Re: SSL tests fail on OpenSSL v3.2.0

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Michael Paquier" <michael@paquier.xyz>
Cc: "Tristan Partin" <tristan@neon.tech>, "Nazir Bilal Yavuz" <byavuz81@gmail.com>, "Andres Freund" <andres@anarazel.de>, "Bo Anderson" <mail@boanderson.me>, "pgsql-hackers" <pgsql-hackers@postgresql.org>
Date: 2023-11-28T02:04:23Z
Lists: pgsql-hackers
I can confirm that we also fail when using up-to-date MacPorts, which
seems to have started shipping 3.2.0 last week or so.  I tried the v3
patch, and while that stops the crash, it looks like 3.2.0 has also
made some random changes in error messages:

# +++ tap check in src/test/ssl +++
t/001_ssltests.pl .. 163/? 
#   Failed test 'certificate authorization fails with revoked client cert: matches'
#   at t/001_ssltests.pl line 775.
#                   'psql: error: connection to server at "127.0.0.1", port 58332 failed: SSL error: ssl/tls alert certificate revoked'
#     doesn't match '(?^:SSL error: sslv3 alert certificate revoked)'
#   Failed test 'certificate authorization fails with revoked client cert with server-side CRL directory: matches'
#   at t/001_ssltests.pl line 880.
#                   'psql: error: connection to server at "127.0.0.1", port 58332 failed: SSL error: ssl/tls alert certificate revoked'
#     doesn't match '(?^:SSL error: sslv3 alert certificate revoked)'
#   Failed test 'certificate authorization fails with revoked UTF-8 client cert with server-side CRL directory: matches'
#   at t/001_ssltests.pl line 893.
#                   'psql: error: connection to server at "127.0.0.1", port 58332 failed: SSL error: ssl/tls alert certificate revoked'
#     doesn't match '(?^:SSL error: sslv3 alert certificate revoked)'
# Looks like you failed 3 tests of 205.
t/001_ssltests.pl .. Dubious, test returned 3 (wstat 768, 0x300)
Failed 3/205 subtests 
t/002_scram.pl ..... ok    
t/003_sslinfo.pl ... ok    

Guess we'll need to adjust the test script a bit too.

			regards, tom lane



Commits

  1. Use BIO_{get,set}_app_data instead of BIO_{get,set}_data.