database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-30 21:42:05 +03:00
Code Activity

Clean up management of IP addresses in our SSL tests.

Browse Source 
Instead of hard-wiring the netmask as /32, allow it to be specified
where we specify the server address.  This will ease changing the
test to use IPv6, when/if somebody wants to do that.

Also remove the hard-wired pg_hba.conf entries for IPv6 (::1/128).
These have never had any usefulness, because the client side
of the tests has always explicitly connected to $SERVERHOSTADDR
which has always been set to IPv4 (127.0.0.1).  All they accomplish
is to break the test on non-IPv6-supporting hosts, and besides
that they violate the express intent of the code to minimize the
server's range of allowed connections.

This could be back-patched, perhaps, but for now I don't see
a need to.

Discussion: https://postgr.es/m/1899.1578356089@sss.pgh.pa.us
This commit is contained in:
Tom Lane
2020-01-06 20:56:32 -05:00
parent e369f37086
commit 2bd0735b95
3 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/test/ssl/t/SSLServer.pm
View File

@ -94,9 +94,12 @@ sub copy_files
return;
}
# serverhost: what to put in listen_addresses, e.g. '127.0.0.1'
# servercidr: what to put in pg_hba.conf, e.g. '127.0.0.1/32'
sub configure_test_server_for_ssl
{
my ($node, $serverhost, $authmethod, $password, $password_enc) = @_;
my ($node, $serverhost, $servercidr, $authmethod, $password,
$password_enc) = @_;
my $pgdata = $node->data_dir;
@ -153,7 +156,7 @@ sub configure_test_server_for_ssl
$node->restart;
# Change pg_hba after restart because hostssl requires ssl=on
configure_hba_for_ssl($node, $serverhost, $authmethod);
configure_hba_for_ssl($node, $servercidr, $authmethod);
return;
}
@ -181,10 +184,10 @@ sub switch_server_cert
sub configure_hba_for_ssl
{
my ($node, $serverhost, $authmethod) = @_;
my ($node, $servercidr, $authmethod) = @_;
my $pgdata = $node->data_dir;
# Only accept SSL connections from localhost. Our tests don't depend on this
# Only accept SSL connections from $servercidr. Our tests don't depend on this
# but seems best to keep it as narrow as possible for security reasons.
#
# When connecting to certdb, also check the client certificate.
@ -192,21 +195,17 @@ sub configure_hba_for_ssl
print $hba
"# TYPE DATABASE USER ADDRESS METHOD OPTIONS\n";
print $hba
"hostssl trustdb md5testuser $serverhost/32 md5\n";
"hostssl trustdb md5testuser $servercidr md5\n";
print $hba
"hostssl trustdb all $serverhost/32 $authmethod\n";
"hostssl trustdb all $servercidr $authmethod\n";
print $hba
"hostssl trustdb all ::1/128 $authmethod\n";
"hostssl verifydb ssltestuser $servercidr $authmethod clientcert=verify-full\n";
print $hba
"hostssl verifydb ssltestuser $serverhost/32 $authmethod clientcert=verify-full\n";
"hostssl verifydb anotheruser $servercidr $authmethod clientcert=verify-full\n";
print $hba
"hostssl verifydb anotheruser $serverhost/32 $authmethod clientcert=verify-full\n";
"hostssl verifydb yetanotheruser $servercidr $authmethod clientcert=verify-ca\n";
print $hba
"hostssl verifydb yetanotheruser $serverhost/32 $authmethod clientcert=verify-ca\n";
print $hba
"hostssl certdb all $serverhost/32 cert\n";
print $hba
"hostssl certdb all ::1/128 cert\n";
"hostssl certdb all $servercidr cert\n";
close $hba;
return;
}