Skip to content

Commit 6d503d2

Browse files
danielgustafssondanielgustafsson
committed
Set SNI ClientHello extension to localhost in tests
The connection strings in the SSL client tests were using the host set up from Cluster.pm which is a temporary pathname. When SNI is enabled we pass the host to OpenSSL in order to set the server name indication ClientHello extension via SSL_set_tlsext_host_name. OpenSSL doesn't validate the hostname apart from checking the max length, but LibreSSL checks for RFC 5890 conformance which results in errors during testing as the pathname from Cluster.pm is not a valid hostname. Fix by setting the host explicitly to localhost, as that's closer to the intent of the test. Backpatch through 14 where SNI support came in. Reported-by: Nazir Bilal Yavuz <byavuz81@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/17391-304f81bcf724b58b@postgresql.org Backpatch-through: 14
1 parent 4c5c41b commit 6d503d2

File tree

3 files changed

+9
-9
lines changed

3 files changed

+9
-9
lines changed

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -396,7 +396,7 @@
396396
note "running server tests";
397397

398398
$common_connstr =
399-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
399+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR host=localhost";
400400

401401
# no client cert
402402
$node->connect_fails(
@@ -573,7 +573,7 @@
573573
# works, iff username matches Common Name
574574
# fails, iff username doesn't match Common Name.
575575
$common_connstr =
576-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
576+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR host=localhost";
577577

578578
$node->connect_ok(
579579
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
@@ -600,7 +600,7 @@
600600
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
601601
switch_server_cert($node, 'server-cn-only', 'root_ca');
602602
$common_connstr =
603-
"user=ssltestuser dbname=certdb sslkey=$key{'client.key'} sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
603+
"user=ssltestuser dbname=certdb sslkey=$key{'client.key'} sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR host=localhost";
604604

605605
$node->connect_ok(
606606
"$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",

‎src/test/ssl/t/002_scram.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
switch_server_cert($node, 'server-cn-only');
5454
$ENV{PGPASSWORD} = "pass";
5555
$common_connstr =
56-
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR";
56+
"dbname=trustdb sslmode=require sslcert=invalid sslrootcert=invalid hostaddr=$SERVERHOSTADDR host=localhost";
5757

5858
# Default settings
5959
$node->connect_ok(
@@ -104,15 +104,15 @@
104104
or die "failed to change permissions on $cert_tempdir/client_scram.key: $!";
105105
$client_tmp_key =~ s!\\!/!g if $PostgreSQL::Test::Utils::windows_os;
106106
$node->connect_fails(
107-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=certdb user=ssltestuser channel_binding=require",
107+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR host=localhost dbname=certdb user=ssltestuser channel_binding=require",
108108
"Cert authentication and channel_binding=require",
109109
expected_stderr =>
110110
qr/channel binding required, but server authenticated client without channel binding/
111111
);
112112

113113
# Certificate verification at the connection level should still work fine.
114114
$node->connect_ok(
115-
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR dbname=verifydb user=ssltestuser",
115+
"sslcert=ssl/client.crt sslkey=$client_tmp_key sslrootcert=invalid hostaddr=$SERVERHOSTADDR host=localhost dbname=verifydb user=ssltestuser",
116116
"SCRAM with clientcert=verify-full",
117117
log_like => [
118118
qr/connection authenticated: identity="ssltestuser" method=scram-sha-256/

‎src/test/ssl/t/003_sslinfo.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
switch_server_cert($node, 'server-revoked');
6868

6969
$common_connstr =
70-
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR " .
70+
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR host=localhost " .
7171
"user=ssltestuser sslcert=ssl/client_ext.crt sslkey=$client_tmp_key";
7272

7373
# Make sure we can connect even though previous test suites have established this
@@ -98,7 +98,7 @@
9898

9999
$result = $node->safe_psql("trustdb", "SELECT ssl_client_cert_present();",
100100
connstr => "sslrootcert=ssl/root+server_ca.crt sslmode=require " .
101-
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser");
101+
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser host=localhost");
102102
is($result, 'f', "ssl_client_cert_present() for connection without cert");
103103

104104
$result = $node->safe_psql("certdb",
@@ -113,7 +113,7 @@
113113

114114
$result = $node->safe_psql("trustdb", "SELECT ssl_client_dn_field('commonName');",
115115
connstr => "sslrootcert=ssl/root+server_ca.crt sslmode=require " .
116-
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser");
116+
"dbname=trustdb hostaddr=$SERVERHOSTADDR user=ssltestuser host=localhost");
117117
is($result, '', "ssl_client_dn_field() for connection without cert");
118118

119119
$result = $node->safe_psql("certdb",

0 commit comments

Comments
 (0)