mirror of
https://github.com/postgres/postgres.git
synced 2025-10-15 05:46:52 +03:00
Add regression expected-files for older OpenSSL in FIPS mode.
In our previous discussions around making our regression tests pass in FIPS mode, we concluded that we didn't need to support the different error message wording observed with pre-3.0 OpenSSL. However there are still a few LTS distributions soldiering along with such versions, and now we have some in the buildfarm. So let's add the variant expected-files needed to make them happy. This commit only covers the core regression tests. Previous discussion suggested that we might need some adjustments in contrib as well, but it's not totally clear to me what those would be. Rather than work it out from first principles, I'll wait to see what the buildfarm shows. Back-patch to v17 which is the oldest branch that claims to support this case. Author: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/443709.1757876535@sss.pgh.pa.us Backpatch-through: 17
This commit is contained in:
Tom Lane
35
src/test/regress/expected/md5_2.out
Normal file
35
src/test/regress/expected/md5_2.out
Normal file
@@ -0,0 +1,35 @@
|
||||
--
|
||||
-- MD5 test suite - from IETF RFC 1321
|
||||
-- (see: https://www.rfc-editor.org/rfc/rfc1321)
|
||||
--
|
||||
-- (The md5() function will error in OpenSSL FIPS mode. By keeping
|
||||
-- this test in a separate file, it is easier to manage variant
|
||||
-- results.)
|
||||
select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
|
||||
ERROR: could not compute MD5 hash: disabled for FIPS
|
||||
168
src/test/regress/expected/password_2.out
Normal file
168
src/test/regress/expected/password_2.out
Normal file
@@ -0,0 +1,168 @@
|
||||
--
|
||||
-- Tests for password types
|
||||
--
|
||||
-- Tests for GUC password_encryption
|
||||
SET password_encryption = 'novalue'; -- error
|
||||
ERROR: invalid value for parameter "password_encryption": "novalue"
|
||||
HINT: Available values: md5, scram-sha-256.
|
||||
SET password_encryption = true; -- error
|
||||
ERROR: invalid value for parameter "password_encryption": "true"
|
||||
HINT: Available values: md5, scram-sha-256.
|
||||
SET password_encryption = 'md5'; -- ok
|
||||
SET password_encryption = 'scram-sha-256'; -- ok
|
||||
-- consistency of password entries
|
||||
SET password_encryption = 'md5';
|
||||
CREATE ROLE regress_passwd1;
|
||||
ALTER ROLE regress_passwd1 PASSWORD 'role_pwd1';
|
||||
ERROR: password encryption failed: disabled for FIPS
|
||||
CREATE ROLE regress_passwd2;
|
||||
ALTER ROLE regress_passwd2 PASSWORD 'role_pwd2';
|
||||
ERROR: password encryption failed: disabled for FIPS
|
||||
SET password_encryption = 'scram-sha-256';
|
||||
CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';
|
||||
CREATE ROLE regress_passwd4 PASSWORD NULL;
|
||||
-- check list of created entries
|
||||
--
|
||||
-- The scram secret will look something like:
|
||||
-- SCRAM-SHA-256$4096:E4HxLGtnRzsYwg==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=
|
||||
--
|
||||
-- Since the salt is random, the exact value stored will be different on every test
|
||||
-- run. Use a regular expression to mask the changing parts.
|
||||
SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+/=]+)\$([a-zA-Z0-9+=/]+):([a-zA-Z0-9+/=]+)', '\1$\2:<salt>$<storedkey>:<serverkey>') as rolpassword_masked
|
||||
FROM pg_authid
|
||||
WHERE rolname LIKE 'regress_passwd%'
|
||||
ORDER BY rolname, rolpassword;
|
||||
rolname | rolpassword_masked
|
||||
-----------------+---------------------------------------------------
|
||||
regress_passwd1 |
|
||||
regress_passwd2 |
|
||||
regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd4 |
|
||||
(4 rows)
|
||||
|
||||
-- Rename a role
|
||||
ALTER ROLE regress_passwd2 RENAME TO regress_passwd2_new;
|
||||
-- md5 entry should have been removed
|
||||
SELECT rolname, rolpassword
|
||||
FROM pg_authid
|
||||
WHERE rolname LIKE 'regress_passwd2_new'
|
||||
ORDER BY rolname, rolpassword;
|
||||
rolname | rolpassword
|
||||
---------------------+-------------
|
||||
regress_passwd2_new |
|
||||
(1 row)
|
||||
|
||||
ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
|
||||
-- Change passwords with ALTER USER. With plaintext or already-encrypted
|
||||
-- passwords.
|
||||
SET password_encryption = 'md5';
|
||||
-- encrypt with MD5
|
||||
ALTER ROLE regress_passwd2 PASSWORD 'foo';
|
||||
ERROR: password encryption failed: disabled for FIPS
|
||||
-- already encrypted, use as they are
|
||||
ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
|
||||
WARNING: setting an MD5-encrypted password
|
||||
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
|
||||
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
|
||||
ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
|
||||
SET password_encryption = 'scram-sha-256';
|
||||
-- create SCRAM secret
|
||||
ALTER ROLE regress_passwd4 PASSWORD 'foo';
|
||||
-- already encrypted with MD5, use as it is
|
||||
CREATE ROLE regress_passwd5 PASSWORD 'md5e73a4b11df52a6068f8b39f90be36023';
|
||||
WARNING: setting an MD5-encrypted password
|
||||
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
|
||||
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
|
||||
-- This looks like a valid SCRAM-SHA-256 secret, but it is not
|
||||
-- so it should be hashed with SCRAM-SHA-256.
|
||||
CREATE ROLE regress_passwd6 PASSWORD 'SCRAM-SHA-256$1234';
|
||||
-- These may look like valid MD5 secrets, but they are not, so they
|
||||
-- should be hashed with SCRAM-SHA-256.
|
||||
-- trailing garbage at the end
|
||||
CREATE ROLE regress_passwd7 PASSWORD 'md5012345678901234567890123456789zz';
|
||||
-- invalid length
|
||||
CREATE ROLE regress_passwd8 PASSWORD 'md501234567890123456789012345678901zz';
|
||||
-- Changing the SCRAM iteration count
|
||||
SET scram_iterations = 1024;
|
||||
CREATE ROLE regress_passwd9 PASSWORD 'alterediterationcount';
|
||||
SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+/=]+)\$([a-zA-Z0-9+=/]+):([a-zA-Z0-9+/=]+)', '\1$\2:<salt>$<storedkey>:<serverkey>') as rolpassword_masked
|
||||
FROM pg_authid
|
||||
WHERE rolname LIKE 'regress_passwd%'
|
||||
ORDER BY rolname, rolpassword;
|
||||
rolname | rolpassword_masked
|
||||
-----------------+---------------------------------------------------
|
||||
regress_passwd1 | md5cd3578025fe2c3d7ed1b9a9b26238b70
|
||||
regress_passwd2 |
|
||||
regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd4 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd5 | md5e73a4b11df52a6068f8b39f90be36023
|
||||
regress_passwd6 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd7 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd8 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
|
||||
regress_passwd9 | SCRAM-SHA-256$1024:<salt>$<storedkey>:<serverkey>
|
||||
(9 rows)
|
||||
|
||||
-- An empty password is not allowed, in any form
|
||||
CREATE ROLE regress_passwd_empty PASSWORD '';
|
||||
NOTICE: empty string is not a valid password, clearing password
|
||||
ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
|
||||
WARNING: setting an MD5-encrypted password
|
||||
DETAIL: MD5 password support is deprecated and will be removed in a future release of PostgreSQL.
|
||||
HINT: Refer to the PostgreSQL documentation for details about migrating to another password type.
|
||||
ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
|
||||
NOTICE: empty string is not a valid password, clearing password
|
||||
SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';
|
||||
rolpassword
|
||||
-------------
|
||||
|
||||
(1 row)
|
||||
|
||||
-- Test with invalid stored and server keys.
|
||||
--
|
||||
-- The first is valid, to act as a control. The others have too long
|
||||
-- stored/server keys. They will be re-hashed.
|
||||
CREATE ROLE regress_passwd_sha_len0 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
|
||||
CREATE ROLE regress_passwd_sha_len1 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96RqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZI=';
|
||||
CREATE ROLE regress_passwd_sha_len2 PASSWORD 'SCRAM-SHA-256$4096:A6xHKoH/494E941doaPOYg==$Ky+A30sewHIH3VHQLRN9vYsuzlgNyGNKCh37dy96Rqw=:COPdlNiIkrsacU5QoxydEuOH6e/KfiipeETb/bPw8ZIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
|
||||
-- Check that the invalid secrets were re-hashed. A re-hashed secret
|
||||
-- should not contain the original salt.
|
||||
SELECT rolname, rolpassword not like '%A6xHKoH/494E941doaPOYg==%' as is_rolpassword_rehashed
|
||||
FROM pg_authid
|
||||
WHERE rolname LIKE 'regress_passwd_sha_len%'
|
||||
ORDER BY rolname;
|
||||
rolname | is_rolpassword_rehashed
|
||||
-------------------------+-------------------------
|
||||
regress_passwd_sha_len0 | f
|
||||
regress_passwd_sha_len1 | t
|
||||
regress_passwd_sha_len2 | t
|
||||
(3 rows)
|
||||
|
||||
-- Test that valid hashes that are too long are rejected
|
||||
CREATE ROLE regress_passwd10 PASSWORD 'SCRAM-SHA-256$000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004096:wNFxNSk1hAXBkgub8py3bg==$65zC6E+R0U7tiYTC9+Wtq4Thw6gUDj3eDCINij8TflU=:rC1I7tcVugrHEY2DT0iPjGyjM4aJxkMM9n8WBxtUtHU=';
|
||||
ERROR: encrypted password is too long
|
||||
DETAIL: Encrypted passwords must be no longer than 512 bytes.
|
||||
ALTER ROLE regress_passwd9 PASSWORD 'SCRAM-SHA-256$000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004096:wNFxNSk1hAXBkgub8py3bg==$65zC6E+R0U7tiYTC9+Wtq4Thw6gUDj3eDCINij8TflU=:rC1I7tcVugrHEY2DT0iPjGyjM4aJxkMM9n8WBxtUtHU=';
|
||||
ERROR: encrypted password is too long
|
||||
DETAIL: Encrypted passwords must be no longer than 512 bytes.
|
||||
DROP ROLE regress_passwd1;
|
||||
DROP ROLE regress_passwd2;
|
||||
DROP ROLE regress_passwd3;
|
||||
DROP ROLE regress_passwd4;
|
||||
DROP ROLE regress_passwd5;
|
||||
DROP ROLE regress_passwd6;
|
||||
DROP ROLE regress_passwd7;
|
||||
DROP ROLE regress_passwd8;
|
||||
DROP ROLE regress_passwd9;
|
||||
DROP ROLE regress_passwd_empty;
|
||||
DROP ROLE regress_passwd_sha_len0;
|
||||
DROP ROLE regress_passwd_sha_len1;
|
||||
DROP ROLE regress_passwd_sha_len2;
|
||||
-- all entries should have been removed
|
||||
SELECT rolname, rolpassword
|
||||
FROM pg_authid
|
||||
WHERE rolname LIKE 'regress_passwd%'
|
||||
ORDER BY rolname, rolpassword;
|
||||
rolname | rolpassword
|
||||
---------+-------------
|
||||
(0 rows)
|
||||
|
||||
Reference in New Issue
Block a user