src/test/ssl/sslfiles.mk

   1 #-------------------------------------------------------------------------
   2 #
   3 # Makefile for sslfiles
   4 #
   5 #   The SSL test files are completely disjoint from the rest of the build; they
   6 #   don't rely on other targets or on Makefile.global. Since these recipes rely
   7 #   on some default Make behavior that's disabled in the main build tree, such
   8 #   as intermediate cleanup, they've been moved into their own separate file.
   9 #   The main Makefile in this directory defers to this helper file when
  10 #   building the sslfiles-related targets.
  11 #
  12 # Portions Copyright (c) 1996-2024, PostgreSQL Global Development Group
  13 # Portions Copyright (c) 1994, Regents of the University of California
  14 #
  15 # src/test/ssl/sslfiles.mk
  16 #
  17 #-------------------------------------------------------------------------
  18
  19 #
  20 # To add a new server or client certificate, add a new <name>.config file in
  21 # the conf/ directory, then add <name> to either SERVERS or CLIENTS below. A
  22 # key/certificate pair will be generated for you, signed by the appropriate CA.
  23 #
  24 SERVERS := server-cn-and-alt-names \
  25         server-cn-and-ip-alt-names \
  26         server-cn-only \
  27         server-ip-alt-names \
  28         server-ip-cn-only \
  29         server-ip-cn-and-alt-names \
  30         server-ip-cn-and-dns-alt-names \
  31         server-ip-in-dnsname \
  32         server-single-alt-name \
  33         server-multiple-alt-names \
  34         server-no-names \
  35         server-revoked
  36 CLIENTS := client client-dn client-revoked client_ext client-long \
  37         client-revoked-utf8
  38
  39 #
  40 # To add a new non-standard certificate, add it to SPECIAL_CERTS and then add
  41 # a recipe for creating it to the "Special-case certificates" section below.
  42 #
  43 SPECIAL_CERTS := ssl/server-rsapss.crt
  44
  45 # Likewise for non-standard keys
  46 SPECIAL_KEYS := ssl/server-password.key \
  47         ssl/client-der.key \
  48         ssl/client-encrypted-pem.key \
  49         ssl/client-encrypted-der.key \
  50         ssl/server-rsapss.key
  51
  52 #
  53 # These files are just concatenations of other files. You can add new ones to
  54 # COMBINATIONS here, then declare the constituent files as dependencies in the
  55 # "Combined files" section below.
  56 #
  57 COMBINATIONS := \
  58         ssl/both-cas-1.crt \
  59         ssl/both-cas-2.crt \
  60         ssl/root+server_ca.crt \
  61         ssl/root+server.crl \
  62         ssl/root+client_ca.crt \
  63         ssl/root+client.crl \
  64         ssl/client+client_ca.crt \
  65         ssl/server-cn-only+server_ca.crt
  66
  67 CERTIFICATES := root_ca server_ca client_ca $(SERVERS) $(CLIENTS)
  68 STANDARD_CERTS := $(CERTIFICATES:%=ssl/%.crt)
  69 STANDARD_KEYS := $(CERTIFICATES:%=ssl/%.key)
  70 CRLS := ssl/root.crl \
  71         ssl/client.crl \
  72         ssl/server.crl
  73
  74 SSLFILES := \
  75         $(STANDARD_CERTS) \
  76         $(STANDARD_KEYS) \
  77         $(SPECIAL_CERTS) \
  78         $(SPECIAL_KEYS) \
  79         $(COMBINATIONS) \
  80         $(CRLS)
  81 SSLDIRS := ssl/client-crldir \
  82         ssl/server-crldir \
  83         ssl/root+client-crldir \
  84         ssl/root+server-crldir
  85
  86 # This target re-generates all the key and certificate files. Usually we just
  87 # use the ones that are committed to the tree without rebuilding them.
  88 #
  89 .PHONY: sslfiles
  90 sslfiles: $(SSLFILES) $(SSLDIRS)
  91
  92 #
  93 # Special-case certificates
  94 #
  95
  96 # Root CA is self-signed.
  97 ssl/root_ca.crt: ssl/root_ca.key conf/root_ca.config
  98         $(OPENSSL) req -new -x509 -config conf/root_ca.config -days 10000 -key $< -out $@
  99
 100 # Certificate using RSA-PSS algorithm. Also self-signed.
 101 ssl/server-rsapss.crt: ssl/server-rsapss.key conf/server-rsapss.config
 102         $(OPENSSL) req -new -x509 -config conf/server-rsapss.config -key $< -out $@
 103
 104 #
 105 # Special-case keys
 106 #
 107 # All targets here are contained in $(SPECIAL_KEYS).
 108 #
 109
 110 # Password-protected version of server-cn-only.key
 111 ssl/server-password.key: ssl/server-cn-only.key
 112         $(OPENSSL) pkey -aes256 -in $< -out $@ -passout 'pass:secret1'
 113
 114 # Key that uses the RSA-PSS algorithm
 115 ssl/server-rsapss.key:
 116         $(OPENSSL) genpkey -algorithm rsa-pss -out $@
 117
 118 # DER-encoded version of client.key
 119 ssl/client-der.key: ssl/client.key
 120         $(OPENSSL) rsa -in $< -outform DER -out $@
 121
 122 # Convert client.key to encrypted PEM (X.509 text) and DER (X.509 ASN.1)
 123 # formats to test libpq's support for the sslpassword= option.
 124 ssl/client-encrypted-pem.key: ssl/client.key
 125         $(OPENSSL) pkey -in $< -outform PEM -aes128 -passout 'pass:dUmmyP^#+' -out $@
 126 # TODO Explicitly choosing -aes128 generates a key unusable to PostgreSQL with
 127 # OpenSSL 3.0.0, so fall back on the default for now.
 128 ssl/client-encrypted-der.key: ssl/client.key
 129         $(OPENSSL) rsa -in $< -outform DER -passout 'pass:dUmmyP^#+' -out $@
 130
 131 #
 132 # Combined files
 133 #
 134 # All targets in $(COMBINATIONS) share a single recipe; just declare the
 135 # necessary dependencies and they'll be smashed together.
 136 #
 137
 138 # Root certificate file that contains both CA certificates, for testing
 139 # that multiple certificates can be used.
 140 ssl/both-cas-1.crt: ssl/root_ca.crt ssl/client_ca.crt ssl/server_ca.crt
 141
 142 # The same, but the certs are in different order
 143 ssl/both-cas-2.crt: ssl/root_ca.crt ssl/server_ca.crt ssl/client_ca.crt
 144
 145 # A root certificate file for the client, to validate server certs.
 146 ssl/root+server_ca.crt: ssl/root_ca.crt ssl/server_ca.crt
 147
 148 # and for the server, to validate client certs
 149 ssl/root+client_ca.crt: ssl/root_ca.crt ssl/client_ca.crt
 150
 151 # and for the client, to present to the server
 152 ssl/client+client_ca.crt: ssl/client.crt ssl/client_ca.crt
 153
 154 # for the server, to present to a client that only knows the root
 155 ssl/server-cn-only+server_ca.crt: ssl/server-cn-only.crt ssl/server_ca.crt
 156
 157 # If a CRL is used, OpenSSL requires a CRL file for *all* the CAs in the
 158 # chain, even if some of them are empty.
 159 ssl/root+server.crl: ssl/root.crl ssl/server.crl
 160 ssl/root+client.crl: ssl/root.crl ssl/client.crl
 161
 162 $(COMBINATIONS):
 163         cat $^ > $@
 164
 165 #
 166 # Standard keys
 167 #
 168
 169 $(STANDARD_KEYS):
 170         $(OPENSSL) genrsa -out $@ 2048
 171         chmod 0600 $@
 172
 173 #
 174 # Standard certificates
 175 #
 176
 177 CA_CERTS     := ssl/server_ca.crt ssl/client_ca.crt
 178 SERVER_CERTS := $(SERVERS:%=ssl/%.crt)
 179 CLIENT_CERTS := $(CLIENTS:%=ssl/%.crt)
 180
 181 # See the "CA State" section below.
 182 root_ca_state_files := ssl/root_ca-certindex ssl/root_ca-certindex.attr ssl/root_ca.srl
 183 server_ca_state_files := ssl/server_ca-certindex ssl/server_ca-certindex.attr ssl/server_ca.srl
 184 client_ca_state_files := ssl/client_ca-certindex ssl/client_ca-certindex.attr ssl/client_ca.srl
 185
 186 # These are the workhorse recipes. `openssl ca` can't be safely run from
 187 # parallel processes, so we must mark the entire Makefile .NOTPARALLEL.
 188 .NOTPARALLEL:
 189 $(CA_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/root_ca.crt | ssl/new_certs_dir $(root_ca_state_files)
 190         $(OPENSSL) ca -batch -config conf/cas.config -name root_ca   -notext -in $< -out $@
 191
 192 $(SERVER_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/server_ca.crt | ssl/new_certs_dir $(server_ca_state_files)
 193         $(OPENSSL) ca -batch -config conf/cas.config -name server_ca -notext -in $< -out $@
 194
 195 $(CLIENT_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/client_ca.crt | ssl/new_certs_dir $(client_ca_state_files)
 196         $(OPENSSL) ca -batch -config conf/cas.config -name client_ca -notext -in $< -out $@
 197
 198 # The CSRs don't need to persist after a build.
 199 .INTERMEDIATE: $(CERTIFICATES:%=ssl/%.csr)
 200 ssl/%.csr: ssl/%.key conf/%.config
 201         $(OPENSSL) req -new -utf8 -key $< -out $@ -config conf/$*.config
 202
 203 #
 204 # CA State
 205 #
 206 # All of these are intended to be order-only dependencies; additionally, the
 207 # pattern recipes are marked as explicit intermediates. The goal is for Make to
 208 # create the state files once for each CA, allow them to accumulate whatever
 209 # state is needed, and then automatically remove them at the end of the run.
 210 #
 211
 212 .INTERMEDIATE: $(root_ca_state_files) $(server_ca_state_files) $(client_ca_state_files)
 213
 214 # OpenSSL requires a directory to put all generated certificates in. We don't
 215 # use this for anything, but we need a location.
 216 ssl/new_certs_dir:
 217         mkdir $@
 218
 219 ssl/%-certindex:
 220         touch $@
 221
 222 ssl/%-certindex.attr:
 223         echo "unique_subject=no" > $@
 224
 225 # The first serial number for each CA is based on the current timestamp, to
 226 # avoid collisions across Make runs.
 227 ssl/%.srl:
 228         date +%Y%m%d%H%M%S00 > $@
 229
 230 #
 231 # CRLs
 232 #
 233
 234 ssl/root.crl: ssl/root_ca.crt | $(root_ca_state_files)
 235         $(OPENSSL) ca -config conf/cas.config -name root_ca   -gencrl -out $@
 236
 237 ssl/server.crl: ssl/server-revoked.crt ssl/server_ca.crt | $(server_ca_state_files)
 238         $(OPENSSL) ca -config conf/cas.config -name server_ca -revoke $<
 239         $(OPENSSL) ca -config conf/cas.config -name server_ca -gencrl -out $@
 240
 241 ssl/client.crl: ssl/client-revoked.crt ssl/client-revoked-utf8.crt ssl/client_ca.crt | $(client_ca_state_files)
 242         $(OPENSSL) ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked.crt
 243         $(OPENSSL) ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked-utf8.crt
 244         $(OPENSSL) ca -config conf/cas.config -name client_ca -gencrl -out $@
 245
 246 #
 247 # CRL hash directories
 248 #
 249
 250 ssl/root+server-crldir: ssl/server.crl ssl/root.crl
 251 ssl/root+client-crldir: ssl/client.crl ssl/root.crl
 252 ssl/server-crldir: ssl/server.crl
 253 ssl/client-crldir: ssl/client.crl
 254
 255 crlhashfile = $(shell $(OPENSSL) crl -hash -noout -in $(1)).r0
 256
 257 ssl/%-crldir:
 258         mkdir -p $@
 259         rm -f $@/*.r0
 260         $(foreach crl,$^,cp $(crl) $@/$(call crlhashfile,$(crl)) &&) true
 261         touch $@
 262
 263 .PHONY: sslfiles-clean
 264 sslfiles-clean:
 265         rm -f $(SSLFILES) ssl/*.old ssl/*.csr ssl/*.srl ssl/*-certindex*
 266         rm -rf $(SSLDIRS) ssl/new_certs_dir
 267
 268 # The difference between the below clean targets and sslfiles-clean is that the
 269 # clean targets will be run during a "standard" recursive clean run from the
 270 # main build tree. The sslfiles-clean target must be run explicitly from this
 271 # directory.
 272 .PHONY: clean distclean
 273 clean distclean:
 274         rm -rf ssl/*.old ssl/new_certs_dir ssl/client*_tmp.key