93 lines
2.7 KiB
Swift
93 lines
2.7 KiB
Swift
import Logging
|
|
import NIOCore
|
|
import NIOPosix
|
|
import PostgresNIO
|
|
import Testing
|
|
|
|
@testable import Persistence
|
|
|
|
@Suite(
|
|
"TLS enumeration",
|
|
.tags(.enumeration)
|
|
)
|
|
struct TLSTests {
|
|
|
|
// MARK: Methods tests
|
|
|
|
@Test
|
|
func `off connects in plaintext`() async throws {
|
|
// With TLS disabled the client skips the `SSLRequest` and sends its startup message directly,
|
|
// which the fake server answers in plaintext.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
let connection = try await connect(to: server, tls: .off)
|
|
|
|
let isConnected = !connection.isClosed
|
|
|
|
try await connection.close()
|
|
try await server.stop()
|
|
|
|
#expect(isConnected)
|
|
}
|
|
|
|
@Test
|
|
func `prefer falls back to plaintext when the server offers no TLS`() async throws {
|
|
// The fake server refuses the `SSLRequest`, so this connection can only succeed by downgrading
|
|
// to plaintext — pinning the driver behavior the `prefer` posture relies on.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
let connection = try await connect(to: server, tls: .prefer)
|
|
|
|
let isConnected = !connection.isClosed
|
|
|
|
try await connection.close()
|
|
try await server.stop()
|
|
|
|
#expect(isConnected)
|
|
}
|
|
|
|
@Test
|
|
func `require refuses the connection when the server offers no TLS`() async throws {
|
|
// The fake server refuses the `SSLRequest`, so the driver must fail the connection instead of
|
|
// downgrading — pinning the refusal the `require` posture promises.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
|
|
let error = await #expect(throws: PSQLError.self) {
|
|
_ = try await connect(to: server, tls: .require)
|
|
}
|
|
|
|
try await server.stop()
|
|
|
|
#expect(error?.code == .sslUnsupported)
|
|
}
|
|
|
|
}
|
|
|
|
// MARK: - Helpers
|
|
|
|
private extension TLSTests {
|
|
|
|
/// Opens a connection to the given fake server with the given TLS posture.
|
|
/// - Parameters:
|
|
/// - server: the fake server to connect to.
|
|
/// - tls: the TLS posture to connect with.
|
|
/// - Returns: the open connection, to be closed by the caller.
|
|
func connect(
|
|
to server: PlaintextPostgresServer,
|
|
tls: TLS
|
|
) async throws -> PostgresConnection {
|
|
try await PostgresConnection.connect(
|
|
on: MultiThreadedEventLoopGroup.singleton.any(),
|
|
configuration: .init(
|
|
host: "127.0.0.1",
|
|
port: server.port,
|
|
username: "loud",
|
|
password: "loud",
|
|
database: "loud",
|
|
tls: tls.postgresTLS()
|
|
),
|
|
id: 1,
|
|
logger: Logger(label: "test")
|
|
)
|
|
}
|
|
|
|
}
|