v8-0005-Add-tests-for-sslnegotiation.patch

From c3e21363f0d15adbbd8f6a90fba0e38c36c60188 Mon Sep 17 00:00:00 2001
From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date: Wed, 10 Jan 2024 10:25:08 +0200
Subject: [PATCH v8 5/6] Add tests for sslnegotiation

Author: Heikki Linnakangas, Matthias van de Meent
---
 .../t/001_negotiate_encryption.pl             | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/src/test/libpq_encryption/t/001_negotiate_encryption.pl b/src/test/libpq_encryption/t/001_negotiate_encryption.pl
index b8646c5bc97..b8b4cd2726d 100644
--- a/src/test/libpq_encryption/t/001_negotiate_encryption.pl
+++ b/src/test/libpq_encryption/t/001_negotiate_encryption.pl
@@ -231,13 +231,13 @@ sub resolve_connection_type
 
 # First test with SSL disabled in the server
 
-# Test the cube of parameters: user, sslmode, and gssencmode
+# Test the cube of parameters: user, sslmode, sslnegotiation and gssencmode
 sub test_modes
 {
 	local $Test::Builder::Level = $Test::Builder::Level + 1;
 
 	my ($pg_node, $node_conf,
-		$test_users, $ssl_modes, $gss_modes) = @_;
+		$test_users, $ssl_modes, $ssl_negotiations, $gss_modes) = @_;
 
 	foreach my $test_user (@{$test_users})
 	{
@@ -253,13 +253,18 @@ sub test_modes
 					gssmode=>$gssencmode,
 				);
 				my $res = resolve_connection_type(\%params);
-				connect_test($pg_node, "user=$test_user sslmode=$client_mode gssencmode=$gssencmode", $res);
+				# Negotiation type doesn't matter for supported connection types
+				foreach my $negotiation (@{$ssl_negotiations})
+				{
+					connect_test($pg_node, "user=$test_user sslmode=$client_mode sslnegotiation=$negotiation gssencmode=$gssencmode", $res);
+				}
 			}
 		}
 	}
 }
 
 my $sslmodes = ['disable', 'allow', 'prefer', 'require'];
+my $sslnegotiations = ['postgres', 'direct', 'requiredirect'];
 my $gssencmodes = ['disable', 'prefer', 'require'];
 
 my $server_config = {
@@ -270,7 +275,7 @@ my $server_config = {
 note("Running tests with SSL and GSS disabled in server");
 test_modes($node, $server_config,
 		   ['testuser'],
-		   $sslmodes, $gssencmodes);
+		   $sslmodes, $sslnegotiations, $gssencmodes);
 
 # Enable SSL in the server
 SKIP:
@@ -284,7 +289,7 @@ SKIP:
 	note("Running tests with SSL enabled in server");
 	test_modes($node, $server_config,
 			   ['testuser', 'ssluser', 'nossluser'],
-			   $sslmodes, ['disable']);
+			   $sslmodes, $sslnegotiations, ['disable']);
 
 	$node->adjust_conf('postgresql.conf', 'ssl', 'off');
 	$node->reload;
@@ -306,7 +311,7 @@ SKIP:
 	note("Running tests with GSS enabled in server");
 	test_modes($node, $server_config,
 			   ['testuser', 'gssuser', 'nogssuser'],
-			   $sslmodes, $gssencmodes);
+			   $sslmodes, $sslnegotiations, $gssencmodes);
 
 	# Check that logs match the expected 'no pg_hba.conf entry' line, too, as
 	# that is not tested by test_modes.
@@ -320,6 +325,10 @@ SKIP:
 	# with no encryption.
 	connect_test($node, 'user=nogssuser sslmode=prefer gssencmode=prefer', 'plain',
 				 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+	connect_test($node, 'user=nogssuser sslmode=prefer gssencmode=prefer sslnegotiation=direct', 'plain',
+				 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
+	connect_test($node, 'user=nogssuser sslmode=prefer gssencmode=prefer sslnegotiation=requiredirect', 'plain',
+				 'no pg_hba.conf entry for host "127.0.0.1", user "nogssuser", database "postgres", GSS encryption');
 }
 
 # Server supports both SSL and GSSAPI
@@ -329,6 +338,8 @@ SKIP:
 
 	# SSL is still disabled
 	connect_test($node, 'user=testuser sslmode=prefer gssencmode=prefer', 'gss');
+	connect_test($node, 'user=testuser sslmode=prefer gssencmode=prefer sslnegotiation=direct', 'gss');
+	connect_test($node, 'user=testuser sslmode=prefer gssencmode=prefer sslnegotiation=requiredirect', 'gss');
 
 	# Enable SSL
 	$node->adjust_conf('postgresql.conf', 'ssl', 'on');
@@ -338,7 +349,7 @@ SKIP:
 	note("Running tests with both GSS and SSL enabled in server");
 	test_modes($node, $server_config,
 			   ['testuser', 'gssuser', 'ssluser', 'nogssuser', 'nossluser'],
-			   $sslmodes, $gssencmodes);
+			   $sslmodes, $sslnegotiations, $gssencmodes);
 
 	# Test case that server supports GSSAPI, but it's not allowed for
 	# this user. Special cased because we check output
-- 
2.39.2