Re: pgsql: Implement channel binding tls-server-end-point for SCRAM

[Peter Eisentraut]

On 1/5/18 09:28, Michael Paquier wrote:
> In order to do things cleanly, we should make this TAP test
> conditional on the version of OpenSSL.

How about looking into pg_config.h, like in the attached patch?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

From d1c309a4c07c47f06650fd8231938e1eaed1342e Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <pete...@gmx.net>
Date: Fri, 5 Jan 2018 09:55:01 -0500
Subject: [PATCH] Fix ssl tests for when tls-server-end-point is not supported

---
 src/test/ssl/t/002_scram.pl | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 3f425e00f0..92b84e1565 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -11,6 +11,11 @@
 # This is the hostname used to connect to the server.
 my $SERVERHOSTADDR = '127.0.0.1';
 
+# Determine whether build supports tls-server-end-point.
+open my $pg_config_h, '<', '../../include/pg_config.h' or die "$!";
+my $supports_tls_server_end_point = (grep {/^#define 
HAVE_X509_GET_SIGNATURE_NID 1/} <$pg_config_h>);
+close $pg_config_h;
+
 # Allocation of base connection string shared among multiple tests.
 my $common_connstr;
 
@@ -44,10 +49,19 @@
        "SCRAM authentication with tls-unique as channel binding");
 test_connect_ok($common_connstr,
        "scram_channel_binding=''",
-       "SCRAM authentication without channel binding");
-test_connect_ok($common_connstr,
-       "scram_channel_binding=tls-server-end-point",
-       "SCRAM authentication with tls-server-end-point as channel binding");
+                               "SCRAM authentication without channel binding");
+if ($supports_tls_server_end_point)
+{
+       test_connect_ok($common_connstr,
+                                       
"scram_channel_binding=tls-server-end-point",
+                                       "SCRAM authentication with 
tls-server-end-point as channel binding");
+}
+else
+{
+       test_connect_fails($common_connstr,
+                                       
"scram_channel_binding=tls-server-end-point",
+                                       "SCRAM authentication with 
tls-server-end-point as channel binding");
+}
 test_connect_fails($common_connstr,
        "scram_channel_binding=not-exists",
        "SCRAM authentication with invalid channel binding");
-- 
2.15.1