rpms/postgresql16
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add SSL test coverage for PQC-compatible TLS group negotiation

Browse Source 
Backport tests from upstream commit 3d1ef3a15c3 (adapted for PG16):
- Test that invalid ssl_ecdh_curve values (colon-separated) are rejected
- Test that valid colon-separated groups are accepted
- Add multi-group configuration to SSL test infrastructure

Resolves: RHEL-119229
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Filip Janus 2026-07-20 22:06:26 +02:00
parent 95905e59ff
commit 26e4a6eda4
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
postgresql-pqc-ssl-groups-tests.patch Normal file
View File

@ -0,0 +1,37 @@
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -120,6 +120,22 @@
command_ok(
[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
'restart succeeds with correct SSL protocol bounds');
+
+# Test parsing colon-separated groups in ssl_ecdh_curve. Writing to
+# sslconfig.conf ensures these values get overwritten by the next call to
+# switch_server_cert (which truncates and rewrites sslconfig.conf).
+$node->append_conf('sslconfig.conf', qq{ssl_ecdh_curve='bad:value'});
+my $log_size = -s $node->logfile;
+command_fails(
+ [ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
+ 'restart fails with incorrect ECDH groups');
+ok( $node->log_contains(
+ qr/ECDH: could not set group names from ssl_ecdh_curve/, $log_size),
+ 'error message mentions ssl_ecdh_curve');
+$node->append_conf('sslconfig.conf', qq{ssl_ecdh_curve='prime256v1'});
+command_ok(
+ [ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
+ 'restart succeeds after correcting ssl_ecdh_curve');
### Run client-side tests.
###
--- a/src/test/ssl/t/SSL/Server.pm
+++ b/src/test/ssl/t/SSL/Server.pm
@@ -299,6 +299,8 @@
open my $sslconf, '>', "$pgdata/sslconfig.conf";
print $sslconf "ssl=on\n";
print $sslconf $backend->set_server_cert(\%params);
+ # use lists of ECDH curves for syntax testing
+ print $sslconf "ssl_ecdh_curve='prime256v1:secp521r1'\n";
print $sslconf "ssl_passphrase_command='"
. $params{passphrase_cmd} . "'\n"
if defined $params{passphrase_cmd};

9
postgresql16.spec
View File

@ -48,7 +48,7 @@
Summary: PostgreSQL client programs
Name: %{majorname}%{majorversion}
Version: %{majorversion}.14
Release: 2%{?dist}
Release: 3%{?dist}
# The PostgreSQL license is very similar to other MIT licenses, but the OSI
# recognizes it as an independent license, so we do as well.
@ -96,6 +96,7 @@ Patch9: postgresql-server-pg_config.patch
Patch10: postgresql-datalayout-mismatch-on-s390.patch
Patch12: postgresql-no-libecpg.patch
Patch13: postgresql-pqc-ssl-groups-v2.patch
Patch14: postgresql-pqc-ssl-groups-tests.patch
# This macro is used for package names in the files section
%if %?postgresql_default
@ -522,6 +523,7 @@ goal of accelerating analytics queries.
%patch 9 -p1
%patch 10 -p1
%patch 13 -p1
%patch 14 -p1
%if ! %external_libpq
@ -1352,6 +1354,11 @@ make -C postgresql-setup-%{setup_version} check
%changelog
* Mon Jul 20 2026 Filip Janus <fjanus@redhat.com> - 16.14-3
- Add SSL test coverage for colon-separated ssl_ecdh_curve group list
- Backport test from upstream commit 3d1ef3a15c3 (adapted for PG16)
- Resolves: RHEL-119229
* Mon Jul 20 2026 Filip Janus <fjanus@redhat.com> - 16.14-2
- Enable PQC-compatible TLS group negotiation via ssl_ecdh_curve
- Backport SSL_CTX_set1_groups_list() from PG18 (upstream commit 3d1ef3a15c3)