git.postgresql.org Git - postgresql.git/commitdiff

git projects / postgresql.git / commitdiff

summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 20e0e7d)

Add tests for errors during SSL or GSSAPI handshake

author Heikki Linnakangas <heikki.linnakangas@iki.fi>

2024年7月26日 12:12:23 +0000 (15:12 +0300)

committer Heikki Linnakangas <heikki.linnakangas@iki.fi>

2024年7月26日 12:12:23 +0000 (15:12 +0300)

These test that libpq correctly falls back to a plaintext connection
on handshake error, in the "prefer" modes.

Reviewed-by: Michael Paquier
Discussion: https://www.postgresql.org/message-id/CAOYmi%2Bnwvu21mJ4DYKUa98HdfM_KZJi7B1MhyXtnsyOO-PB6Ww%40mail.gmail.com

src/backend/libpq/be-secure-gssapi.c patch | blob | blame | history

src/backend/libpq/be-secure.c patch | blob | blame | history

src/interfaces/libpq/t/005_negotiate_encryption.pl patch | blob | blame | history

diff --git a/src/backend/libpq/be-secure-gssapi.c b/src/backend/libpq/be-secure-gssapi.c

index bc04e78abba14d755bf64bef1c85922667f9cd58..483636503c188d36ce7678a756d135f63ad44260 100644 (file)

--- a/src/backend/libpq/be-secure-gssapi.c

+++ b/src/backend/libpq/be-secure-gssapi.c

@@ -21,6 +21,7 @@

#include "libpq/pqformat.h"

#include "miscadmin.h"

#include "pgstat.h"

+#include "utils/injection_point.h"

#include "utils/memutils.h"

@@ -499,6 +500,8 @@ secure_open_gssapi(Port *port)

minor;

gss_cred_id_t delegated_creds;

+ INJECTION_POINT("backend-gssapi-startup");

+

/*

* Allocate subsidiary Port data for GSSAPI operations.

*/

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c

index 1663f36b6b80dc9838aafa66ad8f3038fa9688cd..ef20ea755b70bdb898a403b408c287d176f8c91d 100644 (file)

--- a/src/backend/libpq/be-secure.c

+++ b/src/backend/libpq/be-secure.c

@@ -30,6 +30,7 @@

#include "libpq/libpq.h"

#include "miscadmin.h"

#include "tcop/tcopprot.h"

+#include "utils/injection_point.h"

#include "utils/wait_event.h"

char *ssl_library;

@@ -129,6 +130,8 @@ secure_open_server(Port *port)

}

Assert(pq_buffer_remaining_data() == 0);

+ INJECTION_POINT("backend-ssl-startup");

+

r = be_tls_open_server(port);

if (port->raw_buf_remaining > 0)

diff --git a/src/interfaces/libpq/t/005_negotiate_encryption.pl b/src/interfaces/libpq/t/005_negotiate_encryption.pl

index 5fbab969008be747317ef98b38797e62c3557eb8..157f23b8e831bae8cf8a35bb14655564e1bb6e56 100644 (file)

--- a/src/interfaces/libpq/t/005_negotiate_encryption.pl

+++ b/src/interfaces/libpq/t/005_negotiate_encryption.pl

@@ -339,6 +339,16 @@ nossluser . disable postgres connect, authok

"user=testuser sslmode=prefer",

'connect, v2error -> fail');

$node->restart;

+

+ $node->safe_psql(

+ 'postgres',

+ "SELECT injection_points_attach('backend-ssl-startup', 'error');",

+ connstr => "user=localuser host=$unixdir");

+ connect_test(

+ $node,

+ "user=testuser sslmode=prefer",

+ 'connect, sslaccept, backenderror, reconnect, authok -> plain');

+ $node->restart;

}

# Disable SSL again

@@ -444,6 +454,16 @@ nogssuser disable disable postgres connect, authok

"user=testuser gssencmode=prefer sslmode=disable",

'connect, v2error -> fail');

$node->restart;

+

+ $node->safe_psql(

+ 'postgres',

+ "SELECT injection_points_attach('backend-gssapi-startup', 'error');",

+ connstr => "user=localuser host=$unixdir");

+ connect_test(

+ $node,

+ "user=testuser gssencmode=prefer sslmode=disable",

+ 'connect, gssaccept, backenderror, reconnect, authok -> plain');

+ $node->restart;

}

}

This is the main PostgreSQL git repository.