• Michael Paquier's avatar
    Fix SSL test for libpq connection parameter channel_binding · a12c75a1
    Michael Paquier authored
    When compiling Postgres with OpenSSL 1.0.1 or older versions, SCRAM's
    channel binding cannot be supported as X509_get_signature_nid() is
    needed, which causes a regression test with channel_binding='require' to
    fail as the server cannot publish SCRAM-SHA-256-PLUS as SASL mechanism
    over an SSL connection.
    
    Fix the issue by using a method similar to c3d41ccf, making the test
    result conditional.  The test passes if X509_get_signature_nid() is
    present, and when missing we test for a connection failure.  Testing a
    connection failure is more useful than skipping the test as we should
    fail the connection if channel binding is required by the client but the
    server does not support it.
    
    Reported-by: Tom Lane, Michael Paquier
    Author: Michael Paquier
    Discussion: https://postgr.es/m/20190927024457.GA8485@paquier.xyz
    Discussion: https://postgr.es/m/24857.1569775891@sss.pgh.pa.us
    a12c75a1
002_scram.pl 2.99 KB