|
|
@ -7,7 +7,15 @@ use strict; |
|
|
|
use warnings; |
|
|
|
use warnings; |
|
|
|
use PostgresNode; |
|
|
|
use PostgresNode; |
|
|
|
use TestLib; |
|
|
|
use TestLib; |
|
|
|
use Test::More tests => 12; |
|
|
|
use Test::More; |
|
|
|
|
|
|
|
if ($windows_os) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
plan skip_all => "authentication tests cannot run on Windows"; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
else |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
plan tests => 12; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
# Delete pg_hba.conf from the given node, add a new entry to it |
|
|
|
# Delete pg_hba.conf from the given node, add a new entry to it |
|
|
|
# and then execute a reload to refresh it. |
|
|
|
# and then execute a reload to refresh it. |
|
|
@ -38,62 +46,57 @@ sub test_login |
|
|
|
"authentication $status_string for role $role with password $password"); |
|
|
|
"authentication $status_string for role $role with password $password"); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
SKIP: |
|
|
|
# Initialize master node. Force UTF-8 encoding, so that we can use non-ASCII |
|
|
|
{ |
|
|
|
# characters in the passwords below. |
|
|
|
skip "authentication tests cannot run on Windows", 12 if ($windows_os); |
|
|
|
my $node = get_new_node('master'); |
|
|
|
|
|
|
|
$node->init(extra => ['--locale=C', '--encoding=UTF8']); |
|
|
|
|
|
|
|
$node->start; |
|
|
|
|
|
|
|
|
|
|
|
# Initialize master node. Force UTF-8 encoding, so that we can use non-ASCII |
|
|
|
# These tests are based on the example strings from RFC4013.txt, |
|
|
|
# characters in the passwords below. |
|
|
|
# Section "3. Examples": |
|
|
|
my $node = get_new_node('master'); |
|
|
|
# |
|
|
|
$node->init(extra => ['--locale=C', '--encoding=UTF8']); |
|
|
|
# # Input Output Comments |
|
|
|
$node->start; |
|
|
|
# - ----- ------ -------- |
|
|
|
|
|
|
|
# 1 I<U+00AD>X IX SOFT HYPHEN mapped to nothing |
|
|
|
# These tests are based on the example strings from RFC4013.txt, |
|
|
|
# 2 user user no transformation |
|
|
|
# Section "3. Examples": |
|
|
|
# 3 USER USER case preserved, will not match #2 |
|
|
|
# |
|
|
|
# 4 <U+00AA> a output is NFKC, input in ISO 8859-1 |
|
|
|
# # Input Output Comments |
|
|
|
# 5 <U+2168> IX output is NFKC, will match #1 |
|
|
|
# - ----- ------ -------- |
|
|
|
# 6 <U+0007> Error - prohibited character |
|
|
|
# 1 I<U+00AD>X IX SOFT HYPHEN mapped to nothing |
|
|
|
# 7 <U+0627><U+0031> Error - bidirectional check |
|
|
|
# 2 user user no transformation |
|
|
|
|
|
|
|
# 3 USER USER case preserved, will not match #2 |
|
|
|
# Create test roles. |
|
|
|
# 4 <U+00AA> a output is NFKC, input in ISO 8859-1 |
|
|
|
$node->safe_psql('postgres', |
|
|
|
# 5 <U+2168> IX output is NFKC, will match #1 |
|
|
|
|
|
|
|
# 6 <U+0007> Error - prohibited character |
|
|
|
|
|
|
|
# 7 <U+0627><U+0031> Error - bidirectional check |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Create test roles. |
|
|
|
|
|
|
|
$node->safe_psql('postgres', |
|
|
|
|
|
|
|
"SET password_encryption='scram-sha-256'; |
|
|
|
"SET password_encryption='scram-sha-256'; |
|
|
|
SET client_encoding='utf8'; |
|
|
|
SET client_encoding='utf8'; |
|
|
|
CREATE ROLE saslpreptest1_role LOGIN PASSWORD 'IX'; |
|
|
|
CREATE ROLE saslpreptest1_role LOGIN PASSWORD 'IX'; |
|
|
|
CREATE ROLE saslpreptest4a_role LOGIN PASSWORD 'a'; |
|
|
|
CREATE ROLE saslpreptest4a_role LOGIN PASSWORD 'a'; |
|
|
|
CREATE ROLE saslpreptest4b_role LOGIN PASSWORD E'\\xc2\\xaa'; |
|
|
|
CREATE ROLE saslpreptest4b_role LOGIN PASSWORD E'\\xc2\\xaa'; |
|
|
|
CREATE ROLE saslpreptest6_role LOGIN PASSWORD E'foo\\x07bar'; |
|
|
|
CREATE ROLE saslpreptest6_role LOGIN PASSWORD E'foo\\x07bar'; |
|
|
|
CREATE ROLE saslpreptest7_role LOGIN PASSWORD E'foo\\u0627\\u0031bar'; |
|
|
|
CREATE ROLE saslpreptest7_role LOGIN PASSWORD E'foo\\u0627\\u0031bar'; |
|
|
|
"); |
|
|
|
"); |
|
|
|
|
|
|
|
|
|
|
|
# Require password from now on. |
|
|
|
# Require password from now on. |
|
|
|
reset_pg_hba($node, 'scram-sha-256'); |
|
|
|
reset_pg_hba($node, 'scram-sha-256'); |
|
|
|
|
|
|
|
|
|
|
|
# Check that #1 and #5 are treated the same as just 'IX' |
|
|
|
# Check that #1 and #5 are treated the same as just 'IX' |
|
|
|
test_login($node, 'saslpreptest1_role', "I\xc2\xadX", 0); |
|
|
|
test_login($node, 'saslpreptest1_role', "I\xc2\xadX", 0); |
|
|
|
test_login($node, 'saslpreptest1_role', "\xe2\x85\xa8", 0); |
|
|
|
test_login($node, 'saslpreptest1_role', "\xe2\x85\xa8", 0); |
|
|
|
|
|
|
|
|
|
|
|
# but different from lower case 'ix' |
|
|
|
# but different from lower case 'ix' |
|
|
|
test_login($node, 'saslpreptest1_role', "ix", 2); |
|
|
|
test_login($node, 'saslpreptest1_role', "ix", 2); |
|
|
|
|
|
|
|
|
|
|
|
# Check #4 |
|
|
|
# Check #4 |
|
|
|
test_login($node, 'saslpreptest4a_role', "a", 0); |
|
|
|
test_login($node, 'saslpreptest4a_role', "a", 0); |
|
|
|
test_login($node, 'saslpreptest4a_role', "\xc2\xaa", 0); |
|
|
|
test_login($node, 'saslpreptest4a_role', "\xc2\xaa", 0); |
|
|
|
test_login($node, 'saslpreptest4b_role', "a", 0); |
|
|
|
test_login($node, 'saslpreptest4b_role', "a", 0); |
|
|
|
test_login($node, 'saslpreptest4b_role', "\xc2\xaa", 0); |
|
|
|
test_login($node, 'saslpreptest4b_role', "\xc2\xaa", 0); |
|
|
|
|
|
|
|
|
|
|
|
# Check #6 and #7 - In PostgreSQL, contrary to the spec, if the password |
|
|
|
# Check #6 and #7 - In PostgreSQL, contrary to the spec, if the password |
|
|
|
# contains prohibited characters, we use it as is, without normalization. |
|
|
|
# contains prohibited characters, we use it as is, without normalization. |
|
|
|
test_login($node, 'saslpreptest6_role', "foo\x07bar", 0); |
|
|
|
test_login($node, 'saslpreptest6_role', "foo\x07bar", 0); |
|
|
|
test_login($node, 'saslpreptest6_role', "foobar", 2); |
|
|
|
test_login($node, 'saslpreptest6_role', "foobar", 2); |
|
|
|
|
|
|
|
|
|
|
|
test_login($node, 'saslpreptest7_role', "foo\xd8\xa71bar", 0); |
|
|
|
test_login($node, 'saslpreptest7_role', "foo\xd8\xa71bar", 0); |
|
|
|
test_login($node, 'saslpreptest7_role', "foo1\xd8\xa7bar", 2); |
|
|
|
test_login($node, 'saslpreptest7_role', "foo1\xd8\xa7bar", 2); |
|
|
|
test_login($node, 'saslpreptest7_role', "foobar", 2); |
|
|
|
test_login($node, 'saslpreptest7_role', "foobar", 2); |
|
|
|
} |
|
|
|
|
|
|
|