summaryrefslogtreecommitdiff
path: root/src/test/ssl/t
Commit message (Collapse)AuthorAgeFilesLines
...
* Correct several behavior descriptions in comments.Noah Misch2020-08-151-1/+0
| | | | | | | | | Reuse cautionary language from src/test/ssl/README in src/test/kerberos/README. SLRUs have had access to six-character segments names since commit 73c986adde5d73a5e2555da9b5c8facedb146dcd, and recovery stopped calling HeapTupleHeaderAdvanceLatestRemovedXid() in commit 558a9165e081d1936573e5a7d576f5febd7fb55a. The other corrections are more self-evident.
* Make new SSL TAP test for channel_binding more robustMichael Paquier2020-08-041-1/+1
| | | | | | | | | | The test would fail in an environment including a certificate file in ~/.postgresql/. bdd6e9b fixed a similar failure, and d6e612f introduced the same problem again with a new test. Author: Kyotaro Horiguchi Discussion: https://postgr.es/m/20200804.120033.31225582282178001.horikyota.ntt@gmail.com Backpatch-through: 13
* tap tests: replace 'master' with 'primary'.Andres Freund2020-07-082-2/+2
| | | | | | | | | We've largely replaced master with primary in docs etc, but tap test still widely used master. Author: Andres Freund Reviewed-By: David Steele Discussion: https://postgr.es/m/20200615182235.x7lch5n6kcjq4aue@alap3.anarazel.de
* Fix removal of files generated by TAP tests for SSLMichael Paquier2020-07-012-6/+14
| | | | | | | | | | | | | | | | | | | | | 001_ssltests.pl and 002_scram.pl both generated an extra file for a client key used in the tests that were not removed. In Debian, this causes repeated builds to fail. The code refactoring done in 4dc6355 broke the cleanup done in 001_ssltests.pl, and the new tests added in 002_scram.pl via d6e612f forgot the removal of one file. While on it, fix a second issue introduced in 002_scram.pl where we use the same file name in 001 and 002 for the temporary client key whose permissions are changed in the test, as using the same file name in both tests could cause failures with parallel jobs of src/test/ssl/ if one test removes a file still needed by the second test. Reported-by: Felix Lechner Author: Daniel Gustafsson, Felix Lechner Reviewed-by: Tom Lane, Michael Paquier Discussion: https://postgr.es/m/CAFHYt543sjX=Cm_aEeoejStyP47C+Y3+Wh6WbirLXsgUMaw7iw@mail.gmail.com Backpatch-through: 13
* Initial pgindent and pgperltidy run for v13.Tom Lane2020-05-141-17/+30
| | | | | | | | | | | Includes some manual cleanup of places that pgindent messed up, most of which weren't per project style anyway. Notably, it seems some people didn't absorb the style rules of commit c9d297751, because there were a bunch of new occurrences of function calls with a newline just after the left paren, all with faulty expectations about how the rest of the call would get indented.
* Fix capitalization of messages, per style guidePeter Eisentraut2020-05-051-2/+2
|
* Rename connection parameters to control min/max SSL protocol version in libpqMichael Paquier2020-04-301-6/+6
| | | | | | | | | | | | | | The libpq parameters ssl{max|min}protocolversion are renamed to use underscores, to become ssl_{max|min}_protocol_version. The related environment variables still use the names introduced in commit ff8ca5f that added the feature. Per complaint from Peter Eisentraut (this was also mentioned by me in the original patch review but the issue got discarded). Author: Daniel Gustafsson Reviewed-by: Peter Eisentraut, Michael Paquier Discussion: https://postgr.es/m/b319e449-318d-e691-4997-1327e166fcc4@2ndquadrant.com
* Add bound checks for ssl_min_protocol_version and ssl_max_protocol_versionMichael Paquier2020-03-231-1/+17
| | | | | | | | | | | | | | | | Mixing incorrect bounds in the SSL context leads to confusing error messages generated by OpenSSL which are hard to act on. New range checks are added when both min/max parameters are loaded in the context of a SSL reload to improve the error reporting. Note that this does not make use of the GUC hook machinery contrary to 41aadee, as there is no way to ensure a consistent range check (except if there is a way one day to define range types for GUC parameters?). Hence, this patch applies only to OpenSSL, and uses a logic similar to other parameters to trigger an error when reloading the SSL context in a session. Author: Michael Paquier Reviewed-by: Daniel Gustafsson Discussion: https://postgr.es/m/20200114035420.GE1515@paquier.xyz
* Revert "Add GUC checks for ssl_min_protocol_version and ↵Michael Paquier2020-02-071-19/+1
| | | | | | | | | | | | | ssl_max_protocol_version" This reverts commit 41aadee, as the GUC checks could run on older values with the new values used, and result in incorrect errors if both parameters are changed at the same time. Per complaint from Tom Lane. Discussion: https://postgr.es/m/27574.1581015893@sss.pgh.pa.us Backpatch-through: 12
* Add connection parameters to control SSL protocol min/max in libpqMichael Paquier2020-01-281-1/+22
| | | | | | | | | | | | | | | These two new parameters, named sslminprotocolversion and sslmaxprotocolversion, allow to respectively control the minimum and the maximum version of the SSL protocol used for the SSL connection attempt. The default setting is to allow any version for both the minimum and the maximum bounds, causing libpq to rely on the bounds set by the backend when negotiating the protocol to use for an SSL connection. The bounds are checked when the values are set at the earliest stage possible as this makes the checks independent of any SSL implementation. Author: Daniel Gustafsson Reviewed-by: Michael Paquier, Cary Huang Discussion: https://postgr.es/m/4F246AE3-A7AE-471E-BD3D-C799D3748E03@yesql.se
* Add GUC checks for ssl_min_protocol_version and ssl_max_protocol_versionMichael Paquier2020-01-181-1/+19
| | | | | | | | | | | | | | | | | Mixing incorrect bounds set in the SSL context leads to confusing error messages generated by OpenSSL which are hard to act on. New checks are added within the GUC machinery to improve the user experience as they apply to any SSL implementation, not only OpenSSL, and doing the checks beforehand avoids the creation of a SSL during a reload (or startup) which we know will never be used anyway. Backpatch down to 12, as those parameters have been introduced by e73e67c. Author: Michael Paquier Reviewed-by: Daniel Gustafsson Discussion: https://postgr.es/m/20200114035420.GE1515@paquier.xyz Backpatch-through: 12
* Clean up management of IP addresses in our SSL tests.Tom Lane2020-01-063-17/+21
| | | | | | | | | | | | | | | | | | | Instead of hard-wiring the netmask as /32, allow it to be specified where we specify the server address. This will ease changing the test to use IPv6, when/if somebody wants to do that. Also remove the hard-wired pg_hba.conf entries for IPv6 (::1/128). These have never had any usefulness, because the client side of the tests has always explicitly connected to $SERVERHOSTADDR which has always been set to IPv4 (127.0.0.1). All they accomplish is to break the test on non-IPv6-supporting hosts, and besides that they violate the express intent of the code to minimize the server's range of allowed connections. This could be back-patched, perhaps, but for now I don't see a need to. Discussion: https://postgr.es/m/1899.1578356089@sss.pgh.pa.us
* Remove support for OpenSSL 0.9.8 and 1.0.0Michael Paquier2020-01-061-4/+0
| | | | | | | | | | | | | | | | Support is out of scope from all the major vendors for these versions (for example RHEL5 uses a version based on 0.9.8, and RHEL6 uses 1.0.1), and it created some extra maintenance work. Upstream has stopped support of 0.9.8 in December 2015 and of 1.0.0 in February 2016. Since b1abfec, note that the default SSL protocol version set with ssl_min_protocol_version is TLSv1.2, whose support was added in OpenSSL 1.0.1, so there is no point to enforce ssl_min_protocol_version to TLSv1 in the SSL tests. Author: Michael Paquier Reviewed-by: Daniel Gustafsson, Tom Lane Discussion: https://postgr.es/m/20191205083252.GE5064@paquier.xyz
* Update minimum SSL versionPeter Eisentraut2019-12-041-0/+4
| | | | | | | | | | | | | | | | Change default of ssl_min_protocol_version to TLSv1.2 (from TLSv1, which means 1.0). Older versions are still supported, just not by default. TLS 1.0 is widely deprecated, and TLS 1.1 only slightly less so. All OpenSSL versions that support TLS 1.1 also support TLS 1.2, so there would be very little reason to, say, set the default to TLS 1.1 instead on grounds of better compatibility. The test suite overrides this new setting, so it can still run with older OpenSSL versions. Discussion: https://www.postgresql.org/message-id/flat/b327f8df-da98-054d-0cc5-b76a857cfed9%402ndquadrant.com
* libq support for sslpassword connection param, DER format keysAndrew Dunstan2019-11-301-9/+66
| | | | | | | | | | | | | | | This patch providies for support for password protected SSL client keys in libpq, and for DER format keys, both encrypted and unencrypted. There is a new connection parameter sslpassword, which is supplied to the OpenSSL libraries via a callback function. The callback function can also be set by an application by calling PQgetSSLKeyPassHook(). There is also a function to retreive the connection setting, PQsslpassword(). Craig Ringer and Andrew Dunstan Reviewed by: Greg Nancarrow Discussion: https://postgr.es/m/f7ee88ed-95c4-95c1-d4bf-7b415363ab62@2ndQuadrant.com
* Fix SSL test for libpq connection parameter channel_bindingMichael Paquier2019-09-301-6/+21
| | | | | | | | | | | | | | | | | | | | When compiling Postgres with OpenSSL 1.0.1 or older versions, SCRAM's channel binding cannot be supported as X509_get_signature_nid() is needed, which causes a regression test with channel_binding='require' to fail as the server cannot publish SCRAM-SHA-256-PLUS as SASL mechanism over an SSL connection. Fix the issue by using a method similar to c3d41cc, making the test result conditional. The test passes if X509_get_signature_nid() is present, and when missing we test for a connection failure. Testing a connection failure is more useful than skipping the test as we should fail the connection if channel binding is required by the client but the server does not support it. Reported-by: Tom Lane, Michael Paquier Author: Michael Paquier Discussion: https://postgr.es/m/20190927024457.GA8485@paquier.xyz Discussion: https://postgr.es/m/24857.1569775891@sss.pgh.pa.us
* Allow SSL TAP tests to run on WindowsAndrew Dunstan2019-09-291-9/+14
| | | | | | | Windows does not enforce key file permissions checks in libpq, and psql can produce CRLF line endings on Windows. Backpatch to Release 12 (CRLF) and Release 11 (permissions check)
* Add libpq parameter 'channel_binding'.Jeff Davis2019-09-232-4/+44
| | | | | | | | | Allow clients to require channel binding to enhance security against untrusted servers. Author: Jeff Davis Reviewed-by: Michael Paquier Discussion: https://postgr.es/m/227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel%40j-davis.com
* Initial pgperltidy run for v12.Tom Lane2019-05-222-27/+45
| | | | Make all the perl code look nice, too (for some value of "nice").
* Add new clientcert hba option verify-fullMagnus Hagander2019-03-092-2/+31
| | | | | | | | | | | | | This allows a login to require both that the cn of the certificate matches (like authentication type cert) *and* that another authentication method (such as password or kerberos) succeeds as well. The old value of clientcert=1 maps to the new clientcert=verify-ca, clientcert=0 maps to the new clientcert=no-verify, and the new option erify-full will add the validation of the CN. Author: Julian Markwort, Marius Timmer Reviewed by: Magnus Hagander, Thomas Munro
* Fix searchpath and module location for pg_rewind and ssl TAP testsAndrew Dunstan2019-02-073-2/+211
| | | | | | | | | | | | | | | The modules RewindTest.pm and ServerSetup.pm are really only useful for TAP tests, so they really belong in the TAP test directories. In addition, ServerSetup.pm is renamed to SSLServer.pm. The test scripts have their own directories added to the search path so that the relocated modules will be found, regardless of where the tests are run from, even on modern perl where "." is no longer in the searchpath. Discussion: https://postgr.es/m/e4b0f366-269c-73c3-9c90-d9cb0f4db1f9@2ndQuadrant.com Backpatch as appropriate to 9.5
* Add more columns to pg_stat_sslPeter Eisentraut2019-02-011-4/+4
| | | | | | | | | | Add columns client_serial and issuer_dn to pg_stat_ssl. These allow uniquely identifying the client certificate. Rename the existing column clientdn to client_dn, to make the naming more consistent and easier to read. Discussion: https://www.postgresql.org/message-id/flat/398754d8-6bb5-c5cf-e7b8-22e5f0983caf@2ndquadrant.com/
* Fix pg_stat_ssl.clientdnPeter Eisentraut2019-01-291-1/+1
| | | | | | | | Return null if there is no client certificate. This is how it has always been documented, but in reality it returned an empty string. Reviewed-by: Kyotaro HORIGUCHI <horiguchi.kyotaro@lab.ntt.co.jp> Discussion: https://www.postgresql.org/message-id/flat/398754d8-6bb5-c5cf-e7b8-22e5f0983caf@2ndquadrant.com/
* Add tests for pg_stat_ssl system viewPeter Eisentraut2019-01-291-1/+21
| | | | | Reviewed-by: Kyotaro HORIGUCHI <horiguchi.kyotaro@lab.ntt.co.jp> Discussion: https://www.postgresql.org/message-id/flat/398754d8-6bb5-c5cf-e7b8-22e5f0983caf@2ndquadrant.com/
* Make SSL tests more robustPeter Eisentraut2019-01-291-1/+1
| | | | | | | | | | | Someone running these test could have key or certificate files in their ~/.postgresql/, which would interfere with the tests. The way to override that is to specify sslcert=invalid and/or sslrootcert=invalid if no actual certificate is used for a particular test. Document that and fix up one test that had a risk of failing in these circumstances. Discussion: https://www.postgresql.org/message-id/flat/398754d8-6bb5-c5cf-e7b8-22e5f0983caf@2ndquadrant.com/
* Remove now unused check for HAVE_X509_GET_SIGNATURE_NID in test.Heikki Linnakangas2018-08-051-4/+0
| | | | | | I removed the code that used this in the previous commit. Spotted by Michael Paquier.
* Remove support for tls-unique channel binding.Heikki Linnakangas2018-08-051-31/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some problems with the tls-unique channel binding type. It's not supported by all SSL libraries, and strictly speaking it's not defined for TLS 1.3 at all, even though at least in OpenSSL, the functions used for it still seem to work with TLS 1.3 connections. And since we had no mechanism to negotiate what channel binding type to use, there would be awkward interoperability issues if a server only supported some channel binding types. tls-server-end-point seems feasible to support with any SSL library, so let's just stick to that. This removes the scram_channel_binding libpq option altogether, since there is now only one supported channel binding type. This also removes all the channel binding tests from the SSL test suite. They were really just testing the scram_channel_binding option, which is now gone. Channel binding is used if both client and server support it, so it is used in the existing tests. It would be good to have some tests specifically for channel binding, to make sure it really is used, and the different combinations of a client and a server that support or doesn't support it. The current set of settings we have make it hard to write such tests, but I did test those things manually, by disabling HAVE_BE_TLS_GET_CERTIFICATE_HASH and/or HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH. I also removed the SCRAM_CHANNEL_BINDING_TLS_END_POINT constant. This is a matter of taste, but IMO it's more readable to just use the "tls-server-end-point" string. Refactor the checks on whether the SSL library supports the functions needed for tls-server-end-point channel binding. Now the server won't advertise, and the client won't choose, the SCRAM-SHA-256-PLUS variant, if compiled with an OpenSSL version too old to support it. In the passing, add some sanity checks to check that the chosen SASL mechanism, SCRAM-SHA-256 or SCRAM-SHA-256-PLUS, matches whether the SCRAM exchange used channel binding or not. For example, if the client selects the non-channel-binding variant SCRAM-SHA-256, but in the SCRAM message uses channel binding anyway. It's harmless from a security point of view, I believe, and I'm not sure if there are some other conditions that would cause the connection to fail, but it seems better to be strict about these things and check explicitly. Discussion: https://www.postgresql.org/message-id/ec787074-2305-c6f4-86aa-6902f98485a4%40iki.fi
* Add ssl_library preset parameterPeter Eisentraut2018-07-301-1/+6
| | | | | | | This allows querying the SSL implementation used on the server side. It's analogous to using PQsslAttribute(conn, "library") in libpq. Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* perltidy: Add option --nooutdent-long-quotesPeter Eisentraut2018-04-272-24/+25
|
* Reindent Perl files with perltidy version 20170521.Tom Lane2018-04-252-149/+200
| | | | Discussion: https://postgr.es/m/CABUevEzK3cNiHZQ18f5tK0guoT+cN_jWeVzhYYxY=r+1Q3SmoA@mail.gmail.com
* Add ssl_passphrase_command settingPeter Eisentraut2018-03-171-5/+30
| | | | | | | | | | | | This allows specifying an external command for prompting for or otherwise obtaining passphrases for SSL key files. This is useful because in many cases there is no TTY easily available during service startup. Also add a setting ssl_passphrase_command_supports_reload, which allows supporting SSL configuration reload even if SSL files need passphrases. Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* Fix test counting in SSL testsPeter Eisentraut2018-03-071-5/+6
| | | | | | | The branch that does not support tls-server-end-point runs more tests, so we need to structure the test counting dynamically. Reviewed-by: Michael Paquier <michael@paquier.xyz>
* Fix expected error message in testPeter Eisentraut2018-03-061-1/+1
|
* Prevent LDAP and SSL tests from running without support in buildPeter Eisentraut2018-03-032-2/+20
| | | | | | | | | Add checks in each test file that the build supports the feature, otherwise skip all the tests. Before, if someone were to (accidentally) invoke these tests without build support, they would fail in confusing ways. based on patch from Michael Paquier <michael@paquier.xyz>
* Check error messages in SSL testsPeter Eisentraut2018-02-242-5/+42
| | | | | | | | | | | | | | In tests that check whether a connection fails, also check the error message. That makes sure that the connection was rejected for the right reason. This discovered that two tests had their connection failing for the wrong reason. One test failed because pg_hba.conf was not set up to allow that user, one test failed because the client key file did not have the right permissions. Fix those tests and add a new one that is really supposed to check the file permission issue. Reviewed-by: Michael Paquier <michael@paquier.xyz>
* Refine SSL tests test name reportingPeter Eisentraut2018-02-081-56/+86
| | | | | | | | | Instead of using the psql/libpq connection string as the displayed test name and relying on "notes" and source code comments to explain the tests, give the tests self-explanatory names, like we do elsewhere. Reviewed-by: Michael Paquier <michael.paquier@gmail.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* Fix typo and improve punctuationPeter Eisentraut2018-01-181-5/+5
|
* Fix ssl tests for when tls-server-end-point is not supportedPeter Eisentraut2018-01-091-4/+17
| | | | | | | Add a function to TestLib that allows us to check pg_config.h and then decide the expected test outcome based on that. Author: Michael Paquier <michael.paquier@gmail.com>
* Implement channel binding tls-server-end-point for SCRAMPeter Eisentraut2018-01-041-1/+4
| | | | | | | | This adds a second standard channel binding type for SCRAM. It is mainly intended for third-party clients that cannot implement tls-unique, for example JDBC. Author: Michael Paquier <michael.paquier@gmail.com>
* Add libpq connection parameter "scram_channel_binding"Peter Eisentraut2017-12-191-1/+13
| | | | | | | | | | | | | | | | | This parameter can be used to enforce the channel binding type used during a SCRAM authentication. This can be useful to check code paths where an invalid channel binding type is used by a client and will be even more useful to allow testing other channel binding types when they are added. The default value is tls-unique, which is what RFC 5802 specifies. Clients can optionally specify an empty value, which has as effect to not use channel binding and use SCRAM-SHA-256 as chosen SASL mechanism. More tests for SCRAM and channel binding are added to the SSL test suite. Author: Author: Michael Paquier <michael.paquier@gmail.com>
* Support channel binding 'tls-unique' in SCRAMPeter Eisentraut2017-11-182-1/+39
| | | | | | | | | | | | | | | | | | This is the basic feature set using OpenSSL to support the feature. In order to allow the frontend and the backend to fetch the sent and expected TLS Finished messages, a PG-like API is added to be able to make the interface pluggable for other SSL implementations. This commit also adds a infrastructure to facilitate the addition of future channel binding types as well as libpq parameters to control the SASL mechanism names and channel binding names. Those will be added by upcoming commits. Some tests are added to the SSL test suite to test SCRAM authentication with channel binding. Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
* Refactor routine to test connection to SSL serverPeter Eisentraut2017-11-161-76/+56
| | | | | | | | Move the sub-routines wrappers to check if a connection to a server is fine or not into the test main module. This is useful for other tests willing to check connectivity into a server. Author: Michael Paquier <michael@paquier.xyz>
* Remove incorrect commentMagnus Hagander2017-06-171-2/+0
| | | | Author: Michael Paquier <michael.paquier@gmail.com>
* Remove unnecessary IPC::Run inclusionPeter Eisentraut2017-06-151-13/+0
| | | | | | This is no longer needed because the tests use PostgresNode. Reported-by: Michael Paquier <michael.paquier@gmail.com>
* In SSL tests, don't scribble on permissions of a repo file.Tom Lane2017-05-151-7/+10
| | | | | | | | | | | | Modifying the permissions of a persistent file isn't really much nicer than modifying its contents, even if git doesn't currently notice it. Adjust the test script to make a copy and set the permissions of that instead. Michael Paquier, per a gripe from me. Back-patch to 9.5 where these tests were introduced. Discussion: https://postgr.es/m/14836.1494885946@sss.pgh.pa.us
* Change 'diag' to 'note' in TAP testsPeter Eisentraut2017-03-281-14/+14
| | | | | | | | Reduce noise from TAP tests by changing 'diag' to 'note', so output only goes to the test's log file not stdout, unless in verbose mode. This also removes the junk on screen when running the TAP tests in parallel. Author: Craig Ringer <craig@2ndquadrant.com>
* Don't share SSL_CTX between libpq connections.Heikki Linnakangas2016-10-071-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There were several issues with the old coding: 1. There was a race condition, if two threads opened a connection at the same time. We used a mutex around SSL_CTX_* calls, but that was not enough, e.g. if one thread SSL_CTX_load_verify_locations() with one path, and another thread set it with a different path, before the first thread got to establish the connection. 2. Opening two different connections, with different sslrootcert settings, seemed to fail outright with "SSL error: block type is not 01". Not sure why. 3. We created the SSL object, before calling SSL_CTX_load_verify_locations and SSL_CTX_use_certificate_chain_file on the SSL context. That was wrong, because the options set on the SSL context are propagated to the SSL object, when the SSL object is created. If they are set after the SSL object has already been created, they won't take effect until the next connection. (This is bug #14329) At least some of these could've been fixed while still using a shared context, but it would've been more complicated and error-prone. To keep things simple, let's just use a separate SSL context for each connection, and accept the overhead. Backpatch to all supported versions. Report, analysis and test case by Kacper Zuk. Discussion: <20160920101051.1355.79453@wrigleys.postgresql.org>
* PostgresNode: Add names to nodesAlvaro Herrera2016-01-201-1/+1
| | | | | | | | This makes the log files easier to follow when investigating a test failure. Author: Michael Paquier Review: Noah Misch
* Remove reundand include of TestLibMagnus Hagander2016-01-081-1/+0
| | | | Kyotaro HORIGUCHI
* Fix omission of -X (--no-psqlrc) in some psql invocations.Tom Lane2015-12-281-1/+1
| | | | | | | | | | | As of commit d5563d7df, psql -c no longer implies -X, but not all of our regression testing scripts had gotten that memo. To ensure consistency of results across different developers, make sure that *all* invocations of psql in all scripts in our tree use -X, even where this is not what previously happened. Michael Paquier and Tom Lane
View Lorry Controller Status