mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-15 19:42:28 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-29817: Issues with handling options for SSL CRLs (and some others)

Browse source 
This patch adds the correct setting of the "--tls-version" and
"--ssl-verify-server-cert" options in the client-side utilities
such as mysqltest, mysqlcheck and mysqlslap, as well as the correct
setting of the "--ssl-crl" option when executing queries on the
slave side, and also the correct option codes in the "sslopts-logopts.h"
file (in the latter case, incorrect values are not a problem right
now, but may cause subtle test failures in the future, if the option
handling code changes).
This commit is contained in:
Julius Goryavsky 2022-10-19 02:51:01 +02:00
parent 931549ff66
commit 1ebf0b7372
5 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
client/mysqlcheck.c
View file

@ -1105,7 +1105,10 @@ static int dbConnect(char *host, char *user, char *passwd)
opt_ssl_capath, opt_ssl_cipher);
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(&mysql_connection, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(&mysql_connection, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
if (opt_protocol)
mysql_options(&mysql_connection,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);

3
client/mysqlslap.c
View file

@ -303,7 +303,10 @@ void set_mysql_connect_options(MYSQL *mysql)
opt_ssl_capath, opt_ssl_cipher);
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
if (opt_protocol)
mysql_options(mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);

1
client/mysqltest.cc
View file

@ -9713,6 +9713,7 @@ int main(int argc, char **argv)
opt_ssl_capath, opt_ssl_cipher);
mysql_options(con->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(con->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(con->mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
#if MYSQL_VERSION_ID >= 50000
/* Turn on ssl_verify_server_cert only if host is "localhost" */
opt_ssl_verify_server_cert= opt_host && !strcmp(opt_host, "localhost");

4
include/sslopt-longopts.h
View file

@ -39,10 +39,10 @@
{"ssl-key", OPT_SSL_KEY, "X509 key in PEM format (implies --ssl).",
&opt_ssl_key, &opt_ssl_key, 0, GET_STR, REQUIRED_ARG,
0, 0, 0, 0, 0, 0},
{"ssl-crl", OPT_SSL_KEY, "Certificate revocation list (implies --ssl).",
{"ssl-crl", OPT_SSL_CRL, "Certificate revocation list (implies --ssl).",
&opt_ssl_crl, &opt_ssl_crl, 0, GET_STR, REQUIRED_ARG,
0, 0, 0, 0, 0, 0},
{"ssl-crlpath", OPT_SSL_KEY,
{"ssl-crlpath", OPT_SSL_CRLPATH,
"Certificate revocation list path (implies --ssl).",
&opt_ssl_crlpath, &opt_ssl_crlpath, 0, GET_STR, REQUIRED_ARG,
0, 0, 0, 0, 0, 0},

6
sql/slave.cc
View file

@ -7256,9 +7256,9 @@ static int connect_to_master(THD* thd, MYSQL* mysql, Master_info* mi,
mi->ssl_ca[0]?mi->ssl_ca:0,
mi->ssl_capath[0]?mi->ssl_capath:0,
mi->ssl_cipher[0]?mi->ssl_cipher:0);
mysql_options(mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
&mi->ssl_verify_server_cert);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH,
mysql_options(mysql, MYSQL_OPT_SSL_CRL,
mi->ssl_crl[0] ? mi->ssl_crl : 0);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH,
mi->ssl_crlpath[0] ? mi->ssl_crlpath : 0);
mysql_options(mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
&mi->ssl_verify_server_cert);