mirror of
https://github.com/MariaDB/server.git
synced 2025-01-16 03:52:35 +01:00
5dae19b394
BUILD/compile-alpha-cxx: Building on Alpha with Compaq C and C+++ Docs/manual.texi: Changelogs and update of links myisam/mi_key.c: Fixed multi_part keys where first part where of TEXT/BLOB type mysys/Makefile.am: Makefile.am now works with Compaq make sql-bench/Results/ATIS-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/RUN-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/alter-table-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/big-tables-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/connect-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/create-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/insert-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/select-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/Results/wisconsin-mysql-Linux_2.2.13_SMP_alpha: New benchmark results sql-bench/test-select.sh: Made the count_distinct_big test a bit smaller sql/log.cc: Changed the slow log format to have more information by default sql/mysqld.cc: false->FALSE sql/share/german/errmsg.sys: Update of messages sql/share/german/errmsg.txt: Update of messages sql/sql_base.cc: Fixed SELECT DISTINCT * sql/sql_insert.cc: Cleanup sql/sql_table.cc: Added logging of DROP of temporary tables vio/VioFd.cc: false -> FALSE vio/VioSSL.cc: false -> FALSE vio/VioSSLFactoriesFd.cc: false -> FALSE vio/VioSocket.cc: false -> FALSE
360 lines
9.7 KiB
C++
360 lines
9.7 KiB
C++
/*
|
|
** Virtual I/O library
|
|
** Written by Andrei Errapart <andreie@no.spam.ee>
|
|
*/
|
|
|
|
#include "vio-global.h"
|
|
|
|
#ifdef VIO_HAVE_OPENSSL
|
|
|
|
#ifdef __GNUC__
|
|
#pragma implementation // gcc: Class implementation
|
|
#endif
|
|
|
|
#include <netinet/in.h>
|
|
#include <openssl/x509.h>
|
|
#include <openssl/ssl.h>
|
|
#include <openssl/err.h>
|
|
#include <openssl/pem.h>
|
|
#include <openssl/asn1.h>
|
|
|
|
VIO_NS_BEGIN
|
|
|
|
#define this_ssl_method my_static_cast(SSL_METHOD*)(this->ssl_method_)
|
|
#define this_ssl_context my_static_cast(SSL_CTX*)(this->ssl_context_)
|
|
typedef unsigned char* ssl_data_ptr_t;
|
|
|
|
static bool ssl_algorithms_added = FALSE;
|
|
static bool ssl_error_strings_loaded= FALSE;
|
|
static int verify_depth = 0;
|
|
static int verify_error = X509_V_OK;
|
|
|
|
static int
|
|
vio_verify_callback(int ok, X509_STORE_CTX *ctx)
|
|
{
|
|
DBUG_ENTER("vio_verify_callback");
|
|
DBUG_PRINT("enter", ("ok=%d, ctx=%p", ok, ctx));
|
|
char buf[256];
|
|
X509* err_cert;
|
|
int err,depth;
|
|
|
|
err_cert=X509_STORE_CTX_get_current_cert(ctx);
|
|
err= X509_STORE_CTX_get_error(ctx);
|
|
depth= X509_STORE_CTX_get_error_depth(ctx);
|
|
|
|
X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof(buff));
|
|
if (!ok)
|
|
{
|
|
DBUG_PRINT("error",("verify error:num=%d:%s\n",err,
|
|
X509_verify_cert_error_string(err)));
|
|
if (verify_depth >= depth)
|
|
{
|
|
ok=1;
|
|
verify_error=X509_V_OK;
|
|
}
|
|
else
|
|
{
|
|
ok=0;
|
|
verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
|
|
}
|
|
}
|
|
switch (ctx->error) {
|
|
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
|
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);
|
|
DBUG_PRINT("info",("issuer= %s\n",buf));
|
|
break;
|
|
case X509_V_ERR_CERT_NOT_YET_VALID:
|
|
case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
|
|
DBUG_PRINT("error", ("notBefore"));
|
|
//ASN1_TIME_print_fp(stderr,X509_get_notBefore(ctx->current_cert));
|
|
break;
|
|
case X509_V_ERR_CERT_HAS_EXPIRED:
|
|
case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
|
|
DBUG_PRINT("error", ("notAfter error"));
|
|
//ASN1_TIME_print_fp(stderr,X509_get_notAfter(ctx->current_cert));
|
|
break;
|
|
}
|
|
DBUG_PRINT("exit", ("r=%d", ok));
|
|
DBUG_RETURN(ok);
|
|
}
|
|
|
|
|
|
static int
|
|
vio_set_cert_stuff(SSL_CTX *ctx, const char *cert_file, const char *key_file)
|
|
{
|
|
DBUG_ENTER("vio_set_cert_stuff");
|
|
DBUG_PRINT("enter", ("ctx=%p, cert_file=%p, key_file=%p",
|
|
ctx, cert_file, key_file));
|
|
if (cert_file != NULL)
|
|
{
|
|
if (SSL_CTX_use_certificate_file(ctx,cert_file,SSL_FILETYPE_PEM) <= 0)
|
|
{
|
|
DBUG_PRINT("error",("unable to get certificate from '%s'\n",cert_file));
|
|
/* FIX stderr */
|
|
ERR_print_errors_fp(stderr);
|
|
DBUG_RETURN(0);
|
|
}
|
|
if (key_file == NULL)
|
|
key_file = cert_file;
|
|
if (SSL_CTX_use_PrivateKey_file(ctx,key_file,
|
|
SSL_FILETYPE_PEM) <= 0)
|
|
{
|
|
DBUG_PRINT("error", ("unable to get private key from '%s'\n",key_file));
|
|
/* FIX stderr */
|
|
ERR_print_errors_fp(stderr);
|
|
DBUG_RETURN(0);
|
|
}
|
|
|
|
/* If we are using DSA, we can copy the parameters from
|
|
* the private key */
|
|
/* Now we know that a key and cert have been set against
|
|
* the SSL context */
|
|
if (!SSL_CTX_check_private_key(ctx))
|
|
{
|
|
DBUG_PRINT("error", ("Private key does not match the certificate public key\n"));
|
|
DBUG_RETURN(0);
|
|
}
|
|
}
|
|
DBUG_RETURN(1);
|
|
}
|
|
|
|
/************************ VioSSLConnectorFd **********************************/
|
|
VioSSLConnectorFd::VioSSLConnectorFd(const char* key_file,
|
|
const char* cert_file,
|
|
const char* ca_file,
|
|
const char* ca_path)
|
|
:ssl_context_(0),ssl_method_(0)
|
|
{
|
|
DBUG_ENTER("VioSSLConnectorFd::VioSSLConnectorFd");
|
|
DBUG_PRINT("enter",
|
|
("this=%p, key_file=%s, cert_file=%s, ca_path=%s, ca_file=%s",
|
|
this, key_file, cert_file, ca_path, ca_file));
|
|
|
|
/* FIXME: constants! */
|
|
int verify = SSL_VERIFY_PEER;
|
|
|
|
if (!ssl_algorithms_added)
|
|
{
|
|
DBUG_PRINT("info", ("todo: SSLeay_add_ssl_algorithms()"));
|
|
ssl_algorithms_added = true;
|
|
SSLeay_add_ssl_algorithms();
|
|
}
|
|
if (!ssl_error_strings_loaded)
|
|
{
|
|
DBUG_PRINT("info", ("todo:SSL_load_error_strings()"));
|
|
ssl_error_strings_loaded = true;
|
|
SSL_load_error_strings();
|
|
}
|
|
ssl_method_ = SSLv3_client_method();
|
|
ssl_context_ = SSL_CTX_new(this_ssl_method);
|
|
if (ssl_context_ == 0)
|
|
{
|
|
DBUG_PRINT("error", ("SSL_CTX_new failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
/*
|
|
* SSL_CTX_set_options
|
|
* SSL_CTX_set_info_callback
|
|
* SSL_CTX_set_cipher_list
|
|
*/
|
|
SSL_CTX_set_verify(this_ssl_context, verify, vio_verify_callback);
|
|
if (vio_set_cert_stuff(this_ssl_context, cert_file, key_file) == -1)
|
|
{
|
|
DBUG_PRINT("error", ("vio_set_cert_stuff failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
if (SSL_CTX_load_verify_locations( this_ssl_context, ca_file,ca_path)==0)
|
|
{
|
|
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
|
|
if (SSL_CTX_set_default_verify_paths(this_ssl_context)==0)
|
|
{
|
|
DBUG_PRINT("error", ("SSL_CTX_set_default_verify_paths failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
}
|
|
DBUG_VOID_RETURN;
|
|
ctor_failure:
|
|
DBUG_PRINT("exit", ("there was an error"));
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
VioSSLConnectorFd::~VioSSLConnectorFd()
|
|
{
|
|
DBUG_ENTER("VioSSLConnectorFd::~VioSSLConnectorFd");
|
|
DBUG_PRINT("enter", ("this=%p", this));
|
|
if (ssl_context_!=0)
|
|
SSL_CTX_free(this_ssl_context);
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
VioSSL* VioSSLConnectorFd::connect( int fd)
|
|
{
|
|
DBUG_ENTER("VioSSLConnectorFd::connect");
|
|
DBUG_PRINT("enter", ("this=%p, fd=%d", this, fd));
|
|
DBUG_RETURN(new VioSSL(fd, ssl_context_, VioSSL::state_connect));
|
|
}
|
|
|
|
VioSSL*
|
|
VioSSLConnectorFd::connect( VioSocket* sd)
|
|
{
|
|
DBUG_ENTER("VioSSLConnectorFd::connect");
|
|
DBUG_PRINT("enter", ("this=%p, sd=%s", this, sd->description()));
|
|
DBUG_RETURN(new VioSSL(sd, ssl_context_, VioSSL::state_connect));
|
|
}
|
|
|
|
void
|
|
VioSSLConnectorFd::report_errors()
|
|
{
|
|
unsigned long l;
|
|
const char* file;
|
|
const char* data;
|
|
int line,flags;
|
|
|
|
DBUG_ENTER("VioSSLConnectorFd::report_errors");
|
|
DBUG_PRINT("enter", ("this=%p", this));
|
|
|
|
while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0)
|
|
{
|
|
char buf[200];
|
|
DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf),
|
|
file,line,(flags&ERR_TXT_STRING)?data:"")) ;
|
|
}
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
/************************ VioSSLAcceptorFd **********************************/
|
|
|
|
VioSSLAcceptorFd::VioSSLAcceptorFd(const char* key_file,
|
|
const char* cert_file,
|
|
const char* ca_file,
|
|
const char* ca_path)
|
|
:ssl_context_(0), ssl_method_(0)
|
|
{
|
|
DBUG_ENTER("VioSSLAcceptorFd::VioSSLAcceptorFd");
|
|
DBUG_PRINT("enter",
|
|
("this=%p, key_file=%s, cert_file=%s, ca_path=%s, ca_file=%s",
|
|
this, key_file, cert_file, ca_path, ca_file));
|
|
|
|
/* FIXME: constants! */
|
|
int verify = (SSL_VERIFY_PEER |
|
|
SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
|
|
SSL_VERIFY_CLIENT_ONCE);
|
|
session_id_context_ = static_cast<vio_ptr>(this);
|
|
|
|
if (!ssl_algorithms_added)
|
|
{
|
|
DBUG_PRINT("info", ("todo: SSLeay_add_ssl_algorithms()"));
|
|
ssl_algorithms_added = true;
|
|
SSLeay_add_ssl_algorithms();
|
|
}
|
|
if (!ssl_error_strings_loaded)
|
|
{
|
|
DBUG_PRINT("info", ("todo: SSL_load_error_strings()"));
|
|
ssl_error_strings_loaded = true;
|
|
SSL_load_error_strings();
|
|
}
|
|
ssl_method_ = SSLv3_server_method();
|
|
ssl_context_ = SSL_CTX_new(this_ssl_method);
|
|
if (ssl_context_==0)
|
|
{
|
|
DBUG_PRINT("error", ("SSL_CTX_new failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
/*
|
|
* SSL_CTX_set_quiet_shutdown(ctx,1);
|
|
*
|
|
*/
|
|
SSL_CTX_sess_set_cache_size(this_ssl_context,128);
|
|
|
|
/* DH?
|
|
*/
|
|
SSL_CTX_set_verify(this_ssl_context, verify, vio_verify_callback);
|
|
/*
|
|
* Double cast needed at least for egcs-1.1.2 to
|
|
* supress warnings:
|
|
* 1) ANSI C++ blaah implicit cast from 'void*' to 'unsigned char*'
|
|
* 2) static_cast from 'void**' to 'unsigned char*'
|
|
* Wish I had a copy of standard handy...
|
|
*/
|
|
SSL_CTX_set_session_id_context(this_ssl_context,
|
|
my_static_cast(ssl_data_ptr_t)
|
|
(my_static_cast(void*)(&session_id_context_)),
|
|
sizeof(session_id_context_));
|
|
|
|
/*
|
|
* SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
|
|
*/
|
|
if (vio_set_cert_stuff(this_ssl_context, cert_file, key_file) == -1)
|
|
{
|
|
DBUG_PRINT("error", ("vio_set_cert_stuff failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
if (SSL_CTX_load_verify_locations( this_ssl_context, ca_file, ca_path)==0)
|
|
{
|
|
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
|
|
if (SSL_CTX_set_default_verify_paths(this_ssl_context)==0)
|
|
{
|
|
DBUG_PRINT("error", ("SSL_CTX_set_default_verify_paths failed"));
|
|
report_errors();
|
|
goto ctor_failure;
|
|
}
|
|
}
|
|
DBUG_VOID_RETURN;
|
|
ctor_failure:
|
|
DBUG_PRINT("exit", ("there was an error"));
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
VioSSLAcceptorFd::~VioSSLAcceptorFd()
|
|
{
|
|
DBUG_ENTER("VioSSLAcceptorFd::~VioSSLAcceptorFd");
|
|
DBUG_PRINT("enter", ("this=%p", this));
|
|
if (ssl_context_!=0)
|
|
SSL_CTX_free(this_ssl_context);
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
VioSSL*
|
|
VioSSLAcceptorFd::accept(int fd)
|
|
{
|
|
DBUG_ENTER("VioSSLAcceptorFd::accept");
|
|
DBUG_PRINT("enter", ("this=%p, fd=%d", this, fd));
|
|
DBUG_RETURN(new VioSSL(fd, ssl_context_, VioSSL::state_accept));
|
|
}
|
|
|
|
VioSSL*
|
|
VioSSLAcceptorFd::accept(VioSocket* sd)
|
|
{
|
|
DBUG_ENTER("VioSSLAcceptorFd::accept");
|
|
DBUG_PRINT("enter", ("this=%p, sd=%s", this, sd->description()));
|
|
DBUG_RETURN(new VioSSL(sd, ssl_context_, VioSSL::state_accept));
|
|
}
|
|
|
|
void
|
|
VioSSLAcceptorFd::report_errors()
|
|
{
|
|
unsigned long l;
|
|
const char* file;
|
|
const char* data;
|
|
int line,flags;
|
|
|
|
DBUG_ENTER("VioSSLConnectorFd::report_errors");
|
|
DBUG_PRINT("enter", ("this=%p", this));
|
|
|
|
while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0)
|
|
{
|
|
char buf[200];
|
|
DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf),
|
|
file,line,(flags&ERR_TXT_STRING)?data:"")) ;
|
|
}
|
|
DBUG_VOID_RETURN;
|
|
}
|
|
|
|
VIO_NS_END
|
|
|
|
#endif /* VIO_HAVE_OPENSSL */
|