Re: disabled SSL log_like tests - Mailing list pgsql-hackers

Daniel Gustafsson <daniel@yesql.se> writes:
> I haven't looked at the test in question yet, but we do skip some SSL tests if
> running against libressl already so I assume this will be able to follow the
> same pattern.

Ah, thanks for the tip.  I propose the attached, which disables the
RSA-PSS test altogether on LibreSSL, and modifies the
intermediate-cert test to accept the result we're actually getting
on LibreSSL.  We could revert that one if anyone can figure out
how to make it better, but I don't wish to put any more time into
it myself.

            regards, tom lane

diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index 8b0de2d8e7e..ccf8ef9bf2e 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -895,14 +895,30 @@ switch_server_cert(

 # intermediate CA is provided but doesn't have a trusted root (checks error
 # logging for cert chain depths > 0)
-$node->connect_fails(
-    "$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",
-    "intermediate client certificate is untrusted",
-    expected_stderr => qr/SSL error: tlsv1 alert unknown ca/,
-    log_like => [
-        qr{Client certificate verification failed at depth 1: unable to get local issuer certificate},
-        qr{Failed certificate data \(unverified\): subject "/CN=Test CA for PostgreSQL SSL regression test client
certs",serial number \d+, issuer "/CN=Test root CA for PostgreSQL SSL regression test suite"}, 
-    ]);
+# As of 5/2025, LibreSSL reports a different cert as being at fault;
+# it's probably wrong, but seems to be their bug not ours
+if (!$libressl)
+{
+    $node->connect_fails(
+        "$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",
+        "intermediate client certificate is untrusted",
+        expected_stderr => qr/SSL error: tlsv1 alert unknown ca/,
+        log_like => [
+            qr{Client certificate verification failed at depth 1: unable to get local issuer certificate},
+            qr{Failed certificate data \(unverified\): subject "/CN=Test CA for PostgreSQL SSL regression test client
certs",serial number \d+, issuer "/CN=Test root CA for PostgreSQL SSL regression test suite"}, 
+        ]);
+}
+else
+{
+    $node->connect_fails(
+        "$common_connstr sslmode=require sslcert=ssl/client+client_ca.crt",
+        "intermediate client certificate is untrusted",
+        expected_stderr => qr/SSL error: tlsv1 alert unknown ca/,
+        log_like => [
+            qr{Client certificate verification failed at depth 1: unable to get local issuer certificate},
+            qr{Failed certificate data \(unverified\): subject "/CN=ssltestuser", serial number \d+, issuer "/CN=Test
CAfor PostgreSQL SSL regression test client certs"}, 
+        ]);
+}

 # test server-side CRL directory
 switch_server_cert(
diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 9e4947f4e3c..73d45909e31 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -49,6 +49,13 @@ my $SERVERHOSTCIDR = '127.0.0.1/32';
 my $supports_rsapss_certs =
   check_pg_config("#define HAVE_X509_GET_SIGNATURE_INFO 1");

+# Determine whether this build uses OpenSSL or LibreSSL. As a heuristic, the
+# HAVE_SSL_CTX_SET_CERT_CB macro isn't defined for LibreSSL.
+my $libressl = not check_pg_config("#define HAVE_SSL_CTX_SET_CERT_CB 1");
+
+# As of 5/2025, LibreSSL doesn't actually work for RSA-PSS certificates.
+$supports_rsapss_certs = 0 if $libressl;
+
 # Allocation of base connection string shared among multiple tests.
 my $common_connstr;