Skip to content

Commit b3a101e

Browse files
peterepetere
committed
Refine SSL tests test name reporting
Instead of using the psql/libpq connection string as the displayed test name and relying on "notes" and source code comments to explain the tests, give the tests self-explanatory names, like we do elsewhere. Reviewed-by: Michael Paquier <michael.paquier@gmail.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
1 parent 882ea50 commit b3a101e

File tree

2 files changed

+89
-68
lines changed

2 files changed

+89
-68
lines changed

‎src/test/ssl/ServerSetup.pm‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ our @EXPORT = qw(
3939
sub run_test_psql
4040
{
4141
my $connstr = $_[0];
42-
my $logstring = $_[1];
4342

4443
my $cmd = [
4544
'psql', '-X', '-A', '-t', '-c', "SELECT \$\$connected with $connstr\$\$",
@@ -49,19 +48,15 @@ sub run_test_psql
4948
return $result;
5049
}
5150

52-
#
5351
# The first argument is a base connection string to use for connection.
54-
# The second argument is a complementary connection string, and it's also
55-
# printed out as the test case name.
52+
# The second argument is a complementary connection string.
5653
sub test_connect_ok
5754
{
5855
my $common_connstr = $_[0];
5956
my $connstr = $_[1];
6057
my $test_name = $_[2];
6158

62-
my $result =
63-
run_test_psql("$common_connstr $connstr", "(should succeed)");
64-
ok($result, $test_name || $connstr);
59+
ok(run_test_psql("$common_connstr $connstr"), $test_name);
6560
}
6661

6762
sub test_connect_fails
@@ -70,8 +65,7 @@ sub test_connect_fails
7065
my $connstr = $_[1];
7166
my $test_name = $_[2];
7267

73-
my $result = run_test_psql("$common_connstr $connstr", "(should fail)");
74-
ok(!$result, $test_name || "$connstr (should fail)");
68+
ok(!run_test_psql("$common_connstr $connstr"), $test_name);
7569
}
7670

7771
# Copy a set of files, taking into account wildcards
@@ -151,9 +145,6 @@ sub switch_server_cert
151145
my $cafile = $_[2] || "root+client_ca";
152146
my $pgdata = $node->data_dir;
153147

154-
note
155-
"reloading server with certfile \"$certfile\" and cafile \"$cafile\"";
156-
157148
open my $sslconf, '>', "$pgdata/sslconfig.conf";
158149
print $sslconf "ssl=on\n";
159150
print $sslconf "ssl_ca_file='$cafile.crt'\n";

‎src/test/ssl/t/001_ssltests.pl‎

Lines changed: 86 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -47,113 +47,134 @@
4747
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
4848

4949
# The server should not accept non-SSL connections.
50-
note "test that the server doesn't accept non-SSL connections";
51-
test_connect_fails($common_connstr, "sslmode=disable");
50+
test_connect_fails($common_connstr, "sslmode=disable",
51+
"server doesn't accept non-SSL connections");
5252

5353
# Try without a root cert. In sslmode=require, this should work. In verify-ca
5454
# or verify-full mode it should fail.
55-
note "connect without server root cert";
56-
test_connect_ok($common_connstr, "sslrootcert=invalid sslmode=require");
57-
test_connect_fails($common_connstr, "sslrootcert=invalid sslmode=verify-ca");
58-
test_connect_fails($common_connstr, "sslrootcert=invalid sslmode=verify-full");
55+
test_connect_ok($common_connstr, "sslrootcert=invalid sslmode=require",
56+
"connect without server root cert sslmode=require");
57+
test_connect_fails($common_connstr, "sslrootcert=invalid sslmode=verify-ca",
58+
"connect without server root cert sslmode=verify-ca");
59+
test_connect_fails($common_connstr, "sslrootcert=invalid sslmode=verify-full",
60+
"connect without server root cert sslmode=verify-full");
5961

6062
# Try with wrong root cert, should fail. (We're using the client CA as the
6163
# root, but the server's key is signed by the server CA.)
62-
note "connect with wrong server root cert";
6364
test_connect_fails($common_connstr,
64-
"sslrootcert=ssl/client_ca.crt sslmode=require");
65+
"sslrootcert=ssl/client_ca.crt sslmode=require",
66+
"connect with wrong server root cert sslmode=require");
6567
test_connect_fails($common_connstr,
66-
"sslrootcert=ssl/client_ca.crt sslmode=verify-ca");
68+
"sslrootcert=ssl/client_ca.crt sslmode=verify-ca",
69+
"connect with wrong server root cert sslmode=verify-ca");
6770
test_connect_fails($common_connstr,
68-
"sslrootcert=ssl/client_ca.crt sslmode=verify-full");
71+
"sslrootcert=ssl/client_ca.crt sslmode=verify-full",
72+
"connect with wrong server root cert sslmode=verify-full");
6973

7074
# Try with just the server CA's cert. This fails because the root file
7175
# must contain the whole chain up to the root CA.
72-
note "connect with server CA cert, without root CA";
7376
test_connect_fails($common_connstr,
74-
"sslrootcert=ssl/server_ca.crt sslmode=verify-ca");
77+
"sslrootcert=ssl/server_ca.crt sslmode=verify-ca",
78+
"connect with server CA cert, without root CA");
7579

7680
# And finally, with the correct root cert.
77-
note "connect with correct server CA cert file";
7881
test_connect_ok($common_connstr,
79-
"sslrootcert=ssl/root+server_ca.crt sslmode=require");
82+
"sslrootcert=ssl/root+server_ca.crt sslmode=require",
83+
"connect with correct server CA cert file sslmode=require");
8084
test_connect_ok($common_connstr,
81-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca");
85+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
86+
"connect with correct server CA cert file sslmode=verify-ca");
8287
test_connect_ok($common_connstr,
83-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full");
88+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full",
89+
"connect with correct server CA cert file sslmode=verify-full");
8490

8591
# Test with cert root file that contains two certificates. The client should
8692
# be able to pick the right one, regardless of the order in the file.
8793
test_connect_ok($common_connstr,
88-
"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca");
94+
"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca",
95+
"cert root file that contains two certificates, order 1");
8996
test_connect_ok($common_connstr,
90-
"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca");
97+
"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca",
98+
"cert root file that contains two certificates, order 2");
9199

92-
note "testing sslcrl option with a non-revoked cert";
100+
# CRL tests
93101

94102
# Invalid CRL filename is the same as no CRL, succeeds
95103
test_connect_ok($common_connstr,
96-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid");
104+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid",
105+
"sslcrl option with invalid file name");
97106

98107
# A CRL belonging to a different CA is not accepted, fails
99108
test_connect_fails($common_connstr,
100-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl");
109+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl",
110+
"CRL belonging to a different CA");
101111

102112
# With the correct CRL, succeeds (this cert is not revoked)
103113
test_connect_ok($common_connstr,
104-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl"
105-
);
114+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
115+
"CRL with a non-revoked cert");
106116

107117
# Check that connecting with verify-full fails, when the hostname doesn't
108118
# match the hostname in the server's certificate.
109-
note "test mismatch between hostname and server certificate";
110119
$common_connstr =
111-
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
120+
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
121+
122+
test_connect_ok($common_connstr, "sslmode=require host=wronghost.test",
123+
"mismatch between host name and server certificate sslmode=require");
124+
test_connect_ok($common_connstr, "sslmode=verify-ca host=wronghost.test",
125+
"mismatch between host name and server certificate sslmode=verify-ca");
126+
test_connect_fails($common_connstr, "sslmode=verify-full host=wronghost.test",
127+
"mismatch between host name and server certificate sslmode=verify-full");
112128

113-
test_connect_ok($common_connstr, "sslmode=require host=wronghost.test");
114-
test_connect_ok($common_connstr, "sslmode=verify-ca host=wronghost.test");
115-
test_connect_fails($common_connstr, "sslmode=verify-full host=wronghost.test");
116129

117130
# Test Subject Alternative Names.
118131
switch_server_cert($node, 'server-multiple-alt-names');
119132

120-
note "test hostname matching with X.509 Subject Alternative Names";
121133
$common_connstr =
122134
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
123135

124-
test_connect_ok($common_connstr, "host=dns1.alt-name.pg-ssltest.test");
125-
test_connect_ok($common_connstr, "host=dns2.alt-name.pg-ssltest.test");
126-
test_connect_ok($common_connstr, "host=foo.wildcard.pg-ssltest.test");
136+
test_connect_ok($common_connstr, "host=dns1.alt-name.pg-ssltest.test",
137+
"host name matching with X.509 Subject Alternative Names 1");
138+
test_connect_ok($common_connstr, "host=dns2.alt-name.pg-ssltest.test",
139+
"host name matching with X.509 Subject Alternative Names 2");
140+
test_connect_ok($common_connstr, "host=foo.wildcard.pg-ssltest.test",
141+
"host name matching with X.509 Subject Alternative Names wildcard");
127142

128-
test_connect_fails($common_connstr, "host=wronghost.alt-name.pg-ssltest.test");
143+
test_connect_fails($common_connstr, "host=wronghost.alt-name.pg-ssltest.test",
144+
"host name not matching with X.509 Subject Alternative Names");
129145
test_connect_fails($common_connstr,
130-
"host=deep.subdomain.wildcard.pg-ssltest.test");
146+
"host=deep.subdomain.wildcard.pg-ssltest.test",
147+
"host name not matching with X.509 Subject Alternative Names wildcard");
131148

132149
# Test certificate with a single Subject Alternative Name. (this gives a
133150
# slightly different error message, that's all)
134151
switch_server_cert($node, 'server-single-alt-name');
135152

136-
note "test hostname matching with a single X.509 Subject Alternative Name";
137153
$common_connstr =
138154
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
139155

140-
test_connect_ok($common_connstr, "host=single.alt-name.pg-ssltest.test");
156+
test_connect_ok($common_connstr, "host=single.alt-name.pg-ssltest.test",
157+
"host name matching with a single X.509 Subject Alternative Name");
141158

142-
test_connect_fails($common_connstr, "host=wronghost.alt-name.pg-ssltest.test");
159+
test_connect_fails($common_connstr, "host=wronghost.alt-name.pg-ssltest.test",
160+
"host name not matching with a single X.509 Subject Alternative Name");
143161
test_connect_fails($common_connstr,
144-
"host=deep.subdomain.wildcard.pg-ssltest.test");
162+
"host=deep.subdomain.wildcard.pg-ssltest.test",
163+
"host name not matching with a single X.509 Subject Alternative Name wildcard");
145164

146165
# Test server certificate with a CN and SANs. Per RFCs 2818 and 6125, the CN
147166
# should be ignored when the certificate has both.
148167
switch_server_cert($node, 'server-cn-and-alt-names');
149168

150-
note "test certificate with both a CN and SANs";
151169
$common_connstr =
152170
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
153171

154-
test_connect_ok($common_connstr, "host=dns1.alt-name.pg-ssltest.test");
155-
test_connect_ok($common_connstr, "host=dns2.alt-name.pg-ssltest.test");
156-
test_connect_fails($common_connstr, "host=common-name.pg-ssltest.test");
172+
test_connect_ok($common_connstr, "host=dns1.alt-name.pg-ssltest.test",
173+
"certificate with both a CN and SANs 1");
174+
test_connect_ok($common_connstr, "host=dns2.alt-name.pg-ssltest.test",
175+
"certificate with both a CN and SANs 2");
176+
test_connect_fails($common_connstr, "host=common-name.pg-ssltest.test",
177+
"certificate with both a CN and SANs ignores CN");
157178

158179
# Finally, test a server certificate that has no CN or SANs. Of course, that's
159180
# not a very sensible certificate, but libpq should handle it gracefully.
@@ -162,56 +183,65 @@
162183
"user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
163184

164185
test_connect_ok($common_connstr,
165-
"sslmode=verify-ca host=common-name.pg-ssltest.test");
186+
"sslmode=verify-ca host=common-name.pg-ssltest.test",
187+
"server certificate without CN or SANs sslmode=verify-ca");
166188
test_connect_fails($common_connstr,
167-
"sslmode=verify-full host=common-name.pg-ssltest.test");
189+
"sslmode=verify-full host=common-name.pg-ssltest.test",
190+
"server certificate without CN or SANs sslmode=verify-full");
168191

169192
# Test that the CRL works
170-
note "testing client-side CRL";
171193
switch_server_cert($node, 'server-revoked');
172194

173195
$common_connstr =
174196
"user=ssltestuser dbname=trustdb sslcert=invalid hostaddr=$SERVERHOSTADDR host=common-name.pg-ssltest.test";
175197

176198
# Without the CRL, succeeds. With it, fails.
177199
test_connect_ok($common_connstr,
178-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca");
200+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
201+
"connects without client-side CRL");
179202
test_connect_fails($common_connstr,
180-
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl"
181-
);
203+
"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
204+
"does not connect with client-side CRL");
182205

183206
### Part 2. Server-side tests.
184207
###
185208
### Test certificate authorization.
186209

187-
note "testing certificate authorization";
210+
note "running server tests";
211+
188212
$common_connstr =
189213
"sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
190214

191215
# no client cert
192-
test_connect_fails($common_connstr, "user=ssltestuser sslcert=invalid");
216+
test_connect_fails($common_connstr,
217+
"user=ssltestuser sslcert=invalid",
218+
"certificate authorization fails without client cert");
193219

194220
# correct client cert
195221
test_connect_ok($common_connstr,
196-
"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key");
222+
"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
223+
"certificate authorization succeeds with correct client cert");
197224

198225
# client cert belonging to another user
199226
test_connect_fails($common_connstr,
200-
"user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key");
227+
"user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
228+
"certificate authorization fails with client cert belonging to another user");
201229

202230
# revoked client cert
203231
test_connect_fails($common_connstr,
204-
"user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked.key"
205-
);
232+
"user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked.key",
233+
"certificate authorization fails with revoked client cert");
206234

207235
# intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
208236
switch_server_cert($node, 'server-cn-only', 'root_ca');
209237
$common_connstr =
210238
"user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
211239

212240
test_connect_ok($common_connstr,
213-
"sslmode=require sslcert=ssl/client+client_ca.crt");
214-
test_connect_fails($common_connstr, "sslmode=require sslcert=ssl/client.crt");
241+
"sslmode=require sslcert=ssl/client+client_ca.crt",
242+
"intermediate client certificate is provided by client");
243+
test_connect_fails($common_connstr, "sslmode=require sslcert=ssl/client.crt",
244+
"intermediate client certificate is missing");
215245

216246
# clean up
217247
unlink "ssl/client_tmp.key";

0 commit comments

Comments
 (0)