Re: pgsql: Implement channel binding tls-server-end-point for SCRAM

[Michael Paquier]

On Sat, Jan 06, 2018 at 09:10:51AM +0900, Michael Paquier wrote:
> On Sat, Jan 6, 2018 at 2:56 AM, Alvaro Herrera <alvhe...@alvh.no-ip.org> 
> wrote:
> Good idea as a whole, but I don't think this is the right approach. As
> we include $(bindir) in PATH when running the prove command, why not
> getting the include path from "pg_config --includedir"?

So, I have been looking at that, and I propose the following
counter-patch which implements this idea by adding a new routine as
TestLib::config_check which is able to check within pg_config.h if a
given regexp matches or not for the installation on which TAP tests are
being run. I have tested with Postgres compiled with both OpenSSL 1.0.1
and 1.0.2, in which case the connection test respectively fails and
passes, causing the test to be correctly handled. This is based on
Peter's patch upthread.
--
Michael

diff --git a/src/test/perl/TestLib.pm b/src/test/perl/TestLib.pm
index 72826d5bad..c49b4336c1 100644
--- a/src/test/perl/TestLib.pm
+++ b/src/test/perl/TestLib.pm
@@ -26,6 +26,7 @@ our @EXPORT = qw(
   slurp_dir
   slurp_file
   append_to_file
+  config_check
   system_or_bail
   system_log
   run_log
@@ -221,6 +222,27 @@ sub append_to_file
        close $fh;
 }
 
+# Check presence of a given regexp within pg_config.h for the installation
+# where tests are running, returning a match status result depending on
+# that.
+sub config_check
+{
+       my ($regexp) = @_;
+       my ($stdout, $stderr);
+       my $result = IPC::Run::run [ 'pg_config', '--includedir' ], '>',
+               \$stdout, '2>', \$stderr;
+
+       print("# Checking for match with expression \"$regexp\" in 
pg_config.h\n");
+
+       die "could not execute pg_config" if $result != 1;
+       chomp($stdout);
+
+       open my $pg_config_h, '<', "$stdout/pg_config.h" or die "$!";
+       my $match = (grep {/^$regexp/} <$pg_config_h>);
+       close $pg_config_h;
+       return $match;
+}
+
 #
 # Test functions
 #
diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 3f425e00f0..73c8f7adf2 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -11,6 +11,10 @@ use File::Copy;
 # This is the hostname used to connect to the server.
 my $SERVERHOSTADDR = '127.0.0.1';
 
+# Determine whether build supports tls-server-end-point.
+my $supports_tls_server_end_point =
+       TestLib::config_check("#define HAVE_X509_GET_SIGNATURE_NID 1");
+
 # Allocation of base connection string shared among multiple tests.
 my $common_connstr;
 
@@ -44,10 +48,19 @@ test_connect_ok($common_connstr,
        "SCRAM authentication with tls-unique as channel binding");
 test_connect_ok($common_connstr,
        "scram_channel_binding=''",
-       "SCRAM authentication without channel binding");
-test_connect_ok($common_connstr,
-       "scram_channel_binding=tls-server-end-point",
-       "SCRAM authentication with tls-server-end-point as channel binding");
+                               "SCRAM authentication without channel binding");
+if ($supports_tls_server_end_point)
+{
+       test_connect_ok($common_connstr,
+                                       
"scram_channel_binding=tls-server-end-point",
+                                       "SCRAM authentication with 
tls-server-end-point as channel binding");
+}
+else
+{
+       test_connect_fails($common_connstr,
+                                       
"scram_channel_binding=tls-server-end-point",
+                                       "SCRAM authentication with 
tls-server-end-point as channel binding");
+}
 test_connect_fails($common_connstr,
        "scram_channel_binding=not-exists",
        "SCRAM authentication with invalid channel binding");

signature.asc
Description: PGP signature