mirror of
https://github.com/postgres/postgres.git
synced 2026-03-18 08:33:45 -04:00
8bb14cdd33
There were several issues with the old coding: 1. There was a race condition, if two threads opened a connection at the same time. We used a mutex around SSL_CTX_* calls, but that was not enough, e.g. if one thread SSL_CTX_load_verify_locations() with one path, and another thread set it with a different path, before the first thread got to establish the connection. 2. Opening two different connections, with different sslrootcert settings, seemed to fail outright with "SSL error: block type is not 01". Not sure why. 3. We created the SSL object, before calling SSL_CTX_load_verify_locations and SSL_CTX_use_certificate_chain_file on the SSL context. That was wrong, because the options set on the SSL context are propagated to the SSL object, when the SSL object is created. If they are set after the SSL object has already been created, they won't take effect until the next connection. (This is bug #14329) At least some of these could've been fixed while still using a shared context, but it would've been more complicated and error-prone. To keep things simple, let's just use a separate SSL context for each connection, and accept the overhead. Backpatch to all supported versions. Report, analysis and test case by Kacper Zuk. Discussion: <20160920101051.1355.79453@wrigleys.postgresql.org>
120 lines
3.6 KiB
Perl
120 lines
3.6 KiB
Perl
# This module sets up a test server, for the SSL regression tests.
|
|
#
|
|
# The server is configured as follows:
|
|
#
|
|
# - SSL enabled, with the server certificate specified by argument to
|
|
# switch_server_cert function.
|
|
# - ssl/root+client_ca.crt as the CA root for validating client certs.
|
|
# - reject non-SSL connections
|
|
# - a database called trustdb that lets anyone in
|
|
# - another database called certdb that uses certificate authentiction, ie.
|
|
# the client must present a valid certificate signed by the client CA
|
|
# - two users, called ssltestuser and anotheruser.
|
|
#
|
|
# The server is configured to only accept connections from localhost. If you
|
|
# want to run the client from another host, you'll have to configure that
|
|
# manually.
|
|
package ServerSetup;
|
|
|
|
use strict;
|
|
use warnings;
|
|
use PostgresNode;
|
|
use TestLib;
|
|
use File::Basename;
|
|
use File::Copy;
|
|
use Test::More;
|
|
|
|
use Exporter 'import';
|
|
our @EXPORT = qw(
|
|
configure_test_server_for_ssl switch_server_cert
|
|
);
|
|
|
|
# Copy a set of files, taking into account wildcards
|
|
sub copy_files
|
|
{
|
|
my $orig = shift;
|
|
my $dest = shift;
|
|
|
|
my @orig_files = glob $orig;
|
|
foreach my $orig_file (@orig_files)
|
|
{
|
|
my $base_file = basename($orig_file);
|
|
copy($orig_file, "$dest/$base_file")
|
|
or die "Could not copy $orig_file to $dest";
|
|
}
|
|
}
|
|
|
|
sub configure_test_server_for_ssl
|
|
{
|
|
my $node = $_[0];
|
|
my $serverhost = $_[1];
|
|
|
|
my $pgdata = $node->data_dir;
|
|
|
|
# Create test users and databases
|
|
$node->psql('postgres', "CREATE USER ssltestuser");
|
|
$node->psql('postgres', "CREATE USER anotheruser");
|
|
$node->psql('postgres', "CREATE DATABASE trustdb");
|
|
$node->psql('postgres', "CREATE DATABASE certdb");
|
|
|
|
# enable logging etc.
|
|
open CONF, ">>$pgdata/postgresql.conf";
|
|
print CONF "fsync=off\n";
|
|
print CONF "log_connections=on\n";
|
|
print CONF "log_hostname=on\n";
|
|
print CONF "listen_addresses='$serverhost'\n";
|
|
print CONF "log_statement=all\n";
|
|
|
|
# enable SSL and set up server key
|
|
print CONF "include 'sslconfig.conf'";
|
|
|
|
close CONF;
|
|
|
|
# Copy all server certificates and keys, and client root cert, to the data dir
|
|
copy_files("ssl/server-*.crt", $pgdata);
|
|
copy_files("ssl/server-*.key", $pgdata);
|
|
chmod(0600, glob "$pgdata/server-*.key") or die $!;
|
|
copy_files("ssl/root+client_ca.crt", $pgdata);
|
|
copy_files("ssl/root_ca.crt", $pgdata);
|
|
copy_files("ssl/root+client.crl", $pgdata);
|
|
|
|
# Only accept SSL connections from localhost. Our tests don't depend on this
|
|
# but seems best to keep it as narrow as possible for security reasons.
|
|
#
|
|
# When connecting to certdb, also check the client certificate.
|
|
open HBA, ">$pgdata/pg_hba.conf";
|
|
print HBA
|
|
"# TYPE DATABASE USER ADDRESS METHOD\n";
|
|
print HBA
|
|
"hostssl trustdb ssltestuser $serverhost/32 trust\n";
|
|
print HBA
|
|
"hostssl trustdb ssltestuser ::1/128 trust\n";
|
|
print HBA
|
|
"hostssl certdb ssltestuser $serverhost/32 cert\n";
|
|
print HBA
|
|
"hostssl certdb ssltestuser ::1/128 cert\n";
|
|
close HBA;
|
|
}
|
|
|
|
# Change the configuration to use given server cert file, and restart
|
|
# the server so that the configuration takes effect.
|
|
sub switch_server_cert
|
|
{
|
|
my $node = $_[0];
|
|
my $certfile = $_[1];
|
|
my $cafile = $_[2] || "root+client_ca";
|
|
my $pgdata = $node->data_dir;
|
|
|
|
diag "Restarting server with certfile \"$certfile\" and cafile \"$cafile\"...";
|
|
|
|
open SSLCONF, ">$pgdata/sslconfig.conf";
|
|
print SSLCONF "ssl=on\n";
|
|
print SSLCONF "ssl_ca_file='$cafile.crt'\n";
|
|
print SSLCONF "ssl_cert_file='$certfile.crt'\n";
|
|
print SSLCONF "ssl_key_file='$certfile.key'\n";
|
|
print SSLCONF "ssl_crl_file='root+client.crl'\n";
|
|
close SSLCONF;
|
|
|
|
# Stop and restart server to reload the new config.
|
|
$node->restart;
|
|
}
|