🌐 AI搜索 & 代理 主页
Skip to content

Commit b4c4a00

Browse files
danielgustafssondanielgustafsson
committed
Refactor the sslfiles Makefile target for ease of use
The Makefile handling of certificate and keypairs used for TLS testing had become quite difficult to work with. Adding a new cert without the need to regenerate everything was too complicated. This patch refactors the sslfiles make target such that adding a new certificate requires only adding a .config file, adding it to the top of the Makefile, and running make sslfiles. Improvements: - Interfile dependencies should be fixed, with the exception of the CRL dirs. - New certificates have serial numbers based on the current time, reducing the chance of collision. - The CA index state is created on demand and cleaned up automatically at the end of the Make run. - *.config files are now self-contained; one certificate needs one config file instead of two. - Duplication is reduced, and along with it some unneeded code (and possible copy-paste errors). - all configuration files underneath the conf/ directory. The target is moved to its own makefile in order to avoid colliding with global make settings. Author: Jacob Champion <pchampion@vmware.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Discussion: https://postgr.es/m/d15a9838344ba090e09fd866abf913584ea19fb7.camel@vmware.com
1 parent 3e310d8 commit b4c4a00

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+778
-652
lines changed

‎src/test/ssl/Makefile‎

Lines changed: 7 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -15,170 +15,17 @@ include $(top_builddir)/src/Makefile.global
1515

1616
export with_ssl
1717

18-
CERTIFICATES := server_ca server-cn-and-alt-names \
19-
server-cn-only server-single-alt-name server-multiple-alt-names \
20-
server-no-names server-revoked \
21-
client_ca client client-dn client-revoked \
22-
root_ca
23-
24-
SSLFILES := $(CERTIFICATES:%=ssl/%.key) $(CERTIFICATES:%=ssl/%.crt) \
25-
ssl/server-password.key \
26-
ssl/client.crl ssl/server.crl ssl/root.crl \
27-
ssl/both-cas-1.crt ssl/both-cas-2.crt \
28-
ssl/root+server_ca.crt ssl/root+server.crl \
29-
ssl/root+client_ca.crt ssl/root+client.crl \
30-
ssl/client+client_ca.crt ssl/client-der.key \
31-
ssl/client-encrypted-pem.key ssl/client-encrypted-der.key
32-
33-
SSLDIRS := ssl/client-crldir ssl/server-crldir \
34-
ssl/root+client-crldir ssl/root+server-crldir
35-
36-
# This target re-generates all the key and certificate files. Usually we just
37-
# use the ones that are committed to the tree without rebuilding them.
38-
#
39-
# This target will fail unless preceded by sslfiles-clean.
40-
#
41-
sslfiles: $(SSLFILES) $(SSLDIRS)
42-
43-
# OpenSSL requires a directory to put all generated certificates in. We don't
44-
# use this for anything, but we need a location.
45-
ssl/new_certs_dir:
46-
mkdir ssl/new_certs_dir
47-
48-
# Rule for creating private/public key pairs.
49-
ssl/%.key:
50-
openssl genrsa -out $@ 2048
51-
chmod 0600 $@
52-
53-
# Root CA certificate
54-
ssl/root_ca.crt: ssl/root_ca.key cas.config
55-
touch ssl/root_ca-certindex
56-
openssl req -new -out ssl/root_ca.crt -x509 -config cas.config -config root_ca.config -key ssl/root_ca.key -days 10000 -extensions v3_ca
57-
echo "01" > ssl/root_ca.srl
58-
59-
# Client and server CAs
60-
ssl/%_ca.crt: ssl/%_ca.key %_ca.config ssl/root_ca.crt ssl/new_certs_dir
61-
touch ssl/$*_ca-certindex
62-
echo "unique_subject=no" > ssl/$*_ca-certindex.attr
63-
openssl req -new -out ssl/temp_ca.crt -config cas.config -config $*_ca.config -key ssl/$*_ca.key
64-
# Sign the certificate with the root CA
65-
openssl ca -name root_ca -batch -config cas.config -in ssl/temp_ca.crt -out ssl/temp_ca_signed.crt -extensions v3_ca
66-
openssl x509 -in ssl/temp_ca_signed.crt -out ssl/$*_ca.crt # to keep just the PEM cert
67-
rm ssl/temp_ca.crt ssl/temp_ca_signed.crt
68-
echo "01" > ssl/$*_ca.srl
69-
70-
# Server certificates, signed by server CA:
71-
ssl/server-%.crt: ssl/server-%.key ssl/server_ca.crt server-%.config
72-
openssl req -new -key ssl/server-$*.key -out ssl/server-$*.csr -config server-$*.config
73-
openssl ca -name server_ca -batch -config cas.config -in ssl/server-$*.csr -out ssl/temp.crt -extensions v3_req -extfile server-$*.config
74-
openssl x509 -in ssl/temp.crt -out ssl/server-$*.crt # to keep just the PEM cert
75-
rm ssl/server-$*.csr
76-
77-
# Password-protected version of server-cn-only.key
78-
ssl/server-password.key: ssl/server-cn-only.key
79-
openssl rsa -aes256 -in $< -out $@ -passout 'pass:secret1'
80-
81-
# Client certificate, signed by the client CA:
82-
ssl/client.crt: ssl/client.key ssl/client_ca.crt
83-
openssl req -new -key ssl/client.key -out ssl/client.csr -config client.config
84-
openssl ca -name client_ca -batch -out ssl/temp.crt -config cas.config -infiles ssl/client.csr
85-
openssl x509 -in ssl/temp.crt -out ssl/client.crt # to keep just the PEM cert
86-
rm ssl/client.csr ssl/temp.crt
87-
88-
# Client certificate with multi-part DN, signed by the client CA:
89-
ssl/client-dn.crt: ssl/client-dn.key ssl/client_ca.crt
90-
openssl req -new -key ssl/client-dn.key -out ssl/client-dn.csr -config client-dn.config
91-
openssl ca -name client_ca -batch -out ssl/temp.crt -config cas.config -infiles ssl/client-dn.csr
92-
openssl x509 -in ssl/temp.crt -out ssl/client-dn.crt # to keep just the PEM cert
93-
rm ssl/client-dn.csr ssl/temp.crt
94-
95-
# Another client certificate, signed by the client CA. This one is revoked.
96-
ssl/client-revoked.crt: ssl/client-revoked.key ssl/client_ca.crt client.config
97-
openssl req -new -key ssl/client-revoked.key -out ssl/client-revoked.csr -config client.config
98-
openssl ca -name client_ca -batch -out ssl/temp.crt -config cas.config -infiles ssl/client-revoked.csr
99-
openssl x509 -in ssl/temp.crt -out ssl/client-revoked.crt # to keep just the PEM cert
100-
rm ssl/client-revoked.csr ssl/temp.crt
101-
102-
# Convert the key to DER, to test our behaviour there too
103-
ssl/client-der.key: ssl/client.key
104-
openssl rsa -in ssl/client.key -outform DER -out ssl/client-der.key
105-
106-
# Convert the existing key to encrypted PEM (X.509 text) and DER (X.509 ASN.1) formats
107-
# to test libpq's support for the sslpassword= option.
108-
ssl/client-encrypted-pem.key: ssl/client.key
109-
openssl rsa -in ssl/client.key -outform PEM -aes128 -passout 'pass:dUmmyP^#+' -out ssl/client-encrypted-pem.key
110-
111-
ssl/client-encrypted-der.key: ssl/client.key
112-
openssl rsa -in ssl/client.key -outform DER -aes128 -passout 'pass:dUmmyP^#+' -out ssl/client-encrypted-der.key
113-
114-
# Root certificate files that contains both CA certificates, for testing
115-
# that multiple certificates can be used.
116-
ssl/both-cas-1.crt: ssl/root_ca.crt ssl/client_ca.crt ssl/server_ca.crt
117-
cat $^ > $@
118-
119-
# The same, but the certs are in different order
120-
ssl/both-cas-2.crt: ssl/root_ca.crt ssl/server_ca.crt ssl/client_ca.crt
121-
cat $^ > $@
122-
123-
# A root certificate file for the client, to validate server certs.
124-
ssl/root+server_ca.crt: ssl/root_ca.crt ssl/server_ca.crt
125-
cat $^ > $@
126-
127-
# and for the server, to validate client certs
128-
ssl/root+client_ca.crt: ssl/root_ca.crt ssl/client_ca.crt
129-
cat $^ > $@
130-
131-
ssl/client+client_ca.crt: ssl/client.crt ssl/client_ca.crt
132-
cat $^ > $@
133-
134-
#### CRLs
135-
136-
ssl/client.crl: ssl/client-revoked.crt
137-
openssl ca -config cas.config -name client_ca -revoke ssl/client-revoked.crt
138-
openssl ca -config cas.config -name client_ca -gencrl -out ssl/client.crl
139-
140-
ssl/server.crl: ssl/server-revoked.crt
141-
openssl ca -config cas.config -name server_ca -revoke ssl/server-revoked.crt
142-
openssl ca -config cas.config -name server_ca -gencrl -out ssl/server.crl
143-
144-
ssl/root.crl: ssl/root_ca.crt
145-
openssl ca -config cas.config -name root_ca -gencrl -out ssl/root.crl
146-
147-
# If a CRL is used, OpenSSL requires a CRL file for *all* the CAs in the
148-
# chain, even if some of them are empty.
149-
ssl/root+server.crl: ssl/root.crl ssl/server.crl
150-
cat $^ > $@
151-
ssl/root+client.crl: ssl/root.crl ssl/client.crl
152-
cat $^ > $@
153-
154-
ssl/root+server-crldir: ssl/server.crl ssl/root.crl
155-
mkdir ssl/root+server-crldir
156-
cp ssl/server.crl ssl/root+server-crldir/`openssl crl -hash -noout -in ssl/server.crl`.r0
157-
cp ssl/root.crl ssl/root+server-crldir/`openssl crl -hash -noout -in ssl/root.crl`.r0
158-
159-
ssl/root+client-crldir: ssl/client.crl ssl/root.crl
160-
mkdir ssl/root+client-crldir
161-
cp ssl/client.crl ssl/root+client-crldir/`openssl crl -hash -noout -in ssl/client.crl`.r0
162-
cp ssl/root.crl ssl/root+client-crldir/`openssl crl -hash -noout -in ssl/root.crl`.r0
163-
164-
ssl/server-crldir: ssl/server.crl
165-
mkdir ssl/server-crldir
166-
cp ssl/server.crl ssl/server-crldir/`openssl crl -hash -noout -in ssl/server.crl`.r0
167-
168-
ssl/client-crldir: ssl/client.crl
169-
mkdir ssl/client-crldir
170-
cp ssl/client.crl ssl/client-crldir/`openssl crl -hash -noout -in ssl/client.crl`.r0
171-
172-
.PHONY: sslfiles-clean
173-
sslfiles-clean:
174-
rm -f $(SSLFILES) ssl/client_ca.srl ssl/server_ca.srl ssl/client_ca-certindex* ssl/server_ca-certindex* ssl/root_ca-certindex* ssl/root_ca.srl ssl/temp_ca.crt ssl/temp_ca_signed.crt
175-
rm -rf $(SSLDIRS)
18+
# The sslfiles targets are separated into their own file due to interactions
19+
# with settings in Makefile.global.
20+
.PHONY: sslfiles sslfiles-clean
21+
sslfiles sslfiles-clean:
22+
$(MAKE) -f sslfiles.mk $@
17623

17724
clean distclean maintainer-clean:
17825
rm -rf tmp_check
179-
rm -rf ssl/*.old ssl/new_certs_dir ssl/client*_tmp.key
26+
$(MAKE) -f sslfiles.mk $@
18027

181-
# Doesn't depend on $(SSLFILES) because we don't rebuild them by default
28+
# Doesn't depend on sslfiles because we don't rebuild them by default
18229
check:
18330
$(prove_check)
18431

‎src/test/ssl/README‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,9 @@ There are also CRLs for each of the CAs: root.crl, server.crl and client.crl.
8585

8686
For convenience, all of these keypairs and certificates are included in the
8787
ssl/ subdirectory. The Makefile also contains a rule, "make sslfiles", to
88-
recreate them if you need to make changes.
88+
recreate them if you need to make changes. "make sslfiles-clean" is required
89+
in order to recreate the full set of keypairs and certificates. To rebuild
90+
separate files, touch (or remove) the files in question and run "make sslfiles".
8991

9092
TODO
9193
====

src/test/ssl/cas.config renamed to src/test/ssl/conf/cas.config

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,5 @@
11
# This file contains the configuration for all the CAs.
22

3-
[ req ]
4-
prompt = no
5-
6-
# Extensions for CA certs
7-
[ v3_ca ]
8-
basicConstraints = CA:true
9-
103
# Root CA, used to sign the certificates of the intermediary server and
114
# client CAs.
125
[ root_ca ]
@@ -21,6 +14,7 @@ private_key = ./ssl/root_ca.key
2114
new_certs_dir = ./ssl/new_certs_dir
2215
policy = policy_match
2316
email_in_dn = no
17+
copy_extensions = copy
2418

2519
# CA used to sign all the server certificates.
2620
[ server_ca ]
@@ -35,6 +29,7 @@ new_certs_dir = ./ssl/new_certs_dir
3529
serial = ./ssl/server_ca.srl
3630
policy = policy_match
3731
email_in_dn = no
32+
copy_extensions = copy
3833
unique_subject = no
3934
crl = ./ssl/server.crl
4035

@@ -51,6 +46,7 @@ new_certs_dir = ./ssl/new_certs_dir
5146
serial = ./ssl/client_ca.srl
5247
policy = policy_match
5348
email_in_dn = no
49+
copy_extensions = copy
5450
unique_subject = no
5551
crl = ./ssl/client.crl
5652

src/test/ssl/client-dn.config renamed to src/test/ssl/conf/client-dn.config

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,3 @@ O = PGDG
1313
CN = ssltestuser-dn
1414

1515
# no extensions in client certs
16-
[ v3_req ]

‎src/test/ssl/conf/client-revoked.config‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# An OpenSSL format CSR config file for creating a client certificate.
2+
#
3+
# This is identical to the client.config certificate, but this one is revoked
4+
# later.
5+
6+
[ req ]
7+
distinguished_name = req_distinguished_name
8+
prompt = no
9+
10+
[ req_distinguished_name ]
11+
CN = ssltestuser
12+
13+
# no extensions in client certs

src/test/ssl/client.config renamed to src/test/ssl/conf/client.config

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,3 @@ prompt = no
1010
CN = ssltestuser
1111

1212
# no extensions in client certs
13-
[ v3_req ]

src/test/ssl/client_ca.config renamed to src/test/ssl/conf/client_ca.config

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@
66
[ req ]
77
distinguished_name = req_distinguished_name
88
prompt = no
9+
req_extensions = v3_ca
910

1011
[ req_distinguished_name ]
1112
CN = Test CA for PostgreSQL SSL regression test client certs
13+
14+
# Extensions for CA certs
15+
[ v3_ca ]
16+
basicConstraints = CA:true

src/test/ssl/root_ca.config renamed to src/test/ssl/conf/root_ca.config

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
[ req ]
55
distinguished_name = req_distinguished_name
66
prompt = no
7+
x509_extensions = v3_ca
78

89
[ req_distinguished_name ]
910
CN = Test root CA for PostgreSQL SSL regression test suite

src/test/ssl/server-cn-and-alt-names.config renamed to src/test/ssl/conf/server-cn-and-alt-names.config

File renamed without changes.

src/test/ssl/server-cn-only.config renamed to src/test/ssl/conf/server-cn-only.config

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,4 @@ prompt = no
99
CN = common-name.pg-ssltest.test
1010
OU = PostgreSQL test suite
1111

12-
# For Subject Alternative Names
13-
[ v3_req ]
12+
# No Subject Alternative Names

0 commit comments

Comments
 (0)