Skip to content

Commit 7d57a4b

Browse files
author
Arun Kuruvila
committed
Merge branch 'mysql-5.6' into mysql-5.7
2 parents 7e36c53 + d2a399e commit 7d57a4b

File tree

7 files changed

+142
-10
lines changed

7 files changed

+142
-10
lines changed

‎mysql-test/r/ssl_ca.result

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#
2+
# Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE FOUND
3+
#
4+
# try to connect with wrong '--ssl-ca' path : should fail
5+
ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed
6+
# try to connect with correct '--ssl-ca' path : should connect
7+
Variable_name Value
8+
Ssl_cipher SSL_CIPHER
9+
#
10+
# Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
11+
# PATH SUBSTITUTION
12+
#
13+
# try to connect with '--ssl-ca' option using tilde home directoy
14+
# path substitution : should connect
15+
Variable_name Value
16+
Ssl_cipher SSL_CIPHER
17+
# try to connect with '--ssl-key' option using tilde home directoy
18+
# path substitution : should connect
19+
Variable_name Value
20+
Ssl_cipher SSL_CIPHER
21+
# try to connect with '--ssl-cert' option using tilde home directoy
22+
# path substitution : should connect
23+
Variable_name Value
24+
Ssl_cipher SSL_CIPHER

‎mysql-test/r/ssl_crl.result

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,15 @@ ssl_crl MYSQL_TEST_DIR/std_data/crl-client-revoked.crl
2121
ssl_crlpath
2222
ssl_key MYSQL_TEST_DIR/std_data/crl-server-key.pem
2323
# try logging in with a certificate in the server's --ssl-crl : should fail
24+
#
25+
# Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
26+
# PATH SUBSTITUTION
27+
#
28+
# try to connect with '--ssl-crl' option using tilde home directoy
29+
# path substitution : should connect
30+
Variable_name Value
31+
Ssl_cipher DHE-RSA-AES128-GCM-SHA256
32+
# try to connect with '--ssl-crlpath' option using tilde home directoy
33+
# path substitution : should connect
34+
Variable_name Value
35+
Ssl_cipher DHE-RSA-AES128-GCM-SHA256

‎mysql-test/t/ssl_ca-master.opt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
--ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem
2+
--ssl-key=$MYSQL_TEST_DIR/std_data/crl-server-key.pem
3+
--ssl-cert=$MYSQL_TEST_DIR/std_data/crl-server-cert.pem

‎mysql-test/t/ssl_ca.test

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
--source include/have_ssl.inc
2+
--source include/not_embedded.inc
3+
4+
--echo #
5+
--echo # Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE FOUND
6+
--echo #
7+
8+
--echo # try to connect with wrong '--ssl-ca' path : should fail
9+
--error 1
10+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/wrong-crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'" 2>&1
11+
12+
--echo # try to connect with correct '--ssl-ca' path : should connect
13+
--replace_result DHE-RSA-AES128-GCM-SHA256 SSL_CIPHER DHE-RSA-AES256-SHA SSL_CIPHER
14+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
15+
16+
--echo #
17+
--echo # Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
18+
--echo # PATH SUBSTITUTION
19+
--echo #
20+
21+
--let $mysql_test_dir_path= `SELECT REPLACE('$MYSQL_TEST_DIR', '$HOME', '~')`
22+
23+
--echo # try to connect with '--ssl-ca' option using tilde home directoy
24+
--echo # path substitution : should connect
25+
--replace_result DHE-RSA-AES128-GCM-SHA256 SSL_CIPHER DHE-RSA-AES256-SHA SSL_CIPHER
26+
--exec $MYSQL --ssl-ca=$mysql_test_dir_path/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
27+
28+
--echo # try to connect with '--ssl-key' option using tilde home directoy
29+
--echo # path substitution : should connect
30+
--replace_result DHE-RSA-AES128-GCM-SHA256 SSL_CIPHER DHE-RSA-AES256-SHA SSL_CIPHER
31+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$mysql_test_dir_path/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
32+
33+
--echo # try to connect with '--ssl-cert' option using tilde home directoy
34+
--echo # path substitution : should connect
35+
--replace_result DHE-RSA-AES128-GCM-SHA256 SSL_CIPHER DHE-RSA-AES256-SHA SSL_CIPHER
36+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$mysql_test_dir_path/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"

‎mysql-test/t/ssl_crl.test

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,20 @@ if (!$crllen)
2121
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
2222
--error 1
2323
--exec $MYSQL --ssl-mode=VERIFY_CA --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-revoked-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-revoked-cert.pem test -e "SHOW VARIABLES like '%ssl%';"
24+
25+
--echo #
26+
--echo # Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
27+
--echo # PATH SUBSTITUTION
28+
--echo #
29+
30+
--let $mysql_test_dir_path= `SELECT REPLACE('$MYSQL_TEST_DIR', '$HOME', '~')`
31+
32+
--echo # try to connect with '--ssl-crl' option using tilde home directoy
33+
--echo # path substitution : should connect
34+
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
35+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test --ssl-crl=$mysql_test_dir_path/std_data/crl-client-revoked.crl -e "SHOW STATUS LIKE 'Ssl_cipher'"
36+
37+
--echo # try to connect with '--ssl-crlpath' option using tilde home directoy
38+
--echo # path substitution : should connect
39+
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
40+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-crlpath=$mysql_test_dir_path/std_data/crldir test -e "SHOW STATUS LIKE 'Ssl_cipher'"

‎sql-common/client.c

Lines changed: 48 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1744,6 +1744,24 @@ static int add_init_command(struct st_mysql_options *options, const char *cmd)
17441744
} while(0)
17451745
#endif
17461746

1747+
static char *set_ssl_option_unpack_path(struct st_mysql_options *options,
1748+
const char *arg, unsigned int mode)
1749+
{
1750+
char *opt_var= NULL;
1751+
if (arg)
1752+
{
1753+
char *buff= (char *)my_malloc(key_memory_mysql_options, FN_REFLEN + 1,
1754+
MYF(MY_WME));
1755+
unpack_filename(buff, (char *)arg);
1756+
opt_var= my_strdup(key_memory_mysql_options, buff, MYF(MY_WME));
1757+
ENSURE_EXTENSIONS_PRESENT(options);
1758+
options->extension->ssl_mode= mode;
1759+
my_free(buff);
1760+
}
1761+
return opt_var;
1762+
}
1763+
1764+
17471765
void mysql_read_default_options(struct st_mysql_options *options,
17481766
const char *filename,const char *group)
17491767
{
@@ -5485,27 +5503,49 @@ mysql_options(MYSQL *mysql,enum mysql_option option, const void *arg)
54855503
EXTENSION_SET_STRING(&mysql->options, default_auth, arg);
54865504
break;
54875505
case MYSQL_OPT_SSL_KEY:
5488-
SET_SSL_OPTION(ssl_key, arg, SSL_MODE_PREFERRED);
5506+
if (mysql->options.ssl_key)
5507+
my_free(mysql->options.ssl_key);
5508+
mysql->options.ssl_key= set_ssl_option_unpack_path(&mysql->options, arg,
5509+
SSL_MODE_PREFERRED);
54895510
break;
54905511
case MYSQL_OPT_SSL_CERT:
5491-
SET_SSL_OPTION(ssl_cert, arg, SSL_MODE_PREFERRED);
5512+
if (mysql->options.ssl_cert)
5513+
my_free(mysql->options.ssl_cert);
5514+
mysql->options.ssl_cert= set_ssl_option_unpack_path(&mysql->options, arg,
5515+
SSL_MODE_PREFERRED);
54925516
break;
54935517
case MYSQL_OPT_SSL_CA:
5494-
SET_SSL_OPTION(ssl_ca, arg, SSL_MODE_VERIFY_CA);
5518+
if (mysql->options.ssl_ca)
5519+
my_free(mysql->options.ssl_ca);
5520+
mysql->options.ssl_ca= set_ssl_option_unpack_path(&mysql->options, arg,
5521+
SSL_MODE_VERIFY_CA);
54955522
break;
54965523
case MYSQL_OPT_SSL_CAPATH:
5497-
SET_SSL_OPTION(ssl_capath, arg, SSL_MODE_VERIFY_CA);
5524+
if (mysql->options.ssl_capath)
5525+
my_free(mysql->options.ssl_capath);
5526+
mysql->options.ssl_capath= set_ssl_option_unpack_path(&mysql->options, arg,
5527+
SSL_MODE_VERIFY_CA);
54985528
break;
54995529
case MYSQL_OPT_SSL_CIPHER:
55005530
SET_SSL_OPTION(ssl_cipher, arg, SSL_MODE_PREFERRED);
55015531
break;
55025532
case MYSQL_OPT_SSL_CRL:
5503-
EXTENSION_SET_SSL_STRING(&mysql->options, ssl_crl, arg,
5504-
SSL_MODE_PREFERRED);
5533+
if (mysql->options.extension)
5534+
my_free(mysql->options.extension->ssl_crl);
5535+
else
5536+
ALLOCATE_EXTENSIONS(&mysql->options);
5537+
mysql->options.extension->ssl_crl=
5538+
set_ssl_option_unpack_path(&mysql->options, arg,
5539+
SSL_MODE_PREFERRED);
55055540
break;
55065541
case MYSQL_OPT_SSL_CRLPATH:
5507-
EXTENSION_SET_SSL_STRING(&mysql->options, ssl_crlpath, arg,
5508-
SSL_MODE_PREFERRED);
5542+
if (mysql->options.extension)
5543+
my_free(mysql->options.extension->ssl_crlpath);
5544+
else
5545+
ALLOCATE_EXTENSIONS(&mysql->options);
5546+
mysql->options.extension->ssl_crlpath=
5547+
set_ssl_option_unpack_path(&mysql->options, arg,
5548+
SSL_MODE_PREFERRED);
55095549
break;
55105550
case MYSQL_OPT_TLS_VERSION:
55115551
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)

‎vio/viosslfactories.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -564,7 +564,7 @@ new_VioSSLFd(const char *key_file, const char *cert_file,
564564
}
565565

566566
/* Load certs from the trusted ca */
567-
if (SSL_CTX_load_verify_locations(ssl_fd->ssl_context, ca_file, ca_path) == 0)
567+
if (SSL_CTX_load_verify_locations(ssl_fd->ssl_context, ca_file, ca_path) <= 0)
568568
{
569569
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
570570
if (ca_file || ca_path)

0 commit comments

Comments
 (0)