diff options
author | Kartik Soneji <kartiksoneji@rocketmail.com> | 2021-02-17 22:43:15 +0530 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-02-17 19:13:15 +0200 |
commit | 66b8edf8a57c106b15ef1de2b25ce3e992540b71 (patch) | |
tree | 1f39b8e77ab801ca8c49cbf7eaf7a707a63d6d9b | |
parent | 9f136700042d755ab7e59cc99d593826a67e870d (diff) | |
download | mariadb-git-66b8edf8a57c106b15ef1de2b25ce3e992540b71.tar.gz |
MDEV-19168: Add ssl-flush command. (#1749)
* MDEV-19168: Add ssl-flush command.
Improve flush error messages and move error printing into the `flush` function.
-rw-r--r-- | client/mysqladmin.cc | 92 | ||||
-rw-r--r-- | mysql-test/main/mysqladmin.result | 11 | ||||
-rw-r--r-- | mysql-test/main/mysqladmin.test | 47 |
3 files changed, 75 insertions, 75 deletions
diff --git a/client/mysqladmin.cc b/client/mysqladmin.cc index 5b59cbed30d..e40e82f8038 100644 --- a/client/mysqladmin.cc +++ b/client/mysqladmin.cc @@ -109,7 +109,7 @@ enum commands { ADMIN_FLUSH_TABLE_STATISTICS, ADMIN_FLUSH_INDEX_STATISTICS, ADMIN_FLUSH_USER_STATISTICS, ADMIN_FLUSH_CLIENT_STATISTICS, ADMIN_FLUSH_USER_RESOURCES, - ADMIN_FLUSH_ALL_STATUS, ADMIN_FLUSH_ALL_STATISTICS + ADMIN_FLUSH_ALL_STATUS, ADMIN_FLUSH_ALL_STATISTICS, ADMIN_FLUSH_SSL }; static const char *command_names[]= { "create", "drop", "shutdown", @@ -124,7 +124,7 @@ static const char *command_names[]= { "flush-error-log", "flush-general-log", "flush-relay-log", "flush-slow-log", "flush-table-statistics", "flush-index-statistics", "flush-user-statistics", "flush-client-statistics", "flush-user-resources", - "flush-all-status", "flush-all-statistics", + "flush-all-status", "flush-all-statistics", "flush-ssl", NullS }; @@ -623,7 +623,14 @@ int flush(MYSQL *mysql, const char *what) char buf[FN_REFLEN]; my_snprintf(buf, sizeof(buf), "flush %s%s", (opt_local && !sql_log_bin_off ? "local " : ""), what); - return mysql_query(mysql, buf); + + if (mysql_query(mysql, buf)) + { + my_printf_error(0, "flush %s failed; error: '%s'", error_flags, what, + mysql_error(mysql)); + return -1; + } + return 0; } @@ -739,11 +746,7 @@ static int execute_commands(MYSQL *mysql,int argc, char **argv) case ADMIN_FLUSH_PRIVILEGES: case ADMIN_RELOAD: if (flush(mysql, "privileges")) - { - my_printf_error(0, "reload failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; case ADMIN_REFRESH: if (mysql_refresh(mysql, @@ -943,173 +946,111 @@ static int execute_commands(MYSQL *mysql,int argc, char **argv) case ADMIN_FLUSH_LOGS: { if (flush(mysql, "logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_BINARY_LOG: { if (flush(mysql, "binary logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_ENGINE_LOG: { if (flush(mysql, "engine logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_ERROR_LOG: { if (flush(mysql, "error logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_GENERAL_LOG: { if (flush(mysql, "general logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_RELAY_LOG: { if (flush(mysql, "relay logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_SLOW_LOG: { if (flush(mysql, "slow logs")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_HOSTS: { if (flush(mysql, "hosts")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_TABLES: { if (flush(mysql, "tables")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_STATUS: { if (flush(mysql, "status")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_TABLE_STATISTICS: { if (flush(mysql, "table_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_INDEX_STATISTICS: { if (flush(mysql, "index_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } + break; + } + case ADMIN_FLUSH_SSL: + { + if (flush(mysql, "ssl")) + return -1; break; } case ADMIN_FLUSH_USER_STATISTICS: { if (flush(mysql, "user_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_USER_RESOURCES: { if (flush(mysql, "user_resources")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_CLIENT_STATISTICS: { if (flush(mysql, "client_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_ALL_STATISTICS: { if (flush(mysql, "table_statistics,index_statistics," "user_statistics,client_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_FLUSH_ALL_STATUS: { if (flush(mysql, "status,table_statistics,index_statistics," "user_statistics,client_statistics")) - { - my_printf_error(0, "flush failed; error: '%s'", error_flags, - mysql_error(mysql)); return -1; - } break; } case ADMIN_OLD_PASSWORD: @@ -1418,6 +1359,7 @@ static void usage(void) flush-general-log Flush general log\n\ flush-relay-log Flush relay log\n\ flush-slow-log Flush slow query log\n\ + flush-ssl Flush SSL certificates\n\ flush-status Clear status variables\n\ flush-table-statistics Clear table statistics\n\ flush-tables Flush all tables\n\ diff --git a/mysql-test/main/mysqladmin.result b/mysql-test/main/mysqladmin.result index 8a9b009946b..99615f60e1b 100644 --- a/mysql-test/main/mysqladmin.result +++ b/mysql-test/main/mysqladmin.result @@ -17,3 +17,14 @@ mysqld is alive # Creating an empty file 'cnf_file' # Using --defaults-extra-file option with 'cnf_file'. mysqld is alive +# Kill the server +# restart: --ssl-key=MYSQLTEST_VARDIR/tmp/ssl_key.pem --ssl-cert=MYSQLTEST_VARDIR/tmp/ssl_cert.pem +connect ssl_con,localhost,root,,,,,SSL; +SELECT VARIABLE_VALUE INTO @ssl_not_after FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after'; +# Use a different certificate ("Not after" certificate field changed) +# Check new certificate used by new connection +Result +OK +# Cleanup +# Kill the server +# restart diff --git a/mysql-test/main/mysqladmin.test b/mysql-test/main/mysqladmin.test index 2580db88456..97e805ecf73 100644 --- a/mysql-test/main/mysqladmin.test +++ b/mysql-test/main/mysqladmin.test @@ -51,3 +51,50 @@ EOF # --error 1 --exec $MYSQLADMIN -u root -p 2>&1 > /dev/null + +# +# MDEV-19168 Reload SSL certificate +# This test reloads server SSL certs ./mysqladmin flush-ssl, and checks that new SSL +# connection use new certificate. +# SWtatus variable Ssl_server_not_after is used to tell the old certificate from new. +# + +source include/have_ssl_communication.inc; + +# Restart server with cert. files located in temp directory +# We are going to remove / replace them within the test, +# so we can't use the ones in std_data directly. + +let $ssl_cert=$MYSQLTEST_VARDIR/tmp/ssl_cert.pem; +let $ssl_key=$MYSQLTEST_VARDIR/tmp/ssl_key.pem; + +copy_file $MYSQL_TEST_DIR/std_data/server-key.pem $ssl_key; +copy_file $MYSQL_TEST_DIR/std_data/server-cert.pem $ssl_cert; + +let $restart_parameters=--ssl-key=$ssl_key --ssl-cert=$ssl_cert; +--source include/kill_mysqld.inc +--source include/start_mysqld.inc + +connect ssl_con,localhost,root,,,,,SSL; +SELECT VARIABLE_VALUE INTO @ssl_not_after FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after'; +let $ssl_not_after=`SELECT @ssl_not_after`; + +remove_file $ssl_cert; +remove_file $ssl_key; + +--echo # Use a different certificate ("Not after" certificate field changed) +copy_file $MYSQL_TEST_DIR/std_data/server-new-key.pem $ssl_key; +copy_file $MYSQL_TEST_DIR/std_data/server-new-cert.pem $ssl_cert; + +--exec $MYSQLADMIN --default-character-set=latin1 -S $MASTER_MYSOCK -P $MASTER_MYPORT -u root --password= flush-ssl 2>&1 + +--echo # Check new certificate used by new connection +exec $MYSQL --ssl -e "SELECT IF(VARIABLE_VALUE <> '$ssl_not_after', 'OK', 'FAIL') as Result FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after'"; + +--echo # Cleanup +remove_file $ssl_cert; +remove_file $ssl_key; +# restart with usuall SSL +let $restart_parameters=; +--source include/kill_mysqld.inc +--source include/start_mysqld.inc |