Commit graph

725 commits

Author SHA1 Message Date
Sergei Golubchik
932646b1ff Merge branch '10.1' into 10.2 2016-06-30 16:38:05 +02:00
Sergei Golubchik
3361aee591 Merge branch '10.0' into 10.1 2016-06-28 22:01:55 +02:00
Sergei Golubchik
c081c978a2 Merge branch '5.5' into bb-10.0 2016-06-21 14:11:02 +02:00
Sergei Golubchik
ae29ea2d86 Merge branch 'mysql/5.5' into 5.5 2016-06-14 13:55:28 +02:00
Vladislav Vaintroub
3a7bc23a16 MDEV-9154 : Remove workarounds (mainly dynamic function loading)
for running obsolete versions of Windows
2016-06-01 20:29:10 +02:00
Arun Kuruvila
c7e68606c0 Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE
FOUND

Description:- Failure during the validation of CA
certificate path which is provided as an option for 'ssl-ca'
returns two different errors for YaSSL and OPENSSL.

Analysis:- 'ssl-ca', option used for specifying the ssl ca
certificate path. Failing to validate this certificate with
OPENSSL returns an error, "ERROR 2026 (HY000): SSL
connection error: SSL_CTX_set_default_verify_paths failed".
While YASSL returns "ERROR 2026 (HY000): SSL connection
error: ASN: bad other signature confirmation". Error
returned by the OPENSSL is correct since
"SSL_CTX_load_verify_locations()" returns 0 (in case of
OPENSSL) for the failure and sets error as
"SSL_INITERR_BAD_PATHS". In case of YASSL,
"SSL_CTX_load_verify_locations()" returns an error number
which is less than or equal to 0 in case of error. Error
numbers for YASSL is mentioned in the file,
'extra/yassl/include/openssl/ssl.h'(line no : 292). Also
'ssl-ca' does not accept tilde home directory path
substitution.

Fix:- The condition which checks for the error in the
"SSL_CTX_load_verify_locations()" is changed in order to
accommodate YASSL as well. A logic is written in
"mysql_ssl_set()" in order accept the tilde home directory
path substitution for all ssl options.
2016-03-01 10:17:25 +05:30
Sergei Golubchik
a5679af1b1 Merge branch '10.0' into 10.1 2016-02-23 21:35:05 +01:00
Sergei Golubchik
271fed4106 Merge branch '5.5' into 10.0 2016-02-15 22:50:59 +01:00
Sergei Golubchik
a90da6e053 MDEV-9314 fatal build error: viosslfactories.c:58:5: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}
fixes for openssl that was built with -DOPENSSL_NO_DEPRECATED
2016-02-06 11:45:23 +01:00
Oleksandr Byelkin
0dfa0eef59 MDEV-8957 [PATCH] Useless ssl_ctx_set_tmp_dh call in libmysql
Accepted patch of Georg: do not setup Differ-Hellman parameters on client.
2015-11-15 10:44:20 +01:00
Jan Lindström
9a5787db51 Merge commit '96badb16afcf' into 10.0
Conflicts:
	client/mysql_upgrade.c
	mysql-test/r/func_misc.result
	mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result
	mysql-test/suite/innodb/r/innodb-fk.result
	mysql-test/t/subselect_sj_mat.test
	sql/item.cc
	sql/item_func.cc
	sql/log.cc
	sql/log_event.cc
	sql/rpl_utility.cc
	sql/slave.cc
	sql/sql_class.cc
	sql/sql_class.h
	sql/sql_select.cc
	storage/innobase/dict/dict0crea.c
	storage/innobase/dict/dict0dict.c
	storage/innobase/handler/ha_innodb.cc
	storage/xtradb/dict/dict0crea.c
	storage/xtradb/dict/dict0dict.c
	storage/xtradb/handler/ha_innodb.cc
	vio/viosslfactories.c
2015-08-03 23:09:43 +03:00
Sergei Golubchik
2721d69f79 MDEV-8352 Increase Diffie-Helman modulus to 2048-bits 2015-07-31 17:17:33 +02:00
V S Murthy Sidagam
dbbe747e54 Bug #21221862 NEWEST RHEL/CENTOS OPENSSL UPDATE BREAKS MYSQL DHE CIPHERS
Description: The newest RHEL/CentOS/SL 6.6 openssl package
(1.0.1e-30.el6_6.9; published around 6/4/2015) contains a fix for
LogJam. RedHat's fix for this was to limit the use
of any SSL DH key sizes to a minimum of 768 bits. This breaks any
DHE SSL ciphers for MySQL clients as soon as you install the
openssl update, since in vio/viosslfactories.c, the default
DHPARAM is a 512 bit one. This cannot be changed in
configuration/runtime; and needs a recompile. Because of this the
client connection with --ssl-cipher=DHE-RSA-AES256-SHA is not
able to connect the server.

Analysis: Openssl has changed Diffie-Hellman key from the 512 to
1024 due to some reasons(please see the details at
http://openssl.org/news/secadv_20150611.txt) Because of this the client
with DHE cipher is failing to connect the server. This change took
place from the openssl-1.0.1n onwards.

Fix: Similar bug fix is already pushed to mysql-5.7 under bug#18367167.
Hence we backported the same fix to mysql-5.5 and mysql-5.6.
2015-06-19 08:26:33 +05:30
Sergei Golubchik
56e2d8318b MDEV-7695 MariaDB - ssl - fips: can not connect with --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure
Change 512bit DH key to 1024bit to meet FIPS requirements
2015-06-09 14:44:04 +02:00
Sergei Golubchik
95797b9677 MDEV-8096 vio timeouts are multiplied by 1000 for ssl
in when using vio->read_timeout (and write_timeout) to set
timeouts of a new vio, as in:

  vio_timeout(vio, 0, old_vio.read_timeout)
  vio_timeout(vio, 0, old_vio.write_timeout)

remember that timeouts are stored in ms, but vio_timeout()'s
argument is in seconds.
2015-05-05 21:56:46 +02:00
Sergei Golubchik
8e797ae267 MDEV-8014 MariaDB client can hang in an infinite loop
On EOF vio_read returns 0, it's not an error so the errno
is not reset. If the previous error was EINTR the client
will loop forever. See also man recv.
2015-05-03 14:43:34 +02:00
Sergei Golubchik
ef1eb9c6c0 SSL: Verbosely report SSL initialization errors
And don't ignore SSL_CTX_set_tmp_dh() failures
2015-05-03 11:22:12 +02:00
Sergei Golubchik
7e7dd8e8f4 MDEV-7695 MariaDB - ssl - fips: can not connect with --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure
Change 512bit DH key to 1024bit to meet FIPS requirements
2015-05-03 11:22:07 +02:00
V S Murthy Sidagam
6c11fedb5e Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINED
post push change: fixing valgrind failures
2015-04-21 09:24:41 +05:30
V S Murthy Sidagam
f07d995799 Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINED
post push change: missed the change in mysql-5.5
(Fixing compiler warning/error)
2015-04-20 19:41:50 +05:30
V S Murthy Sidagam
e7ad7f050e Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINED
Description:
Can't build mysql-5.5 latest source with openssl 0.9.8e.

Analysis:
Older OpenSSL versions(prior to openssl 1.0) doesn't have 'SSL_OP_NO_COMPRESSION' defined.
Hence the build is failing with SSL_OP_NO_COMPRESSION undeclared.

Fix:
Added a conditonal compilation for 'SSL_OP_NO_COMPRESSION'.
i.e if 'SSL_OP_NO_COMPRESSION' is defined then have the SSL_set_options call for OpenSSL 1.0 versions.
Have sk_SSL_COMP_zero() call for OpenSSL 0.9.8 version
2015-04-20 16:46:36 +05:30
Sergei Golubchik
d7e7862364 Merge branch '5.5' into 10.0 2015-02-18 15:16:27 +01:00
Sergei Golubchik
8e80f91fa3 Merge remote-tracking branch 'mysql/5.5' into bb-5.5-merge @ mysql-5.5.42 2015-02-11 23:50:40 +01:00
Harin Vadodaria
fe4c4ab914 Bug#19820550 : DISABLE SSL 3.0 SUPPORT IN OPENSSL
Explicitly disable weaker SSL protocols.
2015-01-02 10:18:04 +05:30
Sergei Golubchik
ba076763ec remove ssl debugging report_errors() function that was sometimes destroying the state 2014-12-01 22:24:58 +01:00
Sergei Golubchik
82f56328ea after merge fixes:
* adjust viossl.c to take account the new code
  (SSL_get_error is used now, cannot simply remap it)
* remove unnecessary version check
* update the test to 10.0
2014-11-21 00:02:24 +01:00
Sergei Golubchik
dbbe365132 5.5 merge 2014-11-20 16:27:16 +01:00
Sergei Golubchik
d851d5e70c MDEV-6975 Implement TLS protocol
followup:
* explicitly disable SSLv2 and SSLv3, keep other protocols enabled
* fix a compiler warning
* rename the test and combinations to avoid confusion

vio/viossl.c:
  fix a compiler warning
2014-11-19 18:54:02 +01:00
Sergei Golubchik
3495801e2e 5.5 merge 2014-11-19 17:23:39 +01:00
Sergei Golubchik
cb8f837a3d MDEV-6975 Implement TLS protocol
change SSL methods to be SSLv23 (according to openssl manpage:
"A TLS/SSL connection established with these methods may understand
the SSLv2, SSLv3, TLSv1, TLSv1.1 and TLSv1.2 protocols") from
TLSv1 methods, that go back to the initial SSL implementation
in MySQL in 2001.

OpenSSL default ciphers are different if TLSv1.2 is enabled,
so tests need to take this into account.
2014-11-18 17:57:06 +01:00
Sergei Golubchik
c8fa6f782c improve OpenSSL error reporting
e.g. from "error:00000001:lib(0):func(0):reason(1)"
to "error:140830B5:SSL routines:SSL3_CLIENT_HELLO:no ciphers available"
2014-11-18 17:56:49 +01:00
Sergei Golubchik
1c6ad62a26 mysql-5.5.39 merge
~40% bugfixed(*) applied
~40$ bugfixed reverted (incorrect or we're not buggy)
~20% bugfixed applied, despite us being not buggy
(*) only changes in the server code, e.g. not cmakefiles
2014-08-02 21:26:16 +02:00
Sergei Golubchik
6fb17a0601 5.5.39 merge 2014-08-07 18:06:56 +02:00
Tor Didriksen
918837f728 Backport from trunk:
Bug#18187290 ISSUE WITH BUILDING MYSQL USING CMAKE 2.8.12

We want to upgrade to VS2013 on Windows.
In order to do this, we need to upgrade to cmake 2.8.12
This has introduced some incompatibilities for .pdb files,
and "make install" no longer works.

To reproduce:
  cmake --build . --target package --config debug

The fix:
Rather than installing .pdb files for static libraries, we use the /Z7 flag
to store symbolic debugging information in the .obj files.
2014-05-07 17:09:14 +02:00
Tor Didriksen
3e96ec0ef9 Backport from trunk:
Bug#18187290 ISSUE WITH BUILDING MYSQL USING CMAKE 2.8.12

We want to upgrade to VS2013 on Windows.
In order to do this, we need to upgrade to cmake 2.8.12
This has introduced some incompatibilities for .pdb files,
and "make install" no longer works.

To reproduce:
  cmake --build . --target package --config debug

The fix:
Rather than installing .pdb files for static libraries, we use the /Z7 flag
to store symbolic debugging information in the .obj files.
2014-05-07 17:09:14 +02:00
Sergei Golubchik
0dc23679c8 10.0-base merge 2014-02-26 15:28:07 +01:00
Sergei Golubchik
0b9a0a3517 5.5 merge 2014-02-25 16:04:35 +01:00
Sergey Vojtovich
d12c7adf71 MDEV-5314 - Compiling fails on OSX using clang
This is port of fix for MySQL BUG#17647863.

revno: 5572
revision-id: jon.hauglid@oracle.com-20131030232243-b0pw98oy72uka2sj
committer: Jon Olav Hauglid <jon.hauglid@oracle.com>
timestamp: Thu 2013-10-31 00:22:43 +0100
message:
  Bug#17647863: MYSQL DOES NOT COMPILE ON OSX 10.9 GM

  Rename test() macro to MY_TEST() to avoid conflict with libc++.
2014-02-19 14:05:15 +04:00
Sergei Golubchik
84651126c0 MySQL-5.5.36 merge
(without few incorrect bugfixes and with 1250 files where only a copyright year was changed)
2014-02-17 11:00:51 +01:00
Sergei Golubchik
72c20282db 10.0-base merge 2014-02-03 15:22:39 +01:00
Sergei Golubchik
59d9d08e2b 5.5 merge 2014-02-01 00:54:03 +01:00
Sergei Golubchik
37d240ecf9 MySQL-5.5.35 merge 2014-01-22 15:29:36 +01:00
Murthy Narkedimilli
c92223e198 Updated/added copyright headers 2014-01-06 10:52:35 +05:30
Murthy Narkedimilli
496abd0814 Updated/added copyright headers 2014-01-06 10:52:35 +05:30
Alexander Barkov
b88bf50ec1 Merge 5.5 -> 10.0-base 2013-10-16 20:41:50 +04:00
Alexander Barkov
11005f3413 Merge 5.3->5.5 2013-10-16 18:17:51 +04:00
Alexander Barkov
049000101a Merge 5.1 -> 5.3 2013-10-16 17:48:31 +04:00
Alexander Barkov
de4ca539b8 MDEV-4890 Valgrind warnings on shutdown on a build with openSSL 2013-10-16 17:37:11 +04:00
Sreedhar.S
c8c948ffa6 Bug 13878021 - WINDOWS PACKAGE THAT INCLUDES .PDB FILES FOR INTERMEDIATE LIBRARIES USED 2013-10-09 11:10:46 +05:30
Sreedhar.S
faca34da04 Bug 13878021 - WINDOWS PACKAGE THAT INCLUDES .PDB FILES FOR INTERMEDIATE LIBRARIES USED 2013-10-09 11:10:46 +05:30