mariadb/mysql-test/lib/openssl.cnf

# Toplevel section for openssl (including libssl)
openssl_conf = default_conf_section

[default_conf_section]
# We only specify configuration for the "ssl module"
ssl_conf = ssl_section

[ssl_section]
system_default = system_default_section

[system_default_section]
CipherString = ALL:@SECLEVEL=0
MDEV-21965 main.tls_version and main.tls_version1 fail in buildbot on Ubuntu Focal Not only Ubuntu Focal builds openssl with OPENSSL_TLS_SECURITY_LEVEL=2, but for some unfathomable reason it patches openssl sources to disable TLS < 1.2 at security level 2, even though openssl manual says it should only happen at level 4: https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_security_level.html We test TLSv1.1 and TLSv1, so we have to override Focal defaults in mtr. 2020-05-11 01:00:15 +02:00			`# Toplevel section for openssl (including libssl)`
			`openssl_conf = default_conf_section`

			`[default_conf_section]`
			`# We only specify configuration for the "ssl module"`
			`ssl_conf = ssl_section`

			`[ssl_section]`
			`system_default = system_default_section`

			`[system_default_section]`
MDEV-25785 Add support for OpenSSL 3.0 Summary of changes - MD_CTX_SIZE is increased - EVP_CIPHER_CTX_buf_noconst(ctx) does not work anymore, points to nobody knows where. The assumption made previously was that (since the function does not seem to be documented) was that it points to the last partial source block. Add own partial block buffer for NOPAD encryption instead - SECLEVEL in CipherString in openssl.cnf had been downgraded to 0, from 1, to make TLSv1.0 and TLSv1.1 possible (according to https://github.com/openssl/openssl/blob/openssl-3.0.0/NEWS.md even though the manual for SSL_CTX_get_security_level claims that it should not be necessary) - Workaround Ssl_cipher_list issue, it now returns TLSv1.3 ciphers, in addition to what was set in --ssl-cipher - ctx_buf buffer now must be aligned to 16 bytes with openssl( previously with WolfSSL only), ot crashes will happen - updated aes-t , to be better debuggable using function, rather than a huge multiline macro added test that does "nopad" encryption piece-wise, to test replacement of EVP_CIPHER_CTX_buf_noconst 2021-11-08 18:48:19 +01:00			`CipherString = ALL:@SECLEVEL=0`