Attachment 639131 Details for Bug 924663

[patch] Consolidated patch for #924663

.0001-MDEV-7937-Enforce-SSL-when-ssl-client-option-is-used.patch.swp (text/plain), 16.00 KB, created by MariaDB Engineering on 2015-06-25 14:20:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: MariaDB Engineering

Created: 2015-06-25 14:20:38 UTC

Size: 16.00 KB

patch

obsolete

>b0VIM 7.4.U 2nirbhayNIRBHAY-HOMEC:/Users/nirbhay/Downloads/0001-MDEV-7937-Enforce-SSL-when-ssl-client-option-is-used.patch3210#"! UtpÿaKbad±a¹wR	Î~A=Ê

N
>
× o8	³yP?"é
>¿
>
>g
>]
>Y
>2
>(
>$
>Ö	w	7	Ø¾u`I;ê±d/% ùïêMúàv_Q(ýûòÝl^=,)îëé½»|?î³dbH±°+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem -e "call test.have_ssl()" 2>&1+--echo mysql --ssl-ca=cacert.pem -e "call test.have_ssl()"+--disable_abort_on_error++  where variable_name='ssl_cipher';+  from information_schema.session_status+  select if(variable_value > '','yes','no') as 'have_ssl'+create procedure have_ssl()+# and it's actual value doesn't matter here anyway+# because the cipher depends on openssl (or yassl) version,+# create a procedure instead of SHOW STATUS LIKE 'ssl_cipher'++source include/have_ssl_crypto_functs.inc;++#+# MDEV-7937: Enforce SSL when --ssl client option is used+#@@ -0,0 +1,35 @@+++ b/mysql-test/t/ssl_7937.test--- /dev/nullindex 0000000..d593b9dnew file mode 100644diff --git a/mysql-test/t/ssl_7937.test b/mysql-test/t/ssl_7937.test+--loose-disable-ssl+[nossl]++--loose-enable-ssl+[ssl]@@ -0,0 +1,5 @@+++ b/mysql-test/t/ssl_7937.combinations--- /dev/nullindex 0000000..46a4568new file mode 100644diff --git a/mysql-test/t/ssl_7937.combinations b/mysql-test/t/ssl_7937.combinations+drop procedure have_ssl;+ERROR 2026 (HY000): SSL connection error: Failed to verify the server certificate+mysql --ssl --ssl-verify-server-cert -e "call test.have_ssl()"+yes+have_ssl+mysql --ssl-ca=cacert.pem --ssl-verify-server-cert -e "call test.have_ssl()"+yes+have_ssl+mysql --ssl -e "call test.have_ssl()"+yes+have_ssl+mysql --ssl-ca=cacert.pem -e "call test.have_ssl()"+where variable_name='ssl_cipher';+  from information_schema.session_status+select if(variable_value > '','yes','no') as 'have_ssl'+create procedure have_ssl()@@ -0,0 +1,16 @@+++ b/mysql-test/r/ssl_7937.result--- /dev/nullindex 0000000..a94ca3bnew file mode 100644diff --git a/mysql-test/r/ssl_7937.result b/mysql-test/r/ssl_7937.result+drop procedure have_ssl;+ERROR 2026 (HY000): SSL connection error: SSL is required, but the server does not support it+mysql --ssl --ssl-verify-server-cert -e "call test.have_ssl()"+ERROR 2026 (HY000): SSL connection error: SSL is required, but the server does not support it+mysql --ssl-ca=cacert.pem --ssl-verify-server-cert -e "call test.have_ssl()"+no+have_ssl+mysql --ssl -e "call test.have_ssl()"+no+have_ssl+mysql --ssl-ca=cacert.pem -e "call test.have_ssl()"+where variable_name='ssl_cipher';+  from information_schema.session_status+select if(variable_value > '','yes','no') as 'have_ssl'+create procedure have_ssl()@@ -0,0 +1,15 @@+++ b/mysql-test/r/ssl_7937,nossl.result--- /dev/nullindex 0000000..7269323new file mode 100644diff --git a/mysql-test/r/ssl_7937,nossl.result b/mysql-test/r/ssl_7937,nossl.result create mode 100644 mysql-test/t/ssl_7937.test create mode 100644 mysql-test/t/ssl_7937.combinations create mode 100644 mysql-test/r/ssl_7937.result create mode 100644 mysql-test/r/ssl_7937,nossl.result 5 files changed, 90 insertions(+), 7 deletions(-) sql-common/client.c                | 26 +++++++++++++++++++------- mysql-test/t/ssl_7937.test         | 35 +++++++++++++++++++++++++++++++++++ mysql-test/t/ssl_7937.combinations |  5 +++++ mysql-test/r/ssl_7937.result       | 16 ++++++++++++++++ mysql-test/r/ssl_7937,nossl.result | 15 +++++++++++++++---is required, but the server can not handle a ssl connection.the ssl connection is required. The mysql client will now print an error if sslUsing --ssl-verify-server-cert and --ssl[-*] implies thatSubject: [PATCH] MDEV-7937: Enforce SSL when --ssl client option is usedDate: Tue, 9 Jun 2015 14:08:44 +0300From: =?UTF-8?q?Vicen=C8=9Biu=20Ciorbaru?= <vicentiu@mariadb.org>From 5d0cab00d7b5d306bf7b1c5a0669d6a910c6da3f Mon Sep 17 00:00:00 2001adp°KÒIÕÓRó
q
a

¤¡N0ü±p/ú
>Ê
>²
>¯
>`
>0
>.
>õ	¹	|	X	4		Ô´o@>,úøª~|v4ÀºZ'"ÒM 
>àÛ»·±°¯2.1.0--      /* Do the SSL layering. */   {   if (mysql->client_flag & CLIENT_SSL)++  }+    goto error;+                             "support it");+                             "SSL is required, but the server does not "+                             ER(CR_SSL_CONNECTION_ERROR),+    set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate,+  {+      !(mysql->server_capabilities & CLIENT_SSL))+      (mysql->client_flag & CLIENT_SSL_VERIFY_SERVER_CERT) &&+  if (mysql->options.use_ssl &&+  */+     If the server does not support ssl, we abort the connection.+     certificate, a ssl connection is required.+     If client uses ssl and client also has to verify the server+  /*+ #ifdef HAVE_OPENSSL   }     end= buff+5;@@ -2690,6 +2685,23 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,      mysql->client_flag|= CLIENT_CONNECT_WITH_DB;   if (mpvio->db)+ #endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY*/     mysql->client_flag|= CLIENT_SSL;   if (mysql->options.use_ssl)-    mysql->options.use_ssl= 1;-        mysql->options.extension->ssl_crlpath)))-       (mysql->options.extension->ssl_crl ||-      (mysql->options.extension &&-      mysql->options.ssl_cipher ||-      mysql->options.ssl_ca || mysql->options.ssl_capath ||-  if (mysql->options.ssl_key || mysql->options.ssl_cert || #if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)      mysql->client_flag|= CLIENT_MULTI_RESULTS;@@ -2652,16 +2653,10 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio, }   DBUG_RETURN(result); #endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */+  mysql->options.use_ssl= TRUE;            1 : 0);            mysql_options(mysql, MYSQL_OPT_SSL_CIPHER, cipher) ?            mysql_options(mysql, MYSQL_OPT_SSL_CAPATH, capath) |@@ -1848,6 +1848,7 @@ mysql_ssl_set(MYSQL *mysql __attribute__((unused)) ,+++ b/sql-common/client.c--- a/sql-common/client.cindex c180986..acfdd85 100644diff --git a/sql-common/client.c b/sql-common/client.c+drop procedure have_ssl;++}+  --echo ERROR 2026 (HY000): SSL connection error: Failed to verify the server certificate+if ($yassl) {+}+  --exec $MYSQL --ssl --ssl-verify-server-cert -e "call test.have_ssl()" 2>&1+if (!$yassl) {+let yassl=`select variable_value='Unknown' from information_schema.session_status where variable_name='Ssl_session_cache_mode'`;+# we fake the test result for yassl+# but yassl doesn't support certificate verification, so+# this is the test where certificate verification fails.+--echo mysql --ssl --ssl-verify-server-cert -e "call test.have_ssl()"++--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-verify-server-cert -e "call test.have_ssl()" 2>&1+--echo mysql --ssl-ca=cacert.pem --ssl-verify-server-cert -e "call test.have_ssl()"+--exec $MYSQL --ssl -e "call test.have_ssl()" 2>&1+--echo mysql --ssl -e "call test.have_ssl()"

Actions: View | Diff

Attachments on bug 924663: 639131