mirror of
https://git.postgresql.org/git/postgresql.git
synced 2026-02-24 15:26:59 +08:00
1caef31d9e
The original code was a bit clunky; make it more amenable for further reuse by creating a new Perl package PostgresNode, which is an object-oriented representation of a single server, with some support routines such as init, start, stop, psql. This serves as a better basis on which to build further test code, and enables writing tests that use more than one server without too much complication. This commit modifies a lot of the existing test files, mostly to remove explicit calls to system commands (pg_ctl) replacing them with method calls of a PostgresNode object. The result is quite a bit more straightforward. Also move some initialization code to BEGIN and INIT blocks instead of having it straight in as top-level code. This commit also introduces package RecursiveCopy so that we can copy whole directories without having to depend on packages that may not be present on vanilla Perl 5.8 installations. I also ran perltidy on the modified files, which changes some code sites that are not otherwise touched by this patch. I tried to avoid this, but it ended up being more trouble than it's worth. Authors: Michael Paquier, Álvaro Herrera Review: Noah Misch
119 lines
3.6 KiB
Perl
119 lines
3.6 KiB
Perl
# This module sets up a test server, for the SSL regression tests.
|
|
#
|
|
# The server is configured as follows:
|
|
#
|
|
# - SSL enabled, with the server certificate specified by argument to
|
|
# switch_server_cert function.
|
|
# - ssl/root+client_ca.crt as the CA root for validating client certs.
|
|
# - reject non-SSL connections
|
|
# - a database called trustdb that lets anyone in
|
|
# - another database called certdb that uses certificate authentiction, ie.
|
|
# the client must present a valid certificate signed by the client CA
|
|
# - two users, called ssltestuser and anotheruser.
|
|
#
|
|
# The server is configured to only accept connections from localhost. If you
|
|
# want to run the client from another host, you'll have to configure that
|
|
# manually.
|
|
package ServerSetup;
|
|
|
|
use strict;
|
|
use warnings;
|
|
use PostgresNode;
|
|
use TestLib;
|
|
use File::Basename;
|
|
use File::Copy;
|
|
use Test::More;
|
|
|
|
use Exporter 'import';
|
|
our @EXPORT = qw(
|
|
configure_test_server_for_ssl switch_server_cert
|
|
);
|
|
|
|
# Copy a set of files, taking into account wildcards
|
|
sub copy_files
|
|
{
|
|
my $orig = shift;
|
|
my $dest = shift;
|
|
|
|
my @orig_files = glob $orig;
|
|
foreach my $orig_file (@orig_files)
|
|
{
|
|
my $base_file = basename($orig_file);
|
|
copy($orig_file, "$dest/$base_file")
|
|
or die "Could not copy $orig_file to $dest";
|
|
}
|
|
}
|
|
|
|
sub configure_test_server_for_ssl
|
|
{
|
|
my $node = $_[0];
|
|
my $serverhost = $_[1];
|
|
|
|
my $pgdata = $node->data_dir;
|
|
|
|
# Create test users and databases
|
|
$node->psql('postgres', "CREATE USER ssltestuser");
|
|
$node->psql('postgres', "CREATE USER anotheruser");
|
|
$node->psql('postgres', "CREATE DATABASE trustdb");
|
|
$node->psql('postgres', "CREATE DATABASE certdb");
|
|
|
|
# enable logging etc.
|
|
open CONF, ">>$pgdata/postgresql.conf";
|
|
print CONF "fsync=off\n";
|
|
print CONF "log_connections=on\n";
|
|
print CONF "log_hostname=on\n";
|
|
print CONF "listen_addresses='$serverhost'\n";
|
|
print CONF "log_statement=all\n";
|
|
|
|
# enable SSL and set up server key
|
|
print CONF "include 'sslconfig.conf'";
|
|
|
|
close CONF;
|
|
|
|
# Copy all server certificates and keys, and client root cert, to the data dir
|
|
copy_files("ssl/server-*.crt", $pgdata);
|
|
copy_files("ssl/server-*.key", $pgdata);
|
|
chmod(0600, glob "$pgdata/server-*.key") or die $!;
|
|
copy_files("ssl/root+client_ca.crt", $pgdata);
|
|
copy_files("ssl/root+client.crl", $pgdata);
|
|
|
|
# Only accept SSL connections from localhost. Our tests don't depend on this
|
|
# but seems best to keep it as narrow as possible for security reasons.
|
|
#
|
|
# When connecting to certdb, also check the client certificate.
|
|
open HBA, ">$pgdata/pg_hba.conf";
|
|
print HBA
|
|
"# TYPE DATABASE USER ADDRESS METHOD\n";
|
|
print HBA
|
|
"hostssl trustdb ssltestuser $serverhost/32 trust\n";
|
|
print HBA
|
|
"hostssl trustdb ssltestuser ::1/128 trust\n";
|
|
print HBA
|
|
"hostssl certdb ssltestuser $serverhost/32 cert\n";
|
|
print HBA
|
|
"hostssl certdb ssltestuser ::1/128 cert\n";
|
|
close HBA;
|
|
}
|
|
|
|
# Change the configuration to use given server cert file, and restart
|
|
# the server so that the configuration takes effect.
|
|
sub switch_server_cert
|
|
{
|
|
my $node = $_[0];
|
|
my $certfile = $_[1];
|
|
my $pgdata = $node->data_dir;
|
|
|
|
diag "Restarting server with certfile \"$certfile\"...";
|
|
|
|
open SSLCONF, ">$pgdata/sslconfig.conf";
|
|
print SSLCONF "ssl=on\n";
|
|
print SSLCONF "ssl_ca_file='root+client_ca.crt'\n";
|
|
print SSLCONF "ssl_cert_file='$certfile.crt'\n";
|
|
print SSLCONF "ssl_key_file='$certfile.key'\n";
|
|
print SSLCONF "ssl_crl_file='root+client.crl'\n";
|
|
close SSLCONF;
|
|
|
|
# Stop and restart server to reload the new config.
|
|
$node->restart;
|
|
}
|