@@ -73,7 +73,7 @@ sub test_connect_fails
73
73
74
74
# ### Part 0. Set up the server.
75
75
76
- diag " setting up data directory... " ;
76
+ note " setting up data directory" ;
77
77
my $node = get_new_node(' master' );
78
78
$node -> init;
79
79
@@ -91,36 +91,36 @@ sub test_connect_fails
91
91
# ## on sslmode and whether the server's certificate looks correct. No
92
92
# ## client certificate is used in these tests.
93
93
94
- diag " running client tests... " ;
94
+ note " running client tests" ;
95
95
96
96
$common_connstr =
97
97
" user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test" ;
98
98
99
99
# The server should not accept non-SSL connections
100
- diag " test that the server doesn't accept non-SSL connections" ;
100
+ note " test that the server doesn't accept non-SSL connections" ;
101
101
test_connect_fails(" sslmode=disable" );
102
102
103
103
# Try without a root cert. In sslmode=require, this should work. In verify-ca
104
104
# or verify-full mode it should fail
105
- diag " connect without server root cert" ;
105
+ note " connect without server root cert" ;
106
106
test_connect_ok(" sslrootcert=invalid sslmode=require" );
107
107
test_connect_fails(" sslrootcert=invalid sslmode=verify-ca" );
108
108
test_connect_fails(" sslrootcert=invalid sslmode=verify-full" );
109
109
110
110
# Try with wrong root cert, should fail. (we're using the client CA as the
111
111
# root, but the server's key is signed by the server CA)
112
- diag " connect without wrong server root cert" ;
112
+ note " connect without wrong server root cert" ;
113
113
test_connect_fails(" sslrootcert=ssl/client_ca.crt sslmode=require" );
114
114
test_connect_fails(" sslrootcert=ssl/client_ca.crt sslmode=verify-ca" );
115
115
test_connect_fails(" sslrootcert=ssl/client_ca.crt sslmode=verify-full" );
116
116
117
117
# Try with just the server CA's cert. This fails because the root file
118
118
# must contain the whole chain up to the root CA.
119
- diag " connect with server CA cert, without root CA" ;
119
+ note " connect with server CA cert, without root CA" ;
120
120
test_connect_fails(" sslrootcert=ssl/server_ca.crt sslmode=verify-ca" );
121
121
122
122
# And finally, with the correct root cert.
123
- diag " connect with correct server CA cert file" ;
123
+ note " connect with correct server CA cert file" ;
124
124
test_connect_ok(" sslrootcert=ssl/root+server_ca.crt sslmode=require" );
125
125
test_connect_ok(" sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca" );
126
126
test_connect_ok(" sslrootcert=ssl/root+server_ca.crt sslmode=verify-full" );
@@ -130,7 +130,7 @@ sub test_connect_fails
130
130
test_connect_ok(" sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca" );
131
131
test_connect_ok(" sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca" );
132
132
133
- diag " testing sslcrl option with a non-revoked cert" ;
133
+ note " testing sslcrl option with a non-revoked cert" ;
134
134
135
135
# Invalid CRL filename is the same as no CRL, succeeds
136
136
test_connect_ok(
@@ -147,7 +147,7 @@ sub test_connect_fails
147
147
148
148
# Check that connecting with verify-full fails, when the hostname doesn't
149
149
# match the hostname in the server's certificate.
150
- diag " test mismatch between hostname and server certificate" ;
150
+ note " test mismatch between hostname and server certificate" ;
151
151
$common_connstr =
152
152
" user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full" ;
153
153
@@ -158,7 +158,7 @@ sub test_connect_fails
158
158
# Test Subject Alternative Names.
159
159
switch_server_cert($node , ' server-multiple-alt-names' );
160
160
161
- diag " test hostname matching with X509 Subject Alternative Names" ;
161
+ note " test hostname matching with X.509 Subject Alternative Names" ;
162
162
$common_connstr =
163
163
" user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full" ;
164
164
@@ -173,7 +173,7 @@ sub test_connect_fails
173
173
# slightly different error message, that's all)
174
174
switch_server_cert($node , ' server-single-alt-name' );
175
175
176
- diag " test hostname matching with a single X509 Subject Alternative Name" ;
176
+ note " test hostname matching with a single X.509 Subject Alternative Name" ;
177
177
$common_connstr =
178
178
" user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full" ;
179
179
@@ -186,7 +186,7 @@ sub test_connect_fails
186
186
# should be ignored when the certificate has both.
187
187
switch_server_cert($node , ' server-cn-and-alt-names' );
188
188
189
- diag " test certificate with both a CN and SANs" ;
189
+ note " test certificate with both a CN and SANs" ;
190
190
$common_connstr =
191
191
" user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full" ;
192
192
@@ -204,7 +204,7 @@ sub test_connect_fails
204
204
test_connect_fails(" sslmode=verify-full host=common-name.pg-ssltest.test" );
205
205
206
206
# Test that the CRL works
207
- diag " Testing client-side CRL" ;
207
+ note " testing client-side CRL" ;
208
208
switch_server_cert($node , ' server-revoked' );
209
209
210
210
$common_connstr =
@@ -220,7 +220,7 @@ sub test_connect_fails
220
220
# ##
221
221
# ## Test certificate authorization.
222
222
223
- diag " Testing certificate authorization... " ;
223
+ note " testing certificate authorization" ;
224
224
$common_connstr =
225
225
" sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR " ;
226
226
0 commit comments