid");
216+
test_connect_fails($common_connstr,
217+
"user=ssltestuser sslcert=invalid",
218+
"certificate authorization fails without client cert");
193219

194220
# correct client cert
195221
test_connect_ok($common_connstr,
196-
"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key");
222+
"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
223+
"certificate authorization succeeds with correct client cert");
197224

198225
# client cert belonging to another user
199226
test_connect_fails($common_connstr,
200-
"user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key");
227+
"user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
228+
"certificate authorization fails with client cert belonging to another user");
201229

202230
# revoked client cert
203231
test_connect_fails($common_connstr,
204-
"user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked.key"
205-
);
232+
"user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked.key",
233+
"certificate authorization fails with revoked client cert");
206234

207235
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
208236
switch_server_cert($node,'server-cn-only','root_ca');
209237
$common_connstr =
210238
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
211239

212240
test_connect_ok($common_connstr,
213-
"sslmode=require sslcert=ssl/client+client_ca.crt");
214-
test_connect_fails($common_connstr,"sslmode=require sslcert=ssl/client.crt");
241+
"sslmode=require sslcert=ssl/client+client_ca.crt",
242+
"intermediate client certificate is provided by client");
243+
test_connect_fails($common_connstr,"sslmode=require sslcert=ssl/client.crt",
244+
"intermediate client certificate is missing");
215245

216246
# clean up
217247
unlink"ssl/client_tmp.key";

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp