Horton

Re: disabled SSL log_like tests

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Thomas Munro <thomas.munro@gmail.com>, Andrew Dunstan <andrew@dunslane.net>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Jacob Champion <jacob.champion@enterprisedb.com>
Date: 2025-05-08T11:20:06Z
Lists: pgsql-hackers 
> On 7 May 2025, at 23:54, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> 
> Daniel Gustafsson <daniel@yesql.se> writes:
>> I haven't looked at the test in question yet, but we do skip some SSL tests if
>> running against libressl already so I assume this will be able to follow the
>> same pattern.
> 
> Ah, thanks for the tip.  I propose the attached, which disables the
> RSA-PSS test altogether on LibreSSL, and modifies the
> intermediate-cert test to accept the result we're actually getting
> on LibreSSL.  We could revert that one if anyone can figure out
> how to make it better, but I don't wish to put any more time into
> it myself.

LGTM for now.

> +# Determine whether this build uses OpenSSL or LibreSSL. As a heuristic, the
> +# HAVE_SSL_CTX_SET_CERT_CB macro isn't defined for LibreSSL.
> +my $libressl = not check_pg_config("#define HAVE_SSL_CTX_SET_CERT_CB 1");

Longer term it would be nice to move this into SSL::Server and have the module
export a function or symbol which returns the underlying library and version,
but that's not for this patch.

> +
> +# As of 5/2025, LibreSSL doesn't actually work for RSA-PSS certificates.

Should we add a link to the relevant thread for future readers?  OpenBSD refer
to MARC for archiving which I believe is stable enough for an inclusion.

	https://marc.info/?l=libressl&m=174664225002441&w=2

--
Daniel Gustafsson

Commits

  1. Skip RSA-PSS ssl test when using LibreSSL.

  2. Ooops ... add required configure support.

  3. Hack one ssl test case to pass with current LibreSSL.

  4. Centralize ssl tests' check for whether we're using LibreSSL.

  5. Re-enable SSL connect_fails tests, and fix related race conditions.

  6. Disable unstable test cases in src/test/ssl/t/001_ssltests.pl.