MDEV-25719: stunnel uses "verifyChain" without subject checks

Another batch of changes that should make the SST process
more reliable in all scenarios:

 1) Added hostname or CN verification when stunnel is used
    with certificate chain verification (verifyChain = yes);
 2) Added check for the absence of the stunnel utility for
    mtr tests;
 3) Deletion of working files before and after SST is done
    more accurately;
 4) rsync on joiner can be run even if the path to its
    configuration file contains spaces;
 5) More accurate directory creation (for data files and
    for logs);
 6) IST with mysqldump no longer turns off statement logging;
 7) Reset password for mysqldump when password is empty but
    username is specified;
 8) More reliable quoting when generating statements in
    wsrep_sst_mysqldump;
 9) Added explicit generation of 2048-bit Diffie-Hellman
    parameters for sockat < 1.7.3, by analogy with xtrabackup;
10) Compression parameters for qpress are read from all
    suitable server groups in configuration file, as well as
    from the [sst] and [xtrabackup] groups;
11) Added a test that checks compression using qpress;
12) Checking for optional utilities is modified to work even
    if they implemented as built-in shell commands (unlikely
    on real systems, but more reliable).

16 files changed, 64 insertions, 12 deletions

diff --git a/mysql-test/suite.pm b/mysql-test/suite.pm
index 5fc6f00b460..31e59781064 100644
--- a/mysql-test/suite.pm
+++ b/mysql-test/suite.pm
@@ -63,7 +63,7 @@ sub skip_combinations {
             unless ::have_mariabackup();
 
   $skip{'include/have_mariabackup.inc'} = 'Need socket statistics utility'
-            unless IS_WINDOWS || ::which("ss");
+            unless IS_WINDOWS || ! ::have_wsrep() || ::which("lsof") || ::which("sockstat") || ::which("ss");
 
   $skip{'include/have_mariabackup.inc'} = 'Need socat or nc'
             unless IS_WINDOWS || $ENV{MTR_GALERA_TFMT};
@@ -95,7 +95,6 @@ sub skip_combinations {
     unless $::mysqld_variables{'version-ssl-library'} =~ /OpenSSL (\S+)/
        and $1 ge "1.0.1d" and $1 lt "1.1.1";
 
-
   $skip{'t/ssl_7937.combinations'} = [ 'x509v3' ]
     unless $::mysqld_variables{'version-ssl-library'} =~ /OpenSSL (\S+)/
        and $1 ge "1.0.2";
@@ -108,4 +107,3 @@ sub skip_combinations {
 }
 
 bless { };
-
diff --git a/mysql-test/suite/galera/disabled.def b/mysql-test/suite/galera/disabled.def
index 176b83d56b2..d92f3f7d6b8 100644
--- a/mysql-test/suite/galera/disabled.def
+++ b/mysql-test/suite/galera/disabled.def
@@ -21,10 +21,10 @@ galera_parallel_simple : MDEV-20318 galera.galera_parallel_simple fails
 galera_partition : MDEV-21806: galera.galera_partition MTR failed: failed to recover from DONOR state
 galera_shutdown_nonprim : MDEV-21493 galera.galera_shutdown_nonprim
 galera_var_node_address : MDEV-20485 Galera test failure
-galera_wan : MDEV-17259 Test failure on galera.galera_wan
+#galera_wan : MDEV-17259 Test failure on galera.galera_wan
 partition : MDEV-19958 Galera test failure on galera.partition
 query_cache: MDEV-15805 Test failure on galera.query_cache
-sql_log_bin : MDEV-21491 galera.sql_log_bin
+#sql_log_bin : MDEV-21491 galera.sql_log_bin
 versioning_trx_id: MDEV-18590: galera.versioning_trx_id: Test failure: mysqltest: Result content mismatch
 galera_wsrep_provider_unset_set: wsrep_provider is read-only for security reasons
 pxc-421: wsrep_provider is read-only for security reasons
diff --git a/mysql-test/suite/galera/include/have_qpress.inc b/mysql-test/suite/galera/include/have_qpress.inc
new file mode 100644
index 00000000000..0dd693f2c63
--- /dev/null
+++ b/mysql-test/suite/galera/include/have_qpress.inc
@@ -0,0 +1,4 @@
+#
+# suite.pm will make sure that all tests including this file
+# will be skipped as needed
+#
diff --git a/mysql-test/suite/galera/include/have_stunnel.inc b/mysql-test/suite/galera/include/have_stunnel.inc
new file mode 100644
index 00000000000..0dd693f2c63
--- /dev/null
+++ b/mysql-test/suite/galera/include/have_stunnel.inc
@@ -0,0 +1,4 @@
+#
+# suite.pm will make sure that all tests including this file
+# will be skipped as needed
+#
diff --git a/mysql-test/suite/galera/r/galera_sst_mariabackup_qpress.result b/mysql-test/suite/galera/r/galera_sst_mariabackup_qpress.result
new file mode 100644
index 00000000000..684a6d00c7e
--- /dev/null
+++ b/mysql-test/suite/galera/r/galera_sst_mariabackup_qpress.result
@@ -0,0 +1,4 @@
+SELECT 1;
+1
+1
+include/assert_grep.inc [Compressed qpress files found]
diff --git a/mysql-test/suite/galera/suite.pm b/mysql-test/suite/galera/suite.pm
index 8ef5965834f..9ceedf82a0e 100644
--- a/mysql-test/suite/galera/suite.pm
+++ b/mysql-test/suite/galera/suite.pm
@@ -69,4 +69,13 @@ push @::global_suppressions,
      qr|WSREP: Trying to continue unpaused monitor|,
    );
 
+sub skip_combinations {
+  my %skip = ();
+  $skip{'include/have_stunnel.inc'} = "Need 'stunnel' utility"
+            unless ::which("stunnel");
+  $skip{'include/have_qpress.inc'} = "Need 'qpress' utility"
+            unless ::which("qpress");
+  %skip;
+}
+
 bless { };
diff --git a/mysql-test/suite/galera/t/galera_ist_innodb_flush_logs.cnf b/mysql-test/suite/galera/t/galera_ist_innodb_flush_logs.cnf
index a93c291b47c..2c0cec0ab5a 100644
--- a/mysql-test/suite/galera/t/galera_ist_innodb_flush_logs.cnf
+++ b/mysql-test/suite/galera/t/galera_ist_innodb_flush_logs.cnf
@@ -12,4 +12,3 @@ wsrep_provider_options='base_port=@mysqld.1.#galera_port;pc.ignore_sb=true'
 
 [mysqld.2]
 wsrep_provider_options='base_port=@mysqld.2.#galera_port;pc.ignore_sb=true'
-
diff --git a/mysql-test/suite/galera/t/galera_ist_rsync.cnf b/mysql-test/suite/galera/t/galera_ist_rsync.cnf
index 797e3651967..7a3da6dad02 100644
--- a/mysql-test/suite/galera/t/galera_ist_rsync.cnf
+++ b/mysql-test/suite/galera/t/galera_ist_rsync.cnf
@@ -10,4 +10,3 @@ wsrep_sync_wait=1
 [mysqld.2]
 wsrep_provider_options='base_port=@mysqld.2.#galera_port;pc.ignore_sb=true'
 wsrep_sync_wait=1
-
diff --git a/mysql-test/suite/galera/t/galera_log_bin.cnf b/mysql-test/suite/galera/t/galera_log_bin.cnf
index 8f6a760def0..98e724fb2d0 100644
--- a/mysql-test/suite/galera/t/galera_log_bin.cnf
+++ b/mysql-test/suite/galera/t/galera_log_bin.cnf
@@ -7,4 +7,3 @@ log-slave-updates
 [mysqld.2]
 log-bin
 log-slave-updates
-
diff --git a/mysql-test/suite/galera/t/galera_log_bin.inc b/mysql-test/suite/galera/t/galera_log_bin.inc
index f1d2a12b9de..12d6388615c 100644
--- a/mysql-test/suite/galera/t/galera_log_bin.inc
+++ b/mysql-test/suite/galera/t/galera_log_bin.inc
@@ -39,4 +39,3 @@ DROP TABLE t2;
 --echo #cleanup
 --connection node_1
 RESET MASTER;
-
diff --git a/mysql-test/suite/galera/t/galera_log_bin_opt.cnf b/mysql-test/suite/galera/t/galera_log_bin_opt.cnf
index a09efd2e011..3c14cde794c 100644
--- a/mysql-test/suite/galera/t/galera_log_bin_opt.cnf
+++ b/mysql-test/suite/galera/t/galera_log_bin_opt.cnf
@@ -12,4 +12,4 @@ wsrep_provider_options='base_port=@mysqld.2.#galera_port;gcache.size=1;pc.ignore
 
 [sst]
 transferfmt=@ENV.MTR_GALERA_TFMT
-streamfmt=xbstream
+streamfmt=mbstream
diff --git a/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.cnf b/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.cnf
new file mode 100644
index 00000000000..25a9d5fc0b2
--- /dev/null
+++ b/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.cnf
@@ -0,0 +1,12 @@
+!include ../galera_2nodes.cnf
+
+[mysqld]
+wsrep_sst_method=mariabackup
+wsrep_sst_auth="root:"
+wsrep_debug=ON
+
+[sst]
+transferfmt=@ENV.MTR_GALERA_TFMT
+compress=quicklz
+compress-threads=2
+compress-chunk-size=32768
diff --git a/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.test b/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.test
new file mode 100644
index 00000000000..b5386885ca0
--- /dev/null
+++ b/mysql-test/suite/galera/t/galera_sst_mariabackup_qpress.test
@@ -0,0 +1,24 @@
+#
+# This test checks that qpress compression works with mariabackup
+# Initial SST happens via mariabackup, so there is not much to do in the body
+# of the test
+#
+
+--source include/big_test.inc
+--source include/galera_cluster.inc
+--source include/have_innodb.inc
+--source include/have_mariabackup.inc
+--source include/have_qpress.inc
+
+SELECT 1;
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size';
+--source include/wait_condition.inc
+
+# Confirm that transfer was compressed using qpress algorithm
+--let $assert_text = Compressed qpress files found
+--let $assert_select = Compressed qpress files found
+--let $assert_count = 1
+--let $assert_file = $MYSQLTEST_VARDIR/log/mysqld.2.err
+--let $assert_only_after = CURRENT_TEST
+--source include/assert_grep.inc
diff --git a/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_key.test b/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_key.test
index 505f7e7626d..838c473b9ce 100644
--- a/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_key.test
+++ b/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_key.test
@@ -1,6 +1,7 @@
 --source include/big_test.inc
 --source include/galera_cluster.inc
 --source include/have_debug.inc
+--source include/have_stunnel.inc
 
 # Save original auto_increment_offset values.
 --let $node_1=node_1
diff --git a/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_server.test b/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_server.test
index 505f7e7626d..838c473b9ce 100644
--- a/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_server.test
+++ b/mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_server.test
@@ -1,6 +1,7 @@
 --source include/big_test.inc
 --source include/galera_cluster.inc
 --source include/have_debug.inc
+--source include/have_stunnel.inc
 
 # Save original auto_increment_offset values.
 --let $node_1=node_1
diff --git a/mysql-test/suite/galera/t/galera_wan_restart_sst.test b/mysql-test/suite/galera/t/galera_wan_restart_sst.test
index 4bd7e6e71fb..16e073e7164 100644
--- a/mysql-test/suite/galera/t/galera_wan_restart_sst.test
+++ b/mysql-test/suite/galera/t/galera_wan_restart_sst.test
@@ -4,7 +4,7 @@
 # We can not easily restart the first node, so instead we restart all the other nodes. MTR does not allow multiple nodes
 # to be down at the same time, so restarts are sequential.
 #
-# We can not test any of the actual WAN optimizations from inside MTR and no 
+# We can not test any of the actual WAN optimizations from inside MTR and no
 # status variables are provided. So we only check that simple replication works.
 #
 
@@ -120,7 +120,6 @@ INSERT INTO t1 VALUES (33);
 
 INSERT INTO t1 VALUES (341);
 
-
 #
 # Check all nodes
 #