Skip to content

Commit 0012a43

Browse files
charmandercharmander
authored
Forward options’ ssl.key even when non-enumerable (#2394)
* Test client certificate authentication * Forward options’ ssl.key even when non-enumerable
1 parent 8bed670 commit 0012a43

12 files changed

+198
-6
lines changed

‎.travis.yml

+32
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,38 @@ matrix:
4343
postgresql: '9.5'
4444
dist: precise
4545

46+
# Run tests/paths with client certificate authentication
47+
- node_js: lts/*
48+
env:
49+
- CC=clang CXX=clang++ npm_config_clang=1 PGUSER=postgres PGDATABASE=postgres
50+
PGSSLMODE=verify-full
51+
PGSSLROOTCERT=$TRAVIS_BUILD_DIR/packages/pg/test/tls/test-server-ca.crt
52+
PGSSLCERT=$TRAVIS_BUILD_DIR/packages/pg/test/tls/test-client.crt
53+
PGSSLKEY=$TRAVIS_BUILD_DIR/packages/pg/test/tls/test-client.key
54+
PG_CLIENT_CERT_TEST=1
55+
before_script:
56+
- chmod go= packages/pg/test/tls/test-client.key
57+
- |
58+
sudo sed -i \
59+
-e '/^ssl_cert_file =/d' \
60+
-e '/^ssl_key_file =/d' \
61+
/etc/postgresql/10/main/postgresql.conf
62+
63+
cat <<'travis ci breaks heredoc' | sudo tee -a /etc/postgresql/10/main/postgresql.conf > /dev/null
64+
ssl_cert_file = 'test-server.crt'
65+
ssl_key_file = 'test-server.key'
66+
ssl_ca_file = 'test-client-ca.crt'
67+
68+
- printf 'hostssl all all %s cert\n' 127.0.0.1/32 ::1/128 | sudo tee /etc/postgresql/10/main/pg_hba.conf > /dev/null
69+
- sudo make -C packages/pg/test/tls install DESTDIR=/var/ramfs/postgresql/10/main
70+
- sudo systemctl restart postgresql@10-main
71+
- yarn build
72+
script:
73+
- cd packages/pg
74+
- node test/integration/connection-pool/tls-tests.js
75+
- npm install --no-save pg-native
76+
- node test/integration/connection-pool/tls-tests.js native
77+
4678
# different PostgreSQL versions on Node LTS
4779
- node_js: lts/erbium
4880
addons:

‎packages/pg/lib/connection.js

+12-6
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,18 @@ class Connection extends EventEmitter {
7676
return self.emit('error', new Error('There was an error establishing an SSL connection'))
7777
}
7878
var tls = require('tls')
79-
const options = Object.assign(
80-
{
81-
socket: self.stream,
82-
},
83-
self.ssl
84-
)
79+
const options = {
80+
socket: self.stream,
81+
}
82+
83+
if (self.ssl !== true) {
84+
Object.assign(options, self.ssl)
85+
86+
if ('key' in self.ssl) {
87+
options.key = self.ssl.key
88+
}
89+
}
90+
8591
if (net.isIP(host) === 0) {
8692
options.servername = host
8793
}

‎packages/pg/test/integration/connection-pool/tls-tests.js

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
'use strict'
2+
3+
const fs = require('fs')
4+
5+
const helper = require('./test-helper')
6+
const pg = helper.pg
7+
8+
const suite = new helper.Suite()
9+
10+
if (process.env.PG_CLIENT_CERT_TEST) {
11+
suite.testAsync('client certificate', async () => {
12+
const pool = new pg.Pool({
13+
ssl: {
14+
ca: fs.readFileSync(process.env.PGSSLROOTCERT),
15+
cert: fs.readFileSync(process.env.PGSSLCERT),
16+
key: fs.readFileSync(process.env.PGSSLKEY),
17+
},
18+
})
19+
20+
await pool.query('SELECT 1')
21+
await pool.end()
22+
})
23+
}

‎packages/pg/test/tls/GNUmakefile

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
DESTDIR ::= /var/lib/postgres/data
2+
POSTGRES_USER ::= postgres
3+
POSTGRES_GROUP ::= postgres
4+
DATABASE_HOST ::= localhost
5+
DATABASE_USER ::= postgres
6+
7+
all: \
8+
test-server-ca.crt \
9+
test-client-ca.crt \
10+
test-server.key \
11+
test-server.crt \
12+
test-client.key \
13+
test-client.crt
14+
15+
clean:
16+
rm -f \
17+
test-server-ca.key \
18+
test-client-ca.key \
19+
test-server-ca.crt \
20+
test-client-ca.crt \
21+
test-server.key \
22+
test-server.crt \
23+
test-client.key \
24+
test-client.crt
25+
26+
install: test-server.crt test-server.key test-client-ca.crt
27+
install \
28+
--owner=$(POSTGRES_USER) \
29+
--group=$(POSTGRES_GROUP) \
30+
--mode=0600 \
31+
-t $(DESTDIR) \
32+
$^
33+
34+
test-%-ca.crt: test-%-ca.key
35+
openssl req -new -x509 \
36+
-subj '/CN=node-postgres test $* CA' \
37+
-days 3650 \
38+
-key $< \
39+
-out $@
40+
41+
test-server.csr: test-server.key
42+
openssl req -new \
43+
-subj '/CN=$(DATABASE_HOST)' \
44+
-key $< \
45+
-out $@
46+
47+
test-client.csr: test-client.key
48+
openssl req -new \
49+
-subj '/CN=$(DATABASE_USER)' \
50+
-key $< \
51+
-out $@
52+
53+
test-%.crt: test-%.csr test-%-ca.crt test-%-ca.key
54+
openssl x509 -req \
55+
-CA test-$*-ca.crt \
56+
-CAkey test-$*-ca.key \
57+
-set_serial 1 \
58+
-days 3650 \
59+
-in $< \
60+
-out $@
61+
62+
%.key:
63+
openssl genpkey \
64+
-algorithm EC \
65+
-pkeyopt ec_paramgen_curve:prime256v1 \
66+
-out $@
67+
68+
.PHONY: all clean install
69+
.SECONDARY: test-server-ca.key test-client-ca.key
70+
.INTERMEDIATE: test-server.csr test-client.csr
71+
.POSIX:

‎packages/pg/test/tls/test-client-ca.crt

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBozCCAUmgAwIBAgIUNYMF06PrmjsMR6x+C8k5YZn9heAwCgYIKoZIzj0EAwIw
3+
JzElMCMGA1UEAwwcbm9kZS1wb3N0Z3JlcyB0ZXN0IGNsaWVudCBDQTAeFw0yMDEw
4+
MzExOTI1NDdaFw0zMDEwMjkxOTI1NDdaMCcxJTAjBgNVBAMMHG5vZGUtcG9zdGdy
5+
ZXMgdGVzdCBjbGllbnQgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASI/Efx
6+
Pq0P54VKPkTUOTwBH1iuYbnLpd4kAGjb1E334/p9CEBbDREVSqDjYjWswFybxKIF
7+
ooKXtMpEMJfymJAUo1MwUTAdBgNVHQ4EFgQU/b/FRwYZ5/VMjdesIolksiqNYK4w
8+
HwYDVR0jBBgwFoAU/b/FRwYZ5/VMjdesIolksiqNYK4wDwYDVR0TAQH/BAUwAwEB
9+
/zAKBggqhkjOPQQDAgNIADBFAiEApHFCAWGbRGqYkyiBO+gMyX6gF5oFJywUupZP
10+
LfgIRDACIDBZotzPe6+BIl2fU9Xgm7CxV6cCoX8bPEJKveKMnOaN
11+
-----END CERTIFICATE-----

‎packages/pg/test/tls/test-client-ca.key

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKsipfQWM+41FriF7
3+
kRxVaiNi8qY1fzLx6Dp/gUQQPG6hRANCAASI/EfxPq0P54VKPkTUOTwBH1iuYbnL
4+
pd4kAGjb1E334/p9CEBbDREVSqDjYjWswFybxKIFooKXtMpEMJfymJAU
5+
-----END PRIVATE KEY-----

‎packages/pg/test/tls/test-client.crt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBITCByAIBATAKBggqhkjOPQQDAjAnMSUwIwYDVQQDDBxub2RlLXBvc3RncmVz
3+
IHRlc3QgY2xpZW50IENBMB4XDTIwMTAzMTE5MjU0N1oXDTMwMTAyOTE5MjU0N1ow
4+
EzERMA8GA1UEAwwIcG9zdGdyZXMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARY
5+
4j5AgTLi/O/UTB8l1mX+nD9u3SW9RwN1mekcqEZqCpOPMsQEQ/HLxaKnoSTD6w/G
6+
NqrBnHlbMGPwEdKvV96bMAoGCCqGSM49BAMCA0gAMEUCIQDzfjm+BzmjrsIO4QRu
7+
Et0ShHBK3Kley3oqnzoJHCUSmAIgdF5gELQ5mlJVX3bAI8h1cKiC/L6awwg7eBDU
8+
S1gBTaI=
9+
-----END CERTIFICATE-----

‎packages/pg/test/tls/test-client.key

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgL9jW07+fXy/74Ub3
3+
579RXm0Xpo7lnNnQleSzkTEXCrmhRANCAARY4j5AgTLi/O/UTB8l1mX+nD9u3SW9
4+
RwN1mekcqEZqCpOPMsQEQ/HLxaKnoSTD6w/GNqrBnHlbMGPwEdKvV96b
5+
-----END PRIVATE KEY-----

‎packages/pg/test/tls/test-server-ca.crt

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBozCCAUmgAwIBAgIUD582G2ou0Lg9q7AJeAMpiQVaiPQwCgYIKoZIzj0EAwIw
3+
JzElMCMGA1UEAwwcbm9kZS1wb3N0Z3JlcyB0ZXN0IHNlcnZlciBDQTAeFw0yMDEw
4+
MzExOTI1NDdaFw0zMDEwMjkxOTI1NDdaMCcxJTAjBgNVBAMMHG5vZGUtcG9zdGdy
5+
ZXMgdGVzdCBzZXJ2ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT/jGRh
6+
FiZu96o0hfgIkep4PusTwI6P1ASFh8LgnUu2bMcIlYakQK0ap2XvCaSl9675+Lu9
7+
yNZaSZVA5LpFICXto1MwUTAdBgNVHQ4EFgQUHI1BK+6u7r9r1XhighuP2/eGcQUw
8+
HwYDVR0jBBgwFoAUHI1BK+6u7r9r1XhighuP2/eGcQUwDwYDVR0TAQH/BAUwAwEB
9+
/zAKBggqhkjOPQQDAgNIADBFAiALwBWN9pRpaGQ12G9ERACn8/6RtAoO4lI5RmaR
10+
rsTHtAIhAJxMfzNIgBAgX7vBSjHaqA08CozIctDSVag/rDlAzgy0
11+
-----END CERTIFICATE-----

‎packages/pg/test/tls/test-server-ca.key

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgyUd4vHDNrEFzfttP
3+
z+AFp3Tbyui+b3i9YDW7VqpMOIKhRANCAAT/jGRhFiZu96o0hfgIkep4PusTwI6P
4+
1ASFh8LgnUu2bMcIlYakQK0ap2XvCaSl9675+Lu9yNZaSZVA5LpFICXt
5+
-----END PRIVATE KEY-----

‎packages/pg/test/tls/test-server.crt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBITCByQIBATAKBggqhkjOPQQDAjAnMSUwIwYDVQQDDBxub2RlLXBvc3RncmVz
3+
IHRlc3Qgc2VydmVyIENBMB4XDTIwMTAzMTE5MjU0N1oXDTMwMTAyOTE5MjU0N1ow
4+
FDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
5+
4Mwi6dHeWRZ2QU19a5ykq6gJfIVJDEaJqNlWXk/5/laiGy8ScBV0YAlvk9xsfAyU
6+
YDxcQTjQkeC0bbzhdEPjNjAKBggqhkjOPQQDAgNHADBEAiB+DW/8Kg3tuoovAE+8
7+
1Pv/8OkF3MD4A1ztULkW3KJ4PwIgMn7ea3HrEQJoeSKFe1kKIgNrHftdC5kZQYj5
8+
uNXYpLo=
9+
-----END CERTIFICATE-----

‎packages/pg/test/tls/test-server.key

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgBoW9xxWBH2tHiPFk
3+
9ajPALHyw0lHAY1DF8WvHQNodx2hRANCAATgzCLp0d5ZFnZBTX1rnKSrqAl8hUkM
4+
Romo2VZeT/n+VqIbLxJwFXRgCW+T3Gx8DJRgPFxBONCR4LRtvOF0Q+M2
5+
-----END PRIVATE KEY-----

0 commit comments

Comments
 (0)