From c4342c932abb6792f6c7d8528b6224ca4d5e1a84 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Wed, 1 Jul 2020 10:47:24 +0900 Subject: [PATCH] Fix removal of files generated by TAP tests for SSL 001_ssltests.pl and 002_scram.pl both generated an extra file for a client key used in the tests that were not removed. In Debian, this causes repeated builds to fail. The code refactoring done in 4dc6355 broke the cleanup done in 001_ssltests.pl, and the new tests added in 002_scram.pl via d6e612f forgot the removal of one file. While on it, fix a second issue introduced in 002_scram.pl where we use the same file name in 001 and 002 for the temporary client key whose permissions are changed in the test, as using the same file name in both tests could cause failures with parallel jobs of src/test/ssl/ if one test removes a file still needed by the second test. Reported-by: Felix Lechner Author: Daniel Gustafsson, Felix Lechner Reviewed-by: Tom Lane, Michael Paquier Discussion: https://postgr.es/m/CAFHYt543sjX=Cm_aEeoejStyP47C+Y3+Wh6WbirLXsgUMaw7iw@mail.gmail.com Backpatch-through: 13 --- src/test/ssl/t/001_ssltests.pl | 4 +++- src/test/ssl/t/002_scram.pl | 16 +++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl index a454bb0274..c0680f39d6 100644 --- a/src/test/ssl/t/001_ssltests.pl +++ b/src/test/ssl/t/001_ssltests.pl @@ -52,9 +52,11 @@ foreach my $key (@keys) # Also make a copy of that explicitly world-readable. We can't # necessarily rely on the file in the source tree having those -# permissions. +# permissions. Add it to @keys to include it in the final clean +# up phase. copy("ssl/client.key", "ssl/client_wrongperms_tmp.key"); chmod 0644, "ssl/client_wrongperms_tmp.key"; +push @keys, 'client_wrongperms'; #### Set up the server. diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl index ee6e26d732..a1ab911988 100644 --- a/src/test/ssl/t/002_scram.pl +++ b/src/test/ssl/t/002_scram.pl @@ -89,14 +89,20 @@ test_connect_fails( qr/channel binding required but not supported by server's authentication request/, "MD5 with SSL and channel_binding=require"); -# Now test with auth method 'cert' by connecting to 'certdb'. Should -# fail, because channel binding is not performed. -copy("ssl/client.key", "ssl/client_tmp.key"); -chmod 0600, "ssl/client_tmp.key"; +# Now test with auth method 'cert' by connecting to 'certdb'. Should fail, +# because channel binding is not performed. Note that ssl/client.key may +# be used in a different test, so the name of this temporary client key +# is chosen here to be unique. +my $client_tmp_key = "ssl/client_scram_tmp.key"; +copy("ssl/client.key", $client_tmp_key); +chmod 0600, $client_tmp_key; test_connect_fails( - "sslcert=ssl/client.crt sslkey=ssl/client_tmp.key hostaddr=$SERVERHOSTADDR", + "sslcert=ssl/client.crt sslkey=$client_tmp_key hostaddr=$SERVERHOSTADDR", "dbname=certdb user=ssltestuser channel_binding=require", qr/channel binding required, but server authenticated client without channel binding/, "Cert authentication and channel_binding=require"); +# clean up +unlink($client_tmp_key); + done_testing($number_of_tests);