--- /dev/null
+
+# Copyright (c) 2021-2024, PostgreSQL Global Development Group
+
+# OVERVIEW
+# --------
+#
+# Test negotiation of SSL and GSSAPI encryption
+#
+# We test all combinations of:
+#
+# - all the libpq client options that affect the protocol negotiations
+# (gssencmode, sslmode)
+# - server accepting or rejecting the authentication due to
+# pg_hba.conf entries
+# - SSL and GSS enabled/disabled in the server
+#
+# That's a lot of combinations, so we use a table-driven approach.
+# Each combination is represented by a line in a table. The line lists
+# the options specifying the test case, and an expected outcome. The
+# expected outcome includes whether the connection succeeds or fails,
+# and whether it uses SSL, GSS or no encryption.
+#
+# TEST TABLE FORMAT
+# -----------------
+#
+# Example of the test table format:
+#
+# # USER GSSENCMODE SSLMODE OUTCOME
+# testuser disable allow plain
+# . . prefer ssl
+# testuser require * fail
+#
+# USER, GSSENCMODE and SSLMODE fields are the libpq 'user',
+# 'gssencmode' and 'sslmode' options used in the test. As a shorthand,
+# a single dot ('.') can be used in the USER, GSSENCMODE, and SSLMODE
+# fields, to indicate "same as on previous line". A '*' can be used
+# as a wildcard; it is expanded to mean all possible values of that
+# field.
+#
+# The OUTCOME field indicates the expected result of the test:
+#
+# plain: an unencrypted connection was established
+# ssl: SSL connection was established
+# gss: GSSAPI encrypted connection was established
+# fail: the connection attempt failed
+#
+# Empty lines are ignored. '#' can be used to mark the rest of the
+# line as a comment.
+
+use strict;
+use warnings FATAL => 'all';
+use PostgreSQL::Test::Utils;
+use PostgreSQL::Test::Cluster;
+use PostgreSQL::Test::Kerberos;
+use File::Basename;
+use File::Copy;
+use Test::More;
+
+if (!$ENV{PG_TEST_EXTRA} || $ENV{PG_TEST_EXTRA} !~ /\blibpq_encryption\b/)
+{
+ plan skip_all =>
+ 'Potentially unsafe test libpq_encryption not enabled in PG_TEST_EXTRA';
+}
+
+my $ssl_supported = $ENV{with_ssl} eq 'openssl';
+my $gss_supported = $ENV{with_gssapi} eq 'yes';
+
+###
+### Prepare test server for GSSAPI and SSL authentication, with a few
+### different test users and helper functions. We don't actually
+### enable SSL and kerberos in the server yet, we will do that later.
+###
+
+my $host = 'enc-test-localhost.postgresql.example.com';
+my $hostaddr = '127.0.0.1';
+my $servercidr = '127.0.0.1/32';
+
+my $node = PostgreSQL::Test::Cluster->new('node');
+$node->init;
+$node->append_conf(
+ 'postgresql.conf', qq{
+listen_addresses = '$hostaddr'
+log_connections = on
+lc_messages = 'C'
+});
+my $pgdata = $node->data_dir;
+
+my $dbname = 'postgres';
+my $username = 'enctest';
+my $application = '001_negotiate_encryption.pl';
+
+my $gssuser_password = 'secret1';
+
+my $krb;
+
+if ($gss_supported != 0)
+{
+ note "setting up Kerberos";
+
+ my $realm = 'EXAMPLE.COM';
+ $krb = PostgreSQL::Test::Kerberos->new($host, $hostaddr, $realm);
+ $node->append_conf('postgresql.conf', "krb_server_keyfile = '$krb->{keytab}'\n");
+}
+
+if ($ssl_supported != 0)
+{
+ my $certdir = dirname(__FILE__) . "/../../ssl/ssl";
+
+ copy "$certdir/server-cn-only.crt", "$pgdata/server.crt"
+ || die "copying server.crt: $!";
+ copy "$certdir/server-cn-only.key", "$pgdata/server.key"
+ || die "copying server.key: $!";
+ chmod(0600, "$pgdata/server.key");
+
+ # Start with SSL disabled.
+ $node->append_conf('postgresql.conf', "ssl = off\n");
+}
+
+$node->start;
+
+$node->safe_psql('postgres', 'CREATE USER localuser;');
+$node->safe_psql('postgres', 'CREATE USER testuser;');
+$node->safe_psql('postgres', 'CREATE USER ssluser;');
+$node->safe_psql('postgres', 'CREATE USER nossluser;');
+$node->safe_psql('postgres', 'CREATE USER gssuser;');
+$node->safe_psql('postgres', 'CREATE USER nogssuser;');
+
+my $unixdir = $node->safe_psql('postgres', 'SHOW unix_socket_directories;');
+chomp($unixdir);
+
+# Helper function that returns the encryption method in use in the
+# connection.
+$node->safe_psql('postgres', q{
+CREATE FUNCTION current_enc() RETURNS text LANGUAGE plpgsql AS $$
+DECLARE
+ ssl_in_use bool;
+ gss_in_use bool;
+BEGIN
+ ssl_in_use = (SELECT ssl FROM pg_stat_ssl WHERE pid = pg_backend_pid());
+ gss_in_use = (SELECT encrypted FROM pg_stat_gssapi WHERE pid = pg_backend_pid());
+
+ raise log 'ssl % gss %', ssl_in_use, gss_in_use;
+
+ IF ssl_in_use AND gss_in_use THEN
+ RETURN 'ssl+gss'; -- shouldn't happen
+ ELSIF ssl_in_use THEN
+ RETURN 'ssl';
+ ELSIF gss_in_use THEN
+ RETURN 'gss';
+ ELSE
+ RETURN 'plain';
+ END IF;
+END;
+$$;
+});
+
+# Only accept SSL connections from $servercidr. Our tests don't depend on this
+# but seems best to keep it as narrow as possible for security reasons.
+open my $hba, '>', "$pgdata/pg_hba.conf";
+print $hba qq{
+# TYPE DATABASE USER ADDRESS METHOD OPTIONS
+local postgres localuser trust
+host postgres testuser $servercidr trust
+hostnossl postgres nossluser $servercidr trust
+hostnogssenc postgres nogssuser $servercidr trust
+};
+
+print $hba qq{
+hostssl postgres ssluser $servercidr trust
+} if ($ssl_supported != 0);
+
+print $hba qq{
+hostgssenc postgres gssuser $servercidr trust
+} if ($gss_supported != 0);
+close $hba;
+$node->reload;
+
+# Ok, all prepared. Run the tests.
+
+my @all_test_users = ('testuser', 'ssluser', 'nossluser', 'gssuser', 'nogssuser');
+my @all_gssencmodes = ('disable', 'prefer', 'require');
+my @all_sslmodes = ('disable', 'allow', 'prefer', 'require');
+
+my $server_config = {
+ server_ssl => 0,
+ server_gss => 0,
+};
+
+###
+### Run tests with GSS and SSL disabled in the server
+###
+my $test_table = q{
+# USER GSSENCMODE SSLMODE OUTCOME
+testuser disable disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+. prefer disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+
+# All attempts with gssencmode=require fail because no credential
+# cache has been configured in the client (and the server isn't
+# configured for GSS either)
+. require * fail
+};
+note("Running tests with SSL and GSS disabled in the server");
+test_matrix($node, $server_config,
+ ['testuser'],
+ \@all_sslmodes, \@all_gssencmodes, parse_table($test_table));
+
+###
+### Run tests with GSS disabled and SSL enabled in the server
+###
+SKIP:
+{
+ skip "SSL not supported by this build" if $ssl_supported == 0;
+
+ $test_table = q{
+# USER GSSENCMODE SSLMODE OUTCOME
+testuser disable disable plain
+. . allow plain
+. . prefer ssl
+. . require ssl
+ssluser . disable fail
+. . allow ssl
+. . prefer ssl
+. . require ssl
+nossluser . disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+};
+
+ # Enable SSL in the server
+ $node->adjust_conf('postgresql.conf', 'ssl', 'on');
+ $node->reload;
+ $server_config->{server_ssl} = 1;
+
+ note("Running tests with SSL enabled in server");
+ test_matrix($node, $server_config,
+ ['testuser', 'ssluser', 'nossluser'],
+ \@all_sslmodes, ['disable'], parse_table($test_table));
+
+ # Disable SSL again
+ $node->adjust_conf('postgresql.conf', 'ssl', 'off');
+ $node->reload;
+ $server_config->{server_ssl} = 0;
+}
+
+###
+### Run tests with GSS enabled, SSL disabled in the server
+###
+SKIP:
+{
+ skip "GSSAPI/Kerberos not supported by this build" if $gss_supported == 0;
+ $test_table = q{
+# USER GSSENCMODE SSLMODE OUTCOME
+testuser disable disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+. require * gss
+. prefer * gss
+
+gssuser disable disable fail
+. . allow fail
+. . prefer fail
+. . require fail
+. prefer * gss
+. require * gss
+
+nogssuser disable disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+. prefer disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+. require * fail
+};
+
+ # Sanity check that the connection fails when no kerberos ticket
+ # is present in the client
+ connect_test($node, 'user=testuser gssencmode=require sslmode=disable', 'fail');
+
+ $krb->create_principal('gssuser', $gssuser_password);
+ $krb->create_ticket('gssuser', $gssuser_password);
+ $server_config->{server_gss} = 1;
+
+ note("Running tests with GSS enabled in server");
+ test_matrix($node, $server_config,
+ ['testuser', 'gssuser', 'nogssuser'],
+ \@all_sslmodes, \@all_gssencmodes, parse_table($test_table));
+
+ # Check that logs match the expected 'no pg_hba.conf entry' line, too, as
+ # that is not tested by test_matrix.
+ connect_test($node, 'user=nogssuser gssencmode=require sslmode=prefer', 'fail',
+ 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+
+ # With 'gssencmode=prefer', libpq will first negotiate GSSAPI
+ # encryption, but the connection will fail because pg_hba.conf
+ # forbids GSSAPI encryption for this user. It will then reconnect
+ # with SSL, but the server doesn't support it, so it will continue
+ # with no encryption.
+ connect_test($node, 'user=nogssuser gssencmode=prefer sslmode=prefer', 'plain',
+ 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+}
+
+###
+### Tests with both GSS and SSL enabled in the server
+###
+SKIP:
+{
+ skip "GSSAPI/Kerberos or SSL not supported by this build" unless ($ssl_supported && $gss_supported);
+
+ $test_table = q{
+# USER GSSENCMODE SSLMODE OUTCOME
+testuser disable disable plain
+. . allow plain
+. . prefer ssl
+. . require ssl
+. prefer disable gss
+. . allow gss
+. . prefer gss
+. . require gss # If both GSS and SSL is possible, GSS is chosen over SSL, even if sslmode=require
+. require disable gss
+. . allow gss
+. . prefer gss
+. . require gss # If both GSS and SSL is possible, GSS is chosen over SSL, even if sslmode=require
+
+gssuser disable * fail
+. prefer * gss
+. require * gss
+
+ssluser disable disable fail
+. . allow ssl
+. . prefer ssl
+. . require ssl
+. prefer disable fail
+. . allow ssl
+. . prefer ssl
+. . require ssl
+. require disable fail
+. . allow fail
+. . prefer fail
+. . require fail # If both GSS and SSL are required, the sslmode=require is effectively ignored and GSS is required
+
+nogssuser disable disable plain
+. . allow plain
+. . prefer ssl
+. . require ssl
+. prefer disable plain
+. . allow plain
+. . prefer ssl
+. . require ssl
+. require * fail
+
+nossluser disable disable plain
+. . allow plain
+. . prefer plain
+. . require fail
+. prefer * gss
+. require * gss
+};
+
+ # Sanity check that GSSAPI is still enabled from previous test.
+ connect_test($node, 'user=testuser gssencmode=prefer sslmode=prefer', 'gss');
+
+ # Enable SSL
+ $node->adjust_conf('postgresql.conf', 'ssl', 'on');
+ $node->reload;
+ $server_config->{server_ssl} = 1;
+
+ note("Running tests with both GSS and SSL enabled in server");
+ test_matrix($node, $server_config,
+ ['testuser', 'gssuser', 'ssluser', 'nogssuser', 'nossluser'],
+ \@all_sslmodes, \@all_gssencmodes, parse_table($test_table));
+
+ # Test case that server supports GSSAPI, but it's not allowed for
+ # this user. Special cased because we check output
+ connect_test($node, 'user=nogssuser gssencmode=require sslmode=prefer', 'fail',
+ 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+
+ # with 'gssencmode=prefer', libpq will first negotiate GSSAPI
+ # encryption, but the connection will fail because pg_hba.conf
+ # forbids GSSAPI encryption for this user. It will then reconnect
+ # with SSL.
+ connect_test($node, 'user=nogssuser gssencmode=prefer sslmode=prefer', 'ssl',
+ 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+
+ # Setting both gssencmode=require and sslmode=require fails if
+ # GSSAPI is not available.
+ connect_test($node, 'user=nogssuser gssencmode=require sslmode=require ', 'fail');
+}
+
+###
+### Test negotiation over unix domain sockets.
+###
+SKIP:
+{
+ skip "Unix domain sockets not supported" unless ($unixdir ne "");
+
+ connect_test($node, "user=localuser gssencmode=prefer sslmode=require host=$unixdir", 'plain');
+ connect_test($node, "user=localuser gssencmode=require sslmode=prefer host=$unixdir", 'fail');
+}
+
+done_testing();
+
+
+### Helper functions
+
+# Test the cube of parameters: user, sslmode, and gssencmode
+sub test_matrix
+{
+ local $Test::Builder::Level = $Test::Builder::Level + 1;
+
+ my ($pg_node, $node_conf,
+ $test_users, $ssl_modes, $gss_modes, %expected) = @_;
+
+ foreach my $test_user (@{$test_users})
+ {
+ foreach my $gssencmode (@{$gss_modes})
+ {
+ foreach my $client_mode (@{$ssl_modes})
+ {
+ my %params = (
+ server_ssl=>$node_conf->{server_ssl},
+ server_gss=>$node_conf->{server_gss},
+ user=>$test_user,
+ gssencmode=>$gssencmode,
+ sslmode=>$client_mode,
+ );
+ my $key = "$test_user $gssencmode $client_mode";
+ my $res = $expected{$key};
+ if (!defined $res) {
+ $res = "<expected result missing>";
+ }
+ connect_test($pg_node, "user=$test_user gssencmode=$gssencmode sslmode=$client_mode", $res);
+ }
+ }
+ }
+}
+
+sub connect_test
+{
+ local $Test::Builder::Level = $Test::Builder::Level + 1;
+
+ my ($node, $connstr, $expected_outcome, @expect_log_msgs)
+ = @_;
+
+ my $test_name = " '$connstr' -> $expected_outcome";
+
+ my $connstr_full = "";
+ $connstr_full .= "dbname=postgres " unless $connstr =~ m/dbname=/;
+ $connstr_full .= "host=$host hostaddr=$hostaddr " unless $connstr =~ m/host=/;
+ $connstr_full .= $connstr;
+
+ my $log_location = -s $node->logfile;
+
+ # XXX: Pass command with -c, because I saw intermittent test
+ # failures like this:
+ #
+ # ack Broken pipe: write( 13, 'SELECT current_enc()' ) at /usr/local/lib/perl5/site_perl/IPC/Run/IO.pm line 550.
+ #
+ # I think that happens if the connection fails before we write the
+ # query to its stdin. This test gets a lot of connection failures
+ # on purpose.
+ my ($ret, $stdout, $stderr) = $node->psql(
+ 'postgres',
+ '',
+ extra_params => ['-w', '-c', 'SELECT current_enc()'],
+ connstr => "$connstr_full",
+ on_error_stop => 0);
+
+ my $outcome = $ret == 0 ? $stdout : 'fail';
+
+ is($outcome, $expected_outcome, $test_name) or diag("$stderr");
+
+ if (@expect_log_msgs)
+ {
+ # Match every message literally.
+ my @regexes = map { qr/\Q$_\E/ } @expect_log_msgs;
+ my %params = ();
+ $params{log_like} = \@regexes;
+ $node->log_check($test_name, $log_location, %params);
+ }
+}
+
+sub parse_table
+{
+ my ($table) = @_;
+ my @lines = split /\n/, $table;
+
+ my %expected;
+
+ my ($user, $gssencmode, $sslmode);
+ foreach my $line (@lines) {
+
+ # Trim comments
+ $line =~ s/#.*$//;
+
+ # Trim whitespace at beginning and end
+ $line =~ s/^\s+//;
+ $line =~ s/\s+$//;
+
+ # Ignore empty lines (includes comment-only lines)
+ next if $line eq '';
+
+ my @cols = split /\s+/, $line;
+ die "test table line \"$line\" has incorrect number of columns\n" if scalar(@cols) != 4 ;
+
+ $user = $cols[0] unless $cols[0] eq ".";
+ $gssencmode = $cols[1] unless $cols[1] eq ".";
+ $sslmode = $cols[2] unless $cols[2] eq ".";
+ my $outcome = $cols[3];
+
+ my %expanded = expand_expected_line($user, $gssencmode, $sslmode, $outcome);
+ %expected = (%expected, %expanded);
+ }
+ return %expected;
+}
+
+# Expand wildcards on a test table line
+sub expand_expected_line
+{
+ my ($user, $gssencmode, $sslmode, $expected) = @_;
+
+ my %result;
+ if ($user eq '*') {
+ foreach my $x (@all_test_users) {
+ %result = (%result, expand_expected_line($x, $gssencmode, $sslmode, $expected));
+ }
+ } elsif ($gssencmode eq '*') {
+ foreach my $x (@all_gssencmodes) {
+ %result = (%result, expand_expected_line($user, $x, $sslmode, $expected));
+ }
+ } elsif ($sslmode eq '*') {
+ foreach my $x (@all_sslmodes) {
+ %result = (%result, expand_expected_line($user, $gssencmode, $x, $expected));
+ }
+ } else {
+ $result{"$user $gssencmode $sslmode"} = $expected;
+ }
+ return %result;
+}
projects / postgresql.git / commitdiff