CONNECTIONS IF SPE
Problem description: -ssl-key value is not validated, you can assign any bogus
text to --ssl-key and it is not verified that it exists, and more importantly,
it allows the client to connect to mysqld.
Fix: Added proper validations checks for --ssl-key.
Note:
1) Documentation changes require for 5.1, 5.5, 5.6 and trunk in the sections
listed below and the details are :
http://dev.mysql.com/doc/refman/5.6/en/ssl-options.html#option_general_ssl
and
REQUIRE SSL section of
http://dev.mysql.com/doc/refman/5.6/en/grant.html
2) Client having with option '--ssl', should able to get ssl connection. This
will be implemented as part of separate fix in 5.6 and trunk.
SSL errors on client and now more specific to aid end-user
with debugging. Also restructures error handling for
compliance with SSL docs.
include/violite.h:
new_VioSSLConnectorFd/sslaccept/sslconnect return more elaborate status
libmysql/errmsg.c:
SSL errors now extended, more specific
mysql-test/r/openssl_1.result:
SSL errors now extended, more specific
sql-common/client.c:
Do more detailed error reporting for setup, connect, and
server cert verifying phases.
sql/sql_acl.cc:
sslaccept() signature has changed
vio/viossl.c:
Save the error code and return it to callers of sslaccept
and sslconnect.
vio/viosslfactories.c:
new_VioSSLConnectorFd(): return error code to caller
The problem is that the server failed to follow the rule that
every X509 object retrieved using SSL_get_peer_certificate()
must be explicitly freed by X509_free(). This caused a memory
leak for builds linked against OpenSSL where the X509 object
is reference counted -- improper counting will prevent the
object from being destroyed once the session containing the
peer certificate is freed.
The solution is to explicitly free every X509 object used.
mysql-test/r/openssl_1.result:
Add test case result for Bug#42158
mysql-test/t/openssl_1.test:
Add test case for Bug#42158
sql/sql_acl.cc:
Deallocate X509 objects.
mysqldump included character_set_client magic
that is unknown before 4.1 even when asked for
an appropriate compatibility mode.
In compatibility (3.23, 4.0) mode, we do not
output charset statements (not even in a
"comment conditional"), nor do we do magic on
the server, even if the server is sufficient
new (4.1+). Table-names will be output converted
to the charset requested by mysqldump; if such
a conversion is not possible (Ivrit -> Latin),
mysqldump will fail.
mysqldump included character_set_client magic
that is unknown before 4.1 even when asked for
an appropriate compatibility mode.
In compatibility (3.23, 4.0) mode, we do not
output charset statements (not even in a
"comment conditional"), nor do we do magic on
the server, even if the server is sufficient
new (4.1+). Table-names will be output converted
to the charset requested by mysqldump; if such
a conversion is not possible (Ivrit -> Latin),
mysqldump will fail.
client/mysqldump.c:
in 3.23/4.0 compat mode, don't do charset magic,
period. not in output, but not on the server,
either!
mysql-test/r/mysqldump-max.result:
character_set_client magic lives in version-conditional
now (except in compat 3.23/4.0 mode, in which case we
don't output any at all!).
mysql-test/r/mysqldump.result:
character_set_client magic lives in version-conditional
now (except in compat 3.23/4.0 mode, in which case we
don't output any at all!).
mysql-test/r/openssl_1.result:
character_set_client magic lives in version-conditional
now (except in compat 3.23/4.0 mode, in which case we
don't output any at all!).
mysql-test/t/mysqldump.test:
character_set_client magic lives in version-conditional
now (except in compat 3.23/4.0 mode, in which case we
don't output any at all!).
Re-generated the PKI files needed.
Removed the ones that are not needed.
Updated the tests to reference the correct SSL subject.
mysql-test/r/openssl_1.result:
Bug #42366: Updated the tests to reference the correct SSL subject
mysql-test/std_data/cacert.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/client-cert.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/client-key.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/server-cert-des.pem:
Bug #42366: Removed the ones that are not needed.
mysql-test/std_data/server-cert.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/server-key-des.pem:
Bug #42366: Removed the ones that are not needed.
mysql-test/std_data/server-key.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/server8k-cert.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/std_data/server8k-key.pem:
Bug #42366: Re-generated the PKI files needed.
mysql-test/t/openssl_1.test:
Bug #42366: Updated the tests to reference the correct SSL subject
using crashes server
When the server is configured to use a RSA key, and when the client sends
a cipher-suite list that contains a non-RSA key as acceptable, the server
would try to process that key even though it was impossible.
Now, yaSSL sets its own acceptable-cipher list according to what kind of
key the server is started with, and will never explore and try to pair
impossible combinations.
This involves a partial import of the current YaSSL tree, not the whole
thing, so as to try to avoid introducing new bugs.
(Updated to avoid many whitespace changes and make diff smaller.)
into ibm.:/home/alik/Documents/MySQL/devel/5.1-rt-merge
mysql-test/r/mysqldump-max.result:
Auto merged
mysql-test/r/openssl_1.result:
Auto merged
mysql-test/t/show_check.test:
Auto merged
sql/sp.cc:
Auto merged
sql/sql_yacc.yy:
Auto merged
client/mysqldump.c:
Manual merge.
mysql-test/r/mysqldump.result:
Manual merge + use local.
binary SHOW CREATE TABLE or SELECT FROM I_S.
The problem is that mysqldump generates incorrect dump for a table
with non-ASCII column name if the mysqldump's character set is
ASCII.
The fix is to:
1. Switch character_set_client for the mysqldump's connection
to binary before issuing SHOW CREATE TABLE statement in order
to avoid conversion.
2. Dump switch character_set_client statements to UTF8 and back
for CREATE TABLE statement.
client/mysqldump.c:
1. Switch character_set_client for the mysqldump's connection
to binary before issuing SHOW CREATE TABLE statement in order
to avoid conversion.
2. Dump switch character_set_client statements to UTF8 and back
for CREATE TABLE statement.
mysql-test/r/mysqldump-max.result:
Update result file.
mysql-test/r/mysqldump.result:
Update result file.
mysql-test/r/openssl_1.result:
Update result file.
mysql-test/r/show_check.result:
Update result file.
mysql-test/t/show_check.test:
Test case:
- create a table with non-ASCII column name;
- dump the database by mysqldump using ASCII character set;
- drop the database;
- load the dump;
- check that the table has been re-created properly.
mysql-test/r/compress.result:
result fix
mysql-test/r/information_schema.result:
result fix
mysql-test/r/openssl_1.result:
result fix
mysql-test/r/rpl_packet.result:
result fix
mysql-test/r/status.result:
result fix
- Add testcase for SSL connection from mysqldump to mysqld
mysql-test/r/openssl_1.result:
Add test result
mysql-test/t/openssl_1.test:
Add test case for mysqldump with SSL connection to mysqld
into pilot.blaudden:/home/msvensson/mysql/mysql-5.1-maint
sql/mysqld.cc:
Auto merged
vio/viosslfactories.c:
Auto merged
mysql-test/r/openssl_1.result:
Manual merge
mysql-test/t/openssl_1.test:
Manual merge
Apparently it's the only platform in pushbuild where we
compile without openssl.
mysql-test/r/information_schema.result:
Update results.
mysql-test/r/openssl_1.result:
Update results.
mysql-test/t/information_schema.test:
Move the part of the test case that needs SSL support to
openssl_1.test
mysql-test/t/openssl_1.test:
Add a test case that needs SSL support.
- Change check for return value of 'SSL_CTX_set_cipher_list'
in order to handle 0 as error setting cipher.
- Thanks to Dan Lukes for finding the problem!
mysql-test/r/openssl_1.result:
Update result
mysql-test/t/openssl_1.test:
Add test for setting ssl-cipher to be used
vio/viosslfactories.c:
Change error handling of SSL_CTX_set_cipher_list to
detect 0 as an error
- Turn off verification of peer if both ca_path and ca_file is null
i.e from only passing --ssl-key=<client_key> and --ssl-cert=<client_cert>
to the mysql utility programs.
The server will authenticate the client accoring to GRANT tables
but the client won't authenticate the server
mysql-test/r/openssl_1.result:
Update result file
mysql-test/t/openssl_1.test:
Test that it's possible to connect with --ssl-ca set to /dev/null
vio/viosslfactories.c:
Turn off verification of peer if both ca_file and ca_path is NULL
- Small difference in output from 'X509_NAME_Oneline' between OpenSSL and yaSSL. OpenSSL uses
an extension that allow's the email adress of the cert holder.
- Imported patch for yaSSL "add email to DN output"
extra/yassl/taocrypt/src/asn.cpp:
Import patch yassl.diff
mysql-test/r/openssl_1.result:
Update result file
mysql-test/t/openssl_1.test:
Update test to include "emailAddress=" tag in the required SUBJECT for grant.
when X.509 subject was required for a connect, we tested whether it was the right
one, but did not refuse the connexion if not. fixed.
(corrected CS now --replace_results socket-path)
mysql-test/r/openssl_1.result:
Bug#20411: "GRANT ... REQUIRE ISSUER nnn AND SUBJECT mmm" fails to require both
test not only whether we can connect with a correct X.509 subject when one is
required, but also assure that we can't without one.
mysql-test/t/openssl_1.test:
Bug#20411: "GRANT ... REQUIRE ISSUER nnn AND SUBJECT mmm" fails to require both
test not only whether we can connect with a correct X.509 subject when one is
required, but also assure that we can't without one.
sql/sql_acl.cc:
Bug#20411: "GRANT ... REQUIRE ISSUER nnn AND SUBJECT mmm" fails to require both
actually refuse connexion if X.509 is required, but does not match. kudos to Al Smith.
mysql-test/r/ctype_latin2_ch.result:
Drot table at end of test
mysql-test/r/grant2.result:
Drop users
mysql-test/r/openssl_1.result:
Drop users
mysql-test/r/rpl_openssl.result:
Drop users
mysql-test/r/sp-security.result:
Drop users
mysql-test/r/sp_notembedded.result:
Drop table
mysql-test/r/trigger.result:
Drop table
mysql-test/t/ctype_latin2_ch.test:
Drop table
mysql-test/t/grant2.test:
Drop users
mysql-test/t/openssl_1.test:
Drop users
mysql-test/t/rpl_openssl.test:
Drop users
mysql-test/t/sp-security.test:
Drop users
mysql-test/t/sp_notembedded.test:
Drop table
mysql-test/t/trigger.test:
Drop table
- Added show status variable "compression" for checking that compression is turned on.
- Updated show status variable "have_openssl" to be set to DISABLED if server supports ssl but it's not turned on to accept incoming ssl connections.
- Setup server to accept ssl connections from clients ig that is supported by server
- New tests
- ssl - Run with ssl turned on
- ssl_compress - Run with ssl and compression turned on
- compress - Run with compression turned in
- Updated test
- openssl_1, rpl_openssl1 - Changed to run if server supports ssl
BitKeeper/deleted/.del-have_openssl_1.inc~55590efedeec9ee0:
Delete: mysql-test/include/have_openssl_1.inc
BitKeeper/deleted/.del-have_openssl_1.require~e8cdeb0adba99ac5:
Delete: mysql-test/r/have_openssl_1.require
client/mysqltest.c:
Add commands to enable/disable ssl for the follwing connect's
Add commands to enable/disable compression for the following connect's
mysql-test/mysql-test-run.pl:
Test if ssl is supported by the server
If ssl is supported by the server, start server with ability to accept ssl connections from clients
Cleanup check of supported features check_ssl_support, check_ndbcluster_support
Flags and helptext for mysl-test-run.pl updated
--ssl, turn on ssl encryption between server and client
--skip-ssl, don'r turn on ssl or setup ssl even if it's supported
--with-openssl, deprecated, synonym with --ssl
mysql-test/r/openssl_1.result:
Update test results
mysql-test/t/openssl_1.test:
Run this if server reports it has support for ssl
Enable ssl before connecting
Check that ssl encryption has been turned on
mysql-test/t/rpl_openssl.test:
Run this if server reports it supports ssl
sql-common/client.c:
Add DBUG_PRINT's
sql/mysqld.cc:
If server can't accept ssl connection set have_openssl to SHOW_OPTION_DISABLED
Add status variable to show if connection with server is using compressed protocol
sql/sql_show.cc:
Add status variable to show if connection with server is using compressed protocol
sql/structs.h:
Add status variable to show if connection with server is using compressed protocol
mysql-test/r/compress.result:
New BitKeeper file ``mysql-test/r/compress.result''
mysql-test/r/ssl.result:
New BitKeeper file ``mysql-test/r/ssl.result''
mysql-test/r/ssl_compress.result:
New BitKeeper file ``mysql-test/r/ssl_compress.result''
mysql-test/t/compress.test:
New BitKeeper file ``mysql-test/t/compress.test''
mysql-test/t/ssl.test:
New BitKeeper file ``mysql-test/t/ssl.test''
mysql-test/t/ssl_compress.test:
New BitKeeper file ``mysql-test/t/ssl_compress.test''
openssl_1 and rpl_openssl results difference
mysql-test/r/openssl_1.result:
Fix expected error messages.
mysql-test/r/rpl_openssl.result:
Fix show slave status output. This fix makes rpl_openssl work with openssl-0.9.7 and yassl.
mysql-test/t/openssl_1.test:
Fix expected error codes.
Update SSL Cipher so that 'openssl_1' test passes (BUG#6152)
mysql-test/t/openssl_1.test:
Update SSL Cipher so that 'openssl_1' test passes (BUG#6152)
mysql-test/r/have_openssl_1.require:
Update SSL Cipher so that 'openssl_1' test passes (BUG#6152)
mysql-test/r/openssl_1.result:
Update SSL Cipher so that 'openssl_1' test passes (BUG#6152)
BitKeeper/etc/logging_ok:
Logging to logging@openlogging.org accepted
BitKeeper/etc/ignore:
auto-union
BitKeeper/etc/logging_ok:
auto-union
BitKeeper/deleted/.del-database.c~af098622e818ce0d:
Auto merged
BitKeeper/deleted/.del-have_openssl_2.inc~8c9f1a45676b698f:
Auto merged
BitKeeper/deleted/.del-have_openssl_2.require~53bbdfc136fb514:
Auto merged
BitKeeper/deleted/.del-mini_client.cc~8677895ec8169183:
Auto merged
BitKeeper/deleted/.del-openssl_2.test~f2dfa927f19d14f8:
Auto merged
Build-tools/Bootstrap:
Auto merged
Build-tools/Do-compile:
Auto merged
SSL/cacert.pem:
Auto merged
acconfig.h:
Auto merged
acinclude.m4:
Auto merged
configure.in:
Auto merged
SSL/client-cert.pem:
Auto merged
SSL/client-key.pem:
Auto merged
SSL/server-cert.pem:
Auto merged
SSL/server-key.pem:
Auto merged
VC++Files/client/mysql.dsp:
Auto merged
VC++Files/client/mysqladmin.dsp:
Auto merged
VC++Files/client/mysqlclient.dsp:
Auto merged
VC++Files/client/mysqldump.dsp:
Auto merged
VC++Files/client/mysqlimport.dsp:
Auto merged
VC++Files/client/mysqlshow.dsp:
Auto merged
VC++Files/comp_err/comp_err.dsp:
Auto merged
VC++Files/innobase/innobase.dsp:
Auto merged
VC++Files/isamchk/isamchk.dsp:
Auto merged
VC++Files/libmysql/libmysql.dsp:
Auto merged
VC++Files/libmysqltest/myTest.dsp:
Auto merged
VC++Files/my_print_defaults/my_print_defaults.dsp:
Auto merged
VC++Files/myisamlog/myisamlog.dsp:
Auto merged
VC++Files/mysql.dsw:
Auto merged
VC++Files/mysqlbinlog/mysqlbinlog.dsp:
Auto merged
VC++Files/mysqlcheck/mysqlcheck.dsp:
Auto merged
VC++Files/mysqlmanager/MySqlManager.dsp:
Auto merged
VC++Files/mysqlserver/mysqlserver.dsp:
Auto merged
VC++Files/mysqlshutdown/mysqlshutdown.dsp:
Auto merged
VC++Files/mysys/mysys.dsp:
Auto merged
VC++Files/pack_isam/pack_isam.dsp:
Auto merged
VC++Files/perror/perror.dsp:
Auto merged
VC++Files/replace/replace.dsp:
Auto merged
VC++Files/test1/test1.dsp:
Auto merged
VC++Files/thr_test/thr_test.dsp:
Auto merged
VC++Files/vio/vio.dsp:
Auto merged
VC++Files/zlib/zlib.dsp:
Auto merged
client/mysqlbinlog.cc:
Auto merged
client/mysqldump.c:
Auto merged
client/mysqlimport.c:
Auto merged
extra/my_print_defaults.c:
Auto merged
extra/resolveip.c:
Auto merged
include/m_string.h:
Auto merged
include/my_sys.h:
Auto merged
include/mysql_com.h:
Auto merged
innobase/dict/dict0dict.c:
Auto merged
innobase/os/os0file.c:
Auto merged
isam/_search.c:
Auto merged
libmysql/Makefile.am:
Auto merged
libmysql/errmsg.c:
Auto merged
libmysql/libmysql.c:
Auto merged
myisam/mi_check.c:
Auto merged
myisam/mi_create.c:
Auto merged
myisam/mi_open.c:
Auto merged
myisam/mi_search.c:
Auto merged
myisam/mi_write.c:
Auto merged
myisam/myisamchk.c:
Auto merged
myisam/myisamlog.c:
Auto merged
mysql-test/mysql-test-run.sh:
Auto merged
mysql-test/r/group_by.result:
Auto merged
mysql-test/r/isam.result:
Auto merged
mysql-test/r/loaddata.result:
Auto merged
mysql-test/r/lowercase_table.result:
Auto merged
mysql-test/r/multi_update.result:
Auto merged
mysql-test/r/openssl_1.result:
Auto merged
mysql-test/r/packet.result:
Auto merged
mysql-test/r/query_cache.result:
Auto merged
mysql-test/r/range.result:
Auto merged
mysql-test/r/select_safe.result:
Auto merged
mysql-test/r/show_check.result:
Auto merged
mysql-test/t/grant.test:
Auto merged
mysql-test/t/group_by.test:
Auto merged
mysql-test/t/lock_tables_lost_commit-master.opt:
Auto merged
mysql-test/t/lowercase_table.test:
Auto merged
mysql-test/t/multi_update.test:
Auto merged
mysql-test/t/openssl_1.test:
Auto merged
mysql-test/t/range.test:
Auto merged
mysql-test/t/rpl_loaddata.test:
Auto merged
mysql-test/t/rpl_log.test:
Auto merged
mysql-test/t/select_safe.test:
Auto merged
mysql-test/t/show_check.test:
Auto merged
mysql-test/t/symlink.test:
Auto merged
mysys/default.c:
Auto merged
mysys/my_getopt.c:
Auto merged
mysys/my_pthread.c:
Auto merged
scripts/make_binary_distribution.sh:
Auto merged
scripts/make_win_src_distribution.sh:
Auto merged
scripts/mysql_install_db.sh:
Auto merged
scripts/mysqld_safe.sh:
Auto merged
sql/ha_innodb.cc:
Auto merged
sql/ha_myisam.cc:
Auto merged
sql/handler.cc:
Auto merged
sql/item_uniq.h:
Auto merged
sql/log_event.h:
Auto merged
sql/net_serv.cc:
Auto merged
sql/repl_failsafe.cc:
Auto merged
sql/sql_class.cc:
Auto merged
sql/sql_class.h:
Auto merged
sql/sql_load.cc:
Auto merged
sql/sql_repl.cc:
Auto merged
sql/sql_update.cc:
Auto merged
vio/Makefile.am:
Auto merged
vio/vio.c:
Auto merged
mysql-test/t/myisam.test:
merge with 4.0.15
Extra tests
mysys/mf_keycache.c:
Keep local file
