mirror of
https://github.com/MariaDB/server.git
synced 2025-01-19 05:22:25 +01:00
3227ba706f
ChangeSet@1.2703, 2007-12-07 09:35:28-05:00, cmiller@zippy.cornsilk.net +40 -0 Bug#13174: SHA2 function Patch contributed from Bill Karwin, paper unnumbered CLA in Seattle Implement SHA2 functions. Chad added code to make it work with YaSSL. Also, he removed the (probable) bug of embedded server never using SSL-dependent functions. (libmysqld/Makefile.am didn't read ANY autoconf defs.) Function specification: SHA2( string cleartext, integer hash_length ) -> string hash, or NULL where hash_length is one of 224, 256, 384, or 512. If either is NULL or a length is unsupported, then the result is NULL. The resulting string is always the length of the hash_length parameter or is NULL. Include the canonical hash examples from the NIST in the test results. --- Polish and address concerns of reviewers. .bzrignore: Added libmysqld/sha2.cc to the ignore list. client/mysql.cc: Add condition to remove code for embedded server. client/mysqltest.cc: Add condition to remove code for embedded server. include/Makefile.am: New header file to header list. include/mysql_embed.h: Embedded servers can use SSL-library functions too! include/sha2.h: Compatibility layer to make YaSSL behave like OpenSSL. include/sslopt-case.h: Remove SSL-communication parameters from command lines. include/sslopt-longopts.h: Remove SSL-communication parameters from command lines. include/sslopt-vars.h: Don't declare variables that are only used in SSL communication, if we are compiling the embedded server. include/violite.h: Don't even compile the SSL-communication function if we're in the embedded server. --- Remove CPP condition indentation. libmysqld/CMakeLists.txt: Add new file to source list. libmysqld/Makefile.am: Include standard DEFS in embedded compilation. It's an undiscovered but that it's not there. Add new file to source list. libmysqld/examples/Makefile.am: Include autoconf DEFS. libmysqld/lib_sql.cc: Initialize SSL-related variables in embedded server. mysql-test/include/have_ssl_crypto_functs.inc: Distinguish between communication and crypto. Use the tristate value of "have_ssl" variable to know whether to test or not for SSL-provided crypto functions. mysql-test/r/func_digest.result: Test against the sample test vectors in the NIST Secure Hash Standard (http://csrc.nist.gov/cryptval/shs.htm) mysql-test/r/func_encrypt_nossl.result: Update results to the new error message text. mysql-test/r/have_ssl_is_yes_or_disabled_only.require: Distinguish between communication and crypto. Use the tristate value of "have_ssl" variable to know whether to test or not for SSL-provided crypto functions. mysql-test/suite/rpl/t/rpl_ssl.test: Distinguish between communication and crypto. mysql-test/suite/rpl/t/rpl_ssl1.test: Distinguish between communication and crypto. mysql-test/t/func_des_encrypt.test: Distinguish between communication and crypto. mysql-test/t/func_digest.test: Test against the sample test vectors in the NIST Secure Hash Standard (http://csrc.nist.gov/cryptval/shs.htm) Also, test that various parameters (legal and illegal) do what we expect. --- Distinguish between communication and crypto. mysql-test/t/func_encrypt.test: Distinguish between communication and crypto. mysql-test/t/openssl_1.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. mysql-test/t/ssl-big.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. mysql-test/t/ssl.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. mysql-test/t/ssl_8k_key.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. mysql-test/t/ssl_compress.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. mysql-test/t/ssl_connect.test: Don't test SSL communication if we're in the embedded server. --- Distinguish between communication and crypto. sql-common/client.c: SSL is useful for more functionality than just connecting. Test for whether we are not embedded server also. sql/CMakeLists.txt: Add new source file to source list so that we have access to SHA2 functions. sql/Makefile.am: Add new source file to source list so that we have access to SHA2 functions. sql/item_create.cc: Bootstrap the SHA2 function into the server. sql/item_strfunc.cc: Add new SHA2 Item class methods. Clean up two minor problems. --- Remove extraneous debugging. --- We must check nullness of a parameter only /after/ computing its value. sql/item_strfunc.h: Declare new SHA2 Item class. sql/mysqld.cc: For embedded server, don't refer to SSL-communications variables or values. --- Remove CPP condition indentation. sql/sha2.cc: Compatibility layer to make YaSSL behave like OpenSSL. --- Add comment for generated functions. sql/sql_acl.cc: For embedded server, don't refer to SSL-communications variables or values. sql/sql_connect.cc: SSL is useful for more functionality than just connecting. Test for whether we are not embedded server also. sql/sys_vars.cc: For embedded server, don't refer to SSL-communications variables or values.
256 lines
8.6 KiB
Text
256 lines
8.6 KiB
Text
# Tests for SSL connections, only run if mysqld is compiled
|
|
# with support for SSL.
|
|
|
|
-- source include/have_ssl_communication.inc
|
|
|
|
# Save the initial number of concurrent sessions
|
|
--source include/count_sessions.inc
|
|
|
|
|
|
--disable_warnings
|
|
drop table if exists t1;
|
|
--enable_warnings
|
|
create table t1(f1 int);
|
|
insert into t1 values (5);
|
|
|
|
grant select on test.* to ssl_user1@localhost require SSL;
|
|
grant select on test.* to ssl_user2@localhost require cipher "DHE-RSA-AES256-SHA";
|
|
grant select on test.* to ssl_user3@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Uppsala/O=MySQL AB";
|
|
grant select on test.* to ssl_user4@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Uppsala/O=MySQL AB" ISSUER "/C=SE/ST=Uppsala/L=Uppsala/O=MySQL AB";
|
|
grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx";
|
|
flush privileges;
|
|
|
|
connect (con1,localhost,ssl_user1,,,,,SSL);
|
|
connect (con2,localhost,ssl_user2,,,,,SSL);
|
|
connect (con3,localhost,ssl_user3,,,,,SSL);
|
|
connect (con4,localhost,ssl_user4,,,,,SSL);
|
|
--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
|
|
--error ER_ACCESS_DENIED_ERROR
|
|
connect (con5,localhost,ssl_user5,,,,,SSL);
|
|
|
|
connection con1;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error ER_TABLEACCESS_DENIED_ERROR
|
|
delete from t1;
|
|
|
|
connection con2;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error ER_TABLEACCESS_DENIED_ERROR
|
|
delete from t1;
|
|
|
|
connection con3;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error ER_TABLEACCESS_DENIED_ERROR
|
|
delete from t1;
|
|
|
|
connection con4;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error ER_TABLEACCESS_DENIED_ERROR
|
|
delete from t1;
|
|
|
|
connection default;
|
|
disconnect con1;
|
|
disconnect con2;
|
|
disconnect con3;
|
|
disconnect con4;
|
|
drop user ssl_user1@localhost, ssl_user2@localhost,
|
|
ssl_user3@localhost, ssl_user4@localhost, ssl_user5@localhost;
|
|
|
|
drop table t1;
|
|
|
|
# End of 4.1 tests
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a different cacert
|
|
#
|
|
--exec echo "this query should not execute;" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca=$MYSQL_TEST_DIR/std_data/untrusted-cacert.pem --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank ca
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a nonexistent ca file
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca=nonexisting_file.pem --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank client-key
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-key= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank client-cert
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-cert= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Bug#21611 Slave can't connect when master-ssl-cipher specified
|
|
# - Apparently selecting a cipher doesn't work at all
|
|
# - Usa a cipher that both yaSSL and OpenSSL supports
|
|
#
|
|
--exec echo "SHOW STATUS LIKE 'Ssl_cipher'; exit;" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--exec $MYSQL_TEST --ssl-cipher=DHE-RSA-AES256-SHA < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Bug#25309 SSL connections without CA certificate broken since MySQL 5.0.23
|
|
#
|
|
# Test that we can open encrypted connection to server without
|
|
# verification of servers certificate by setting both ca certificate
|
|
# and ca path to NULL
|
|
#
|
|
--exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
|
|
--echo End of 5.0 tests
|
|
|
|
#
|
|
# Bug#26174 Server Crash: INSERT ... SELECT ... FROM I_S.GLOBAL_STATUS in
|
|
# Event (see also information_schema.test for the other part of test for
|
|
# this bug).
|
|
#
|
|
--disable_warnings
|
|
DROP TABLE IF EXISTS thread_status;
|
|
DROP EVENT IF EXISTS event_status;
|
|
--enable_warnings
|
|
|
|
SET GLOBAL event_scheduler=1;
|
|
|
|
DELIMITER $$;
|
|
|
|
CREATE EVENT event_status
|
|
ON SCHEDULE AT NOW()
|
|
ON COMPLETION NOT PRESERVE
|
|
DO
|
|
BEGIN
|
|
CREATE TABLE thread_status
|
|
SELECT variable_name, variable_value
|
|
FROM information_schema.session_status
|
|
WHERE variable_name LIKE 'SSL_ACCEPTS' OR
|
|
variable_name LIKE 'SSL_CALLBACK_CACHE_HITS';
|
|
END$$
|
|
|
|
DELIMITER ;$$
|
|
|
|
let $wait_condition=select count(*) = 0 from information_schema.events where event_name='event_status';
|
|
--source include/wait_condition.inc
|
|
|
|
# The actual value doesn't matter and can vary based on test ordering and on ssl library.
|
|
--replace_column 2 #
|
|
SELECT variable_name, variable_value FROM thread_status;
|
|
|
|
DROP TABLE thread_status;
|
|
SET GLOBAL event_scheduler=0;
|
|
|
|
#
|
|
# Test to connect using a list of ciphers
|
|
#
|
|
--exec echo "SHOW STATUS LIKE 'Ssl_cipher'; exit;" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--exec $MYSQL_TEST --ssl-cipher=UNKNOWN-CIPHER:AES128-SHA < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
|
|
# Test to connect using a specifi cipher
|
|
#
|
|
--exec echo "SHOW STATUS LIKE 'Ssl_cipher'; exit;" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--exec $MYSQL_TEST --ssl-cipher=AES128-SHA < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
# Test to connect using an unknown cipher
|
|
#
|
|
--exec echo "SHOW STATUS LIKE 'Ssl_cipher'; exit" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-cipher=UNKNOWN-CIPHER < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Bug#27669 mysqldump: SSL connection error when trying to connect
|
|
#
|
|
|
|
CREATE TABLE t1(a int);
|
|
INSERT INTO t1 VALUES (1), (2);
|
|
|
|
# Run mysqldump
|
|
--exec $MYSQL_DUMP --skip-create --skip-comments --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test t1
|
|
|
|
--exec $MYSQL_DUMP --skip-create --skip-comments --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test
|
|
|
|
--exec $MYSQL_DUMP --skip-create --skip-comments --ssl --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test
|
|
|
|
# With wrong parameters
|
|
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
|
|
--error 2
|
|
--exec $MYSQL_DUMP --skip-create --skip-comments --ssl --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test 2>&1
|
|
|
|
DROP TABLE t1;
|
|
--remove_file $MYSQLTEST_VARDIR/tmp/test.sql
|
|
|
|
#
|
|
# Bug#39172 Asking for DH+non-RSA key with server set to use other key caused
|
|
# YaSSL to crash the server.
|
|
#
|
|
|
|
# Common ciphers to openssl and yassl
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=DHE-RSA-AES256-SHA
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=EDH-RSA-DES-CBC3-SHA
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=EDH-RSA-DES-CBC-SHA
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=RC4-SHA
|
|
--disable_query_log
|
|
--disable_result_log
|
|
|
|
# Below here caused crashes. ################
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=NOT----EXIST
|
|
# These probably exist but the server's keys can't be used to accept these kinds of connections.
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=DHE-DSS-AES128-RMD
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=DHE-DSS-AES128-SHA
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=DHE-DSS-AES256-RMD
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=DHE-DSS-AES256-SHA
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=DHE-DSS-DES-CBC3-RMD
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=EDH-DSS-DES-CBC3-SHA
|
|
--error 1,0
|
|
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl-cipher';" --ssl-cipher=EDH-DSS-DES-CBC-SHA
|
|
# End of crashers. ##########################
|
|
|
|
# If this gives a result, then the bug is fixed.
|
|
--enable_result_log
|
|
--enable_query_log
|
|
select 'is still running; no cipher request crashed the server' as result from dual;
|
|
|
|
#
|
|
# Bug#42158: leak: SSL_get_peer_certificate() doesn't have matching X509_free()
|
|
#
|
|
|
|
GRANT SELECT ON test.* TO bug42158@localhost REQUIRE X509;
|
|
FLUSH PRIVILEGES;
|
|
connect(con1,localhost,bug42158,,,,,SSL);
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
disconnect con1;
|
|
connection default;
|
|
DROP USER bug42158@localhost;
|
|
|
|
--echo End of 5.1 tests
|
|
|
|
# Wait till we reached the initial number of concurrent sessions
|
|
--source include/wait_until_count_sessions.inc
|