diff options
| author | Vladislav Vaintroub <wlad@mariadb.com> | 2021-11-08 18:48:19 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2022-01-20 16:01:10 +0100 |
| commit | d42c2efbaa06a0307c2f0fd8fa87819ff50bbd7e (patch) | |
| tree | 90f43bdb1b36124529379c2355386ee50e56db3f /include | |
| parent | a855d6d93acf0af24c5801e3c61593bea6a81f71 (diff) | |
| download | mariadb-git-d42c2efbaa06a0307c2f0fd8fa87819ff50bbd7e.tar.gz | |
MDEV-25785 Add support for OpenSSL 3.0
Summary of changes
- MD_CTX_SIZE is increased
- EVP_CIPHER_CTX_buf_noconst(ctx) does not work anymore, points
to nobody knows where. The assumption made previously was that
(since the function does not seem to be documented)
was that it points to the last partial source block.
Add own partial block buffer for NOPAD encryption instead
- SECLEVEL in CipherString in openssl.cnf
had been downgraded to 0, from 1, to make TLSv1.0 and TLSv1.1 possible
(according to https://github.com/openssl/openssl/blob/openssl-3.0.0/NEWS.md
even though the manual for SSL_CTX_get_security_level claims that it
should not be necessary)
- Workaround Ssl_cipher_list issue, it now returns TLSv1.3 ciphers,
in addition to what was set in --ssl-cipher
- ctx_buf buffer now must be aligned to 16 bytes with openssl(
previously with WolfSSL only), ot crashes will happen
- updated aes-t , to be better debuggable
using function, rather than a huge multiline macro
added test that does "nopad" encryption piece-wise, to test
replacement of EVP_CIPHER_CTX_buf_noconst
Diffstat (limited to 'include')
| -rw-r--r-- | include/mysql/service_my_crypt.h | 2 | ||||
| -rw-r--r-- | include/ssl_compat.h | 3 |
2 files changed, 2 insertions, 3 deletions
diff --git a/include/mysql/service_my_crypt.h b/include/mysql/service_my_crypt.h index 2a232117ca1..bb038aaa295 100644 --- a/include/mysql/service_my_crypt.h +++ b/include/mysql/service_my_crypt.h @@ -45,7 +45,7 @@ extern "C" { /* The max key length of all supported algorithms */ #define MY_AES_MAX_KEY_LENGTH 32 -#define MY_AES_CTX_SIZE 656 +#define MY_AES_CTX_SIZE 672 enum my_aes_mode { MY_AES_ECB, MY_AES_CBC diff --git a/include/ssl_compat.h b/include/ssl_compat.h index 9f4b6be8d95..affa9f2a448 100644 --- a/include/ssl_compat.h +++ b/include/ssl_compat.h @@ -24,7 +24,7 @@ #define SSL_LIBRARY OpenSSL_version(OPENSSL_VERSION) #define ERR_remove_state(X) ERR_clear_error() #define EVP_CIPHER_CTX_SIZE 176 -#define EVP_MD_CTX_SIZE 48 +#define EVP_MD_CTX_SIZE 72 #undef EVP_MD_CTX_init #define EVP_MD_CTX_init(X) do { memset((X), 0, EVP_MD_CTX_SIZE); EVP_MD_CTX_reset(X); } while(0) #undef EVP_CIPHER_CTX_init @@ -74,7 +74,6 @@ #endif #define DH_set0_pqg(D,P,Q,G) ((D)->p= (P), (D)->g= (G)) -#define EVP_CIPHER_CTX_buf_noconst(ctx) ((ctx)->buf) #define EVP_CIPHER_CTX_encrypting(ctx) ((ctx)->encrypt) #define EVP_CIPHER_CTX_SIZE sizeof(EVP_CIPHER_CTX) |