diff --git a/src/test/Makefile b/src/test/Makefile index 6b40cf5..bf5c5b9 100644 --- a/src/test/Makefile +++ b/src/test/Makefile @@ -12,7 +12,7 @@ subdir = src/test top_builddir = ../.. include $(top_builddir)/src/Makefile.global -SUBDIRS = perl regress isolation modules recovery +SUBDIRS = perl regress isolation modules recovery pg_hba_rules # We don't build or execute examples/, locale/, or thread/ by default, # but we do want "make clean" etc to recurse into them. Likewise for ssl/, diff --git a/src/test/pg_hba_rules/.gitignore b/src/test/pg_hba_rules/.gitignore new file mode 100644 index 0000000..5dcb3ff --- /dev/null +++ b/src/test/pg_hba_rules/.gitignore @@ -0,0 +1,4 @@ +# Generated subdirectories +/log/ +/results/ +/tmp_check/ diff --git a/src/test/pg_hba_rules/Makefile b/src/test/pg_hba_rules/Makefile new file mode 100644 index 0000000..241f201 --- /dev/null +++ b/src/test/pg_hba_rules/Makefile @@ -0,0 +1,19 @@ +# src/test/pg_hba_rules/Makefile + +REGRESS = pg_hba_rules + +ifdef USE_PGXS +PG_CONFIG = pg_config +PGXS := $(shell $(PG_CONFIG) --pgxs) +include $(PGXS) +else +subdir = src/test/pg_hba_rules +top_builddir = ../../.. +include $(top_builddir)/src/Makefile.global +endif + +check: + $(prove_check) + +clean distclean maintainer-clean: + rm -rf tmp_check \ No newline at end of file diff --git a/src/test/pg_hba_rules/README b/src/test/pg_hba_rules/README new file mode 100644 index 0000000..fbc22f7 --- /dev/null +++ b/src/test/pg_hba_rules/README @@ -0,0 +1,14 @@ +src/test/pg_hba_rules/README + +Regression tests for hba rules +============================== + +This directory contains a test suite for pg_hba.conf rules to verify +from pg_hba_rules view. + +Running the tests +================= + + make check + +NOTE: This requires the --enable-tap-tests argument to configure. diff --git a/src/test/pg_hba_rules/t/001_pg_hba_rules.pl b/src/test/pg_hba_rules/t/001_pg_hba_rules.pl new file mode 100644 index 0000000..8e5d756 --- /dev/null +++ b/src/test/pg_hba_rules/t/001_pg_hba_rules.pl @@ -0,0 +1,288 @@ +# Test all cases of pg_hba_rules view + +use strict; +use warnings; + +use TestLib; +use Test::More tests => 1; +use PostgresNode; + +my $node = get_new_node(); +$node->init; +$node->start; + +#local connections are not supported by this build (windows) +$node->append_conf('pg_hba.conf', qq( +local +)); + +#hostssl requires SSL to be turned on +#hostssl is not supported by this build +$node->append_conf('pg_hba.conf', qq( +hostssl +)); + +#invalid connection type +$node->append_conf('pg_hba.conf', qq( +hostinvalid +)); + +#end-of-line before database specification +$node->append_conf('pg_hba.conf', qq( +host +)); + +#end-of-line before role specification +$node->append_conf('pg_hba.conf', qq( +host all +)); + +#end-of-line before IP address specification +$node->append_conf('pg_hba.conf', qq( +host all all +)); + +#specifying both host name and CIDR mask is invalid +$node->append_conf('pg_hba.conf', qq( +host all all /32 +)); + +#specifying both host name and CIDR mask is invalid +$node->append_conf('pg_hba.conf', qq( +host all all 127.0.0.1 +)); + +#invalid CIDR mask in address +$node->append_conf('pg_hba.conf', qq( +host all all 127.0.0.1/255 +)); + +#invalid CIDR mask in address +$node->append_conf('pg_hba.conf', qq( +host all all 127.0.0.1 256.256.256.256 +)); + +#invalid CIDR mask in address +$node->append_conf('pg_hba.conf', qq( +host all all ::1 255.255.255.255 +)); + +#end-of-line before authentication method +$node->append_conf('pg_hba.conf', qq( +host all all all +)); + +#samehost as IP address specification and md5 authentication method +$node->append_conf('pg_hba.conf', qq( +host all all samehost md5 +)); + +#samenet IP address specification and invalid authentication method +$node->append_conf('pg_hba.conf', qq( +host all all samenet noauth +)); + +#hostname specification and invalid authentication method, not supported by this build (in some builds) +$node->append_conf('pg_hba.conf', qq( +host all all hostname bsd +)); + +#gssapi authentication is not supported on local sockets +$node->append_conf('pg_hba.conf', qq( +local all all all gss +)); + +#peer authentication is only supported on local sockets +$node->append_conf('pg_hba.conf', qq( +host all all all peer +)); + +#cert authentication is only supported on hostssl connections +$node->append_conf('pg_hba.conf', qq( +host all all all cert +)); + +#authentication option not in name=value format +$node->append_conf('pg_hba.conf', qq( +host all all all md5 notnamevalueformat +)); + +#auhentication option "map" is only valid for authentication methods ident, peer, gssapi, sspi, and cert +$node->append_conf('pg_hba.conf', qq( +host all all all md5 map=1 +)); + +#clientcert can only be configured for hostssl rows +$node->append_conf('pg_hba.conf', qq( +host all all all md5 clientcert=1 +)); + +#client certificates can only be checked if a root certificate store is available +$node->append_conf('pg_hba.conf', qq( +hostssl all all all md5 clientcert=1 +)); + +#clientcert can not be set to 0 when using cert authentication +$node->append_conf('pg_hba.conf', qq( +hostssl all all all cert clientcert=0 +)); + +#auhentication option pamservice is only valid for authentication methods pam +$node->append_conf('pg_hba.conf', qq( +host all all all md5 pamservice=postgresql +)); + +#auhentication option pam_use_hostname is only valid for authentication methods pam +$node->append_conf('pg_hba.conf', qq( +host all all all md5 pam_use_hostname=1 +)); + +#LDAP URLs not supported on this platform +#auhentication option ldapurl is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapurl=invalid +)); + +#could not parse LDAP URL +$node->append_conf('pg_hba.conf', qq( +host all all all ldap ldapurl=invalid +)); + +#auhentication option ldaptls is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldaptls=1 +)); + +#auhentication option ldapserver is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapserver=invalid +)); + +#auhentication option ldapport is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapport=0 +)); + +#invalid LDAP port number +$node->append_conf('pg_hba.conf', qq( +host all all all ldap ldapport=0 +)); + +#auhentication option ldapbinddn is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapbinddn=invalid +)); + +#auhentication option ldapbindpasswd is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapbindpasswd=invalid +)); + +#auhentication option ldapsearchattribute is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapsearchattribute=invalid +)); + +#auhentication option ldapbasedn is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapbasedn=invalid +)); + +#auhentication option ldapprefix is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapprefix=invalid +)); + +#auhentication option ldapsuffix is only valid for authentication methods ldap +$node->append_conf('pg_hba.conf', qq( +host all all all md5 ldapsuffix=invalid +)); + +#auhentication option krb_realm is only valid for authentication methods gssapi and sspi +$node->append_conf('pg_hba.conf', qq( +host all all all md5 krb_realm=invalid +)); + +#auhentication option include_realm is only valid for authentication methods gssapi and sspi +$node->append_conf('pg_hba.conf', qq( +host all all all md5 include_realm=1 +)); + +#auhentication option compat_realm is only valid for authentication methods sspi +$node->append_conf('pg_hba.conf', qq( +host all all all md5 compat_realm=1 +)); + +#auhentication option upn_username is only valid for authentication methods sspi +$node->append_conf('pg_hba.conf', qq( +host all all all md5 upn_username=1 +)); + +#auhentication option radiusserver is only valid for authentication methods radius +$node->append_conf('pg_hba.conf', qq( +host all all all md5 radiusserver=invalid +)); + +#could not translate RADIUS server name +$node->append_conf('pg_hba.conf', qq( +host all all all radius radiusserver=invalid +)); + +#auhentication option radiusport is only valid for authentication methods radius +$node->append_conf('pg_hba.conf', qq( +host all all all md5 radiusport=0 +)); + +#invalid RADIUS port number +$node->append_conf('pg_hba.conf', qq( +host all all all radius radiusport=0 +)); + +#auhentication option radiussecret is only valid for authentication methods radius +$node->append_conf('pg_hba.conf', qq( +host all all all md5 radiussecret=invalid +)); + +#auhentication option radiusidentifier is only valid for authentication methods radius +$node->append_conf('pg_hba.conf', qq( +host all all all md5 radiusidentifier=invalid +)); + +#unrecognized authentication option name +$node->append_conf('pg_hba.conf', qq( +host all all all md5 invalidoption=invalid +)); + +#auhentication method ldap requires argument ldapserver to be set +$node->append_conf('pg_hba.conf', qq( +host all all all ldap +)); + +#cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, or ldapurl together with ldapprefix +$node->append_conf('pg_hba.conf', qq( +host all all all ldap ldapserver=127.0.0.1 ldapprefix=invalid ldapbasedn=invalid +)); + +#authentication method ldap requires argument ldapbasedn, ldapprefix, or ldapsuffix to be set +$node->append_conf('pg_hba.conf', qq( +host all all all ldap ldapserver=127.0.0.1 +)); + +#auhentication method radius requires argument radiusserver to be set +$node->append_conf('pg_hba.conf', qq( +host all all all radius +)); + +#auhentication method radius requires argument radiussecret to be set +$node->append_conf('pg_hba.conf', qq( +host all all all radius radiusserver=127.0.0.1 +)); + + +# Verify all the hba rules that are added from pg_hba_rules view +my($result) = $node->safe_psql('postgres', 'select * from pg_hba_rules'); +is(scalar(split /^/m, $result), 57, 'pg_hba_rules produced 57 rows inc original rules'); + +# Stop the node +$node->stop('fast'); +