Skip to content

Commit c113d8a

Browse files
danielgustafssondanielgustafsson
committed
Use test-specific temp path for keys during SSL test
The SSL and SCRAM TAP test suites both use temporary copies of the supplied test keys in order to ensure correct permissions. These were however copied inside the tree using temporary filenames rather than a true temporary folder. Fix by using tmp_check supplied by PostgreSQL::Test::Utils. Spotted by Tom Lane during review of the nearby sslinfo TAP test patch. Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/599244.1638041239@sss.pgh.pa.us
1 parent ae81776 commit c113d8a

File tree

3 files changed

+42
-49
lines changed

3 files changed

+42
-49
lines changed

‎src/test/ssl/ssl/.gitignore

-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
/*.old
22
/new_certs_dir/
3-
/client*_tmp.key

‎src/test/ssl/t/001_ssltests.pl

+41-44
Original file line numberDiff line numberDiff line change
@@ -39,28 +39,31 @@
3939
# The client's private key must not be world-readable, so take a copy
4040
# of the key stored in the code tree and update its permissions.
4141
#
42-
# This changes ssl/client.key to ssl/client_tmp.key etc for the rest
43-
# of the tests.
42+
# This changes to using keys stored in a temporary path for the rest of
43+
# the tests. To get the full path for inclusion in connection strings, the
44+
# %key hash can be interrogated.
45+
my %key;
4446
my @keys = (
45-
"client", "client-revoked",
46-
"client-der", "client-encrypted-pem",
47-
"client-encrypted-der", "client-dn");
48-
foreach my $key (@keys)
47+
"client.key", "client-revoked.key",
48+
"client-der.key", "client-encrypted-pem.key",
49+
"client-encrypted-der.key", "client-dn.key");
50+
foreach my $keyfile (@keys)
4951
{
50-
copy("ssl/${key}.key", "ssl/${key}_tmp.key")
52+
copy("ssl/${keyfile}", "${PostgreSQL::Test::Utils::tmp_check}/${keyfile}")
5153
or die
52-
"couldn't copy ssl/${key}.key to ssl/${key}_tmp.key for permissions change: $!";
53-
chmod 0600, "ssl/${key}_tmp.key"
54-
or die "failed to change permissions on ssl/${key}_tmp.key: $!";
54+
"couldn't copy ssl/${keyfile} to ${PostgreSQL::Test::Utils::tmp_check}/${keyfile} for permissions change: $!";
55+
chmod 0600, "${PostgreSQL::Test::Utils::tmp_check}/${keyfile}"
56+
or die "failed to change permissions on ${PostgreSQL::Test::Utils::tmp_check}/${keyfile}: $!";
57+
58+
$key{$keyfile} = "${PostgreSQL::Test::Utils::tmp_check}/$keyfile";
5559
}
5660

5761
# Also make a copy of that explicitly world-readable. We can't
5862
# necessarily rely on the file in the source tree having those
59-
# permissions. Add it to @keys to include it in the final clean
60-
# up phase.
61-
copy("ssl/client.key", "ssl/client_wrongperms_tmp.key");
62-
chmod 0644, "ssl/client_wrongperms_tmp.key";
63-
push @keys, 'client_wrongperms';
63+
# permissions.
64+
copy("ssl/client.key", "${PostgreSQL::Test::Utils::tmp_check}/client_wrongperms.key");
65+
chmod 0644, "${PostgreSQL::Test::Utils::tmp_check}/client_wrongperms.key";
66+
$key{'client_wrongperms.key'} = "${PostgreSQL::Test::Utils::tmp_check}/client_wrongperms.key";
6467

6568
#### Set up the server.
6669

@@ -399,42 +402,42 @@
399402

400403
# correct client cert in unencrypted PEM
401404
$node->connect_ok(
402-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
405+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
403406
"certificate authorization succeeds with correct client cert in PEM format"
404407
);
405408

406409
# correct client cert in unencrypted DER
407410
$node->connect_ok(
408-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-der_tmp.key",
411+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-der.key'}",
409412
"certificate authorization succeeds with correct client cert in DER format"
410413
);
411414

412415
# correct client cert in encrypted PEM
413416
$node->connect_ok(
414-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='dUmmyP^#+'",
417+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-encrypted-pem.key'} sslpassword='dUmmyP^#+'",
415418
"certificate authorization succeeds with correct client cert in encrypted PEM format"
416419
);
417420

418421
# correct client cert in encrypted DER
419422
$node->connect_ok(
420-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-der_tmp.key sslpassword='dUmmyP^#+'",
423+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-encrypted-der.key'} sslpassword='dUmmyP^#+'",
421424
"certificate authorization succeeds with correct client cert in encrypted DER format"
422425
);
423426

424427
# correct client cert in encrypted PEM with wrong password
425428
$node->connect_fails(
426-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='wrong'",
429+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-encrypted-pem.key'} sslpassword='wrong'",
427430
"certificate authorization fails with correct client cert and wrong password in encrypted PEM format",
428431
expected_stderr =>
429-
qr!\Qprivate key file "ssl/client-encrypted-pem_tmp.key": bad decrypt\E!
432+
qr!\Qprivate key file "$key{'client-encrypted-pem.key'}": bad decrypt\E!
430433
);
431434

432435

433436
# correct client cert using whole DN
434437
my $dn_connstr = "$common_connstr dbname=certdb_dn";
435438

436439
$node->connect_ok(
437-
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=ssl/client-dn_tmp.key",
440+
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=$key{'client-dn.key'}",
438441
"certificate authorization succeeds with DN mapping",
439442
log_like => [
440443
qr/connection authenticated: identity="CN=ssltestuser-dn,OU=Testing,OU=Engineering,O=PGDG" method=cert/
@@ -444,14 +447,14 @@
444447
$dn_connstr = "$common_connstr dbname=certdb_dn_re";
445448

446449
$node->connect_ok(
447-
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=ssl/client-dn_tmp.key",
450+
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=$key{'client-dn.key'}",
448451
"certificate authorization succeeds with DN regex mapping");
449452

450453
# same thing but using explicit CN
451454
$dn_connstr = "$common_connstr dbname=certdb_cn";
452455

453456
$node->connect_ok(
454-
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=ssl/client-dn_tmp.key",
457+
"$dn_connstr user=ssltestuser sslcert=ssl/client-dn.crt sslkey=$key{'client-dn.key'}",
455458
"certificate authorization succeeds with CN mapping",
456459
# the full DN should still be used as the authenticated identity
457460
log_like => [
@@ -469,18 +472,18 @@
469472

470473
# correct client cert in encrypted PEM with empty password
471474
$node->connect_fails(
472-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword=''",
475+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-encrypted-pem.key'} sslpassword=''",
473476
"certificate authorization fails with correct client cert and empty password in encrypted PEM format",
474477
expected_stderr =>
475-
qr!\Qprivate key file "ssl/client-encrypted-pem_tmp.key": processing error\E!
478+
qr!\Qprivate key file "$key{'client-encrypted-pem.key'}": processing error\E!
476479
);
477480

478481
# correct client cert in encrypted PEM with no password
479482
$node->connect_fails(
480-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key",
483+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client-encrypted-pem.key'}",
481484
"certificate authorization fails with correct client cert and no password in encrypted PEM format",
482485
expected_stderr =>
483-
qr!\Qprivate key file "ssl/client-encrypted-pem_tmp.key": processing error\E!
486+
qr!\Qprivate key file "$key{'client-encrypted-pem.key'}": processing error\E!
484487
);
485488

486489
}
@@ -522,7 +525,7 @@
522525
'-P',
523526
'null=_null_',
524527
'-d',
525-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
528+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
526529
'-c',
527530
"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
528531
],
@@ -536,16 +539,16 @@
536539
skip "Permissions check not enforced on Windows", 2 if ($windows_os);
537540

538541
$node->connect_fails(
539-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_wrongperms_tmp.key",
542+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client_wrongperms.key'}",
540543
"certificate authorization fails because of file permissions",
541544
expected_stderr =>
542-
qr!\Qprivate key file "ssl/client_wrongperms_tmp.key" has group or world access\E!
545+
qr!\Qprivate key file "$key{'client_wrongperms.key'}" has group or world access\E!
543546
);
544547
}
545548

546549
# client cert belonging to another user
547550
$node->connect_fails(
548-
"$common_connstr user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
551+
"$common_connstr user=anotheruser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
549552
"certificate authorization fails with client cert belonging to another user",
550553
expected_stderr =>
551554
qr/certificate authentication failed for user "anotheruser"/,
@@ -555,7 +558,7 @@
555558

556559
# revoked client cert
557560
$node->connect_fails(
558-
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked_tmp.key",
561+
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=$key{'client-revoked.key'}",
559562
"certificate authorization fails with revoked client cert",
560563
expected_stderr => qr/SSL error: sslv3 alert certificate revoked/,
561564
# revoked certificates should not authenticate the user
@@ -568,13 +571,13 @@
568571
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
569572

570573
$node->connect_ok(
571-
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
574+
"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
572575
"auth_option clientcert=verify-full succeeds with matching username and Common Name",
573576
# verify-full does not provide authentication
574577
log_unlike => [qr/connection authenticated:/],);
575578

576579
$node->connect_fails(
577-
"$common_connstr user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
580+
"$common_connstr user=anotheruser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
578581
"auth_option clientcert=verify-full fails with mismatching username and Common Name",
579582
expected_stderr =>
580583
qr/FATAL: .* "trust" authentication failed for user "anotheruser"/,
@@ -584,15 +587,15 @@
584587
# Check that connecting with auth-optionverify-ca in pg_hba :
585588
# works, when username doesn't match Common Name
586589
$node->connect_ok(
587-
"$common_connstr user=yetanotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
590+
"$common_connstr user=yetanotheruser sslcert=ssl/client.crt sslkey=$key{'client.key'}",
588591
"auth_option clientcert=verify-ca succeeds with mismatching username and Common Name",
589592
# verify-full does not provide authentication
590593
log_unlike => [qr/connection authenticated:/],);
591594

592595
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
593596
switch_server_cert($node, 'server-cn-only', 'root_ca');
594597
$common_connstr =
595-
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
598+
"user=ssltestuser dbname=certdb sslkey=$key{'client.key'} sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
596599

597600
$node->connect_ok(
598601
"$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",
@@ -608,12 +611,6 @@
608611

609612
# revoked client cert
610613
$node->connect_fails(
611-
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked_tmp.key",
614+
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=$key{'client-revoked.key'}",
612615
"certificate authorization fails with revoked client cert with server-side CRL directory",
613616
expected_stderr => qr/SSL error: sslv3 alert certificate revoked/);
614-
615-
# clean up
616-
foreach my $key (@keys)
617-
{
618-
unlink("ssl/${key}_tmp.key");
619-
}

‎src/test/ssl/t/002_scram.pl

+1-4
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@
9595
# because channel binding is not performed. Note that ssl/client.key may
9696
# be used in a different test, so the name of this temporary client key
9797
# is chosen here to be unique.
98-
my $client_tmp_key = "ssl/client_scram_tmp.key";
98+
my $client_tmp_key = "${PostgreSQL::Test::Utils::tmp_check}/client_scram.key";
9999
copy("ssl/client.key", $client_tmp_key);
100100
chmod 0600, $client_tmp_key;
101101
$node->connect_fails(
@@ -113,7 +113,4 @@
113113
qr/connection authenticated: identity="ssltestuser" method=scram-sha-256/
114114
]);
115115

116-
# clean up
117-
unlink($client_tmp_key);
118-
119116
done_testing($number_of_tests);

0 commit comments

Comments
 (0)