mirror of
https://github.com/MariaDB/server.git
synced 2025-06-29 16:11:24 +02:00
86ec20189a
Add ssl_passphrase server parameter, which works similarly to --passout/--passin openssl command line parameters. Pass phrase value can be formatted as follows. - pass:password Provide actual password after the pass: prefix. - env:var Obtain the password from the environment variable 'var'a - file:pathname Reads the password from the specified file pathname. Only the first line, up to the newline character, is read from the stream. If ssl_passphrase was set, SHOW VARIABLE will show "file:", "env:" or "pass:" (but won't reveal sensitive data)
75 lines
3.5 KiB
Text
75 lines
3.5 KiB
Text
# mysqld refuses to run as root normally.
|
|
--source include/not_as_root.inc
|
|
|
|
--source include/not_embedded.inc
|
|
--source include/have_ssl_communication.inc
|
|
|
|
--source include/shutdown_mysqld.inc
|
|
|
|
# Try to start the server, with bad values for some options.
|
|
# Make sure, the starts fails, and expected message is in the error log
|
|
|
|
--let errorlog=$MYSQL_TMP_DIR/errorlog.err
|
|
--let SEARCH_FILE=$errorlog
|
|
|
|
# Bad ssl-cert
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-cert=bad --log-error=$errorlog
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get certificate
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
# No valid cipher suites
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-cipher=ECDHE-ECDSA-FAKE-CIPHER:ECDHE-RSA-INVALID --log-error=$errorlog
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Failed to set ciphers to use
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
# Wrong SSL passphrase(pass)
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-key=$MYSQL_TEST_DIR/std_data/encrypted-server-key.pem --ssl-passphrase=pass:BadPassword --log-error=$errorlog
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get private key
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
# Bad SSL passphrase(file)
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --secure-file-priv=$MYSQLTEST_VARDIR/tmp --ssl-key=$MYSQL_TEST_DIR/std_data/encrypted-server-key.pem --ssl-passphrase=file:BadFile --log-error=$errorlog
|
|
--let SEARCH_PATTERN=SSL passphrase error: failed to open file 'BadFile'
|
|
--source include/search_pattern_in_file.inc
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get private key
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
|
|
# Check "insecure SSL passphrase file location" warning (secure-file-priv empty)
|
|
# We still let it fail later, by supply non-existing file
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --secure-file-priv= --ssl-key=$MYSQL_TEST_DIR/std_data/encrypted-server-key.pem --ssl-passphrase=file:$BadFile --log-error=$errorlog
|
|
--let SEARCH_PATTERN=\[Warning\] ssl passphrase file '.*' is not secure
|
|
--source include/search_pattern_in_file.inc
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get private key
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
|
|
# Bad SSL passphrase(env)
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-key=$MYSQL_TEST_DIR/std_data/encrypted-server-key.pem --ssl-passphrase=env:BadEnv --log-error=$errorlog
|
|
--let SEARCH_PATTERN=SSL passphrase error: environment variable 'BadEnv' not found
|
|
--source include/search_pattern_in_file.inc
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get private key
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
# Bad SSL passphrase(invalid prefix)
|
|
--error 1
|
|
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-key=$MYSQL_TEST_DIR/std_data/encrypted-server-key.pem --ssl-passphrase=BadVal --log-error=$errorlog
|
|
--let SEARCH_PATTERN=SSL passphrase error: ssl-passphrase value must be prefixed with 'file:', 'env:', or 'pass:'
|
|
--source include/search_pattern_in_file.inc
|
|
--let SEARCH_PATTERN=\[ERROR\] SSL error: Unable to get private key
|
|
--source include/search_pattern_in_file.inc
|
|
--remove_file $SEARCH_FILE
|
|
|
|
--source include/start_mysqld.inc
|