Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf32be99

Browse files
committed
Fix failures in SSL tests caused by out-of-tree keys and certificates
This issue is environment-sensitive, where the SSL tests could fail invarious way by feeding on defaults provided by sslcert, sslkey,sslrootkey, sslrootcert, sslcrl and sslcrldir coming from a local setup,as of ~/.postgresql/ by default. Horiguchi-san has reported twofailures, but more advanced testing from me (aka inclusion of garbageSSL configuration in ~/.postgresql/ for all the configurationparameters) has showed dozens of failures that can be triggered in thewhole test suite.History has showed that we are not good when it comes to address suchissues, fixing them locally like indd87799, and such problems keepappearing. This commit strengthens the entire test suite to put an endto this set of problems by embedding invalid default values in all theconnection strings used in the tests. The invalid values are prefixedin each connection string, relying on the follow-up values passed in theconnection string to enforce any invalid value previously set. Notethat two tests related to CRLs are required to fail with certain pre-setconfigurations, but we can rely on enforcing an empty value insteadafter the invalid set of values.Reported-by: Kyotaro HoriguchiReviewed-by: Andrew Dunstan, Daniel Gustafsson, Kyotaro HoriguchiDiscussion:https://postgr.es/m/20220316.163658.1122740600489097632.horikyota.ntt@gmail.combackpatch-through: 10
1 parentdfefe38 commitf32be99

File tree

1 file changed

+15
-10
lines changed

1 file changed

+15
-10
lines changed

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,13 @@
131131

132132
switch_server_cert($node,'server-cn-only');
133133

134+
# Set of default settings for SSL parameters in connection string. This
135+
# makes the tests protected against any defaults the environment may have
136+
# in ~/.postgresql/.
137+
my$default_ssl_connstr ="sslkey=invalid sslcert=invalid sslrootcert=invalid sslcrl=invalid";
138+
134139
$common_connstr =
135-
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
140+
"$default_ssl_connstruser=ssltestuser dbname=trustdb hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
136141

137142
# The server should not accept non-SSL connections.
138143
test_connect_fails(
@@ -224,7 +229,7 @@
224229
# Check that connecting with verify-full fails, when the hostname doesn't
225230
# match the hostname in the server's certificate.
226231
$common_connstr =
227-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
232+
"$default_ssl_connstruser=ssltestuser dbname=trustdb sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
228233

229234
test_connect_ok(
230235
$common_connstr,
@@ -244,7 +249,7 @@
244249
switch_server_cert($node,'server-multiple-alt-names');
245250

246251
$common_connstr =
247-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
252+
"$default_ssl_connstruser=ssltestuser dbname=trustdb sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
248253

249254
test_connect_ok(
250255
$common_connstr,
@@ -275,7 +280,7 @@
275280
switch_server_cert($node,'server-single-alt-name');
276281

277282
$common_connstr =
278-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
283+
"$default_ssl_connstruser=ssltestuser dbname=trustdb sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
279284

280285
test_connect_ok(
281286
$common_connstr,
@@ -299,7 +304,7 @@
299304
switch_server_cert($node,'server-cn-and-alt-names');
300305

301306
$common_connstr =
302-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
307+
"$default_ssl_connstruser=ssltestuser dbname=trustdb sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
303308

304309
test_connect_ok(
305310
$common_connstr,
@@ -319,7 +324,7 @@
319324
# not a very sensible certificate, but libpq should handle it gracefully.
320325
switch_server_cert($node,'server-no-names');
321326
$common_connstr =
322-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
327+
"$default_ssl_connstruser=ssltestuser dbname=trustdb sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
323328

324329
test_connect_ok(
325330
$common_connstr,
@@ -335,7 +340,7 @@
335340
switch_server_cert($node,'server-revoked');
336341

337342
$common_connstr =
338-
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
343+
"$default_ssl_connstruser=ssltestuser dbname=trustdb hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
339344

340345
# Without the CRL, succeeds. With it, fails.
341346
test_connect_ok(
@@ -390,7 +395,7 @@
390395
note"running server tests";
391396

392397
$common_connstr =
393-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
398+
"$default_ssl_connstrsslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
394399

395400
# no client cert
396401
test_connect_fails(
@@ -510,7 +515,7 @@
510515
# works, iff username matches Common Name
511516
# fails, iff username doesn't match Common Name.
512517
$common_connstr =
513-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
518+
"$default_ssl_connstrsslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
514519

515520
test_connect_ok(
516521
$common_connstr,
@@ -536,7 +541,7 @@
536541
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
537542
switch_server_cert($node,'server-cn-only','root_ca');
538543
$common_connstr =
539-
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
544+
"$default_ssl_connstruser=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
540545

541546
test_connect_ok(
542547
$common_connstr,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp