Horton

Re: disabled SSL log_like tests

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Thomas Munro <thomas.munro@gmail.com>, Andrew Dunstan <andrew@dunslane.net>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Jacob Champion <jacob.champion@enterprisedb.com>
Date: 2025-05-09T07:24:57Z
Lists: pgsql-hackers 
> On 9 May 2025, at 02:15, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Daniel Gustafsson <daniel@yesql.se> writes:

>> If we were to end up with a
>> Libressl libtls implementation in libpq we'd still have to test with Libressl
>> against the OpenSSL compat layer in libssl since it could act as both.  Not a
>> bridge we have to cross today but might be worth at least keeping in mind when
>> designing something to not make it impossible in the future.
> 
> Right.  I think the attached would be amenable to that.

It will be a bit awkward to ask "are you libressl" if we ever add support for
something not OpenSSL based, but we could always revisit should that happen.

> Further down the road, it seems inevitable that we'll need to have a
> way of detecting the SSL library version --- for example, assuming
> the LibreSSL folk eventually fix their RSA-PSS code, we'll need a
> version-dependent test.  That could be another new backend method,
> I guess.

Agreed.

--
Daniel Gustafsson

Commits

  1. Skip RSA-PSS ssl test when using LibreSSL.

  2. Ooops ... add required configure support.

  3. Hack one ssl test case to pass with current LibreSSL.

  4. Centralize ssl tests' check for whether we're using LibreSSL.

  5. Re-enable SSL connect_fails tests, and fix related race conditions.

  6. Disable unstable test cases in src/test/ssl/t/001_ssltests.pl.