diff options
author | Vladislav Vaintroub <wlad@mariadb.com> | 2021-11-08 18:48:19 +0100 |
---|---|---|
committer | Vladislav Vaintroub <wlad@mariadb.com> | 2022-07-04 12:49:11 +0200 |
commit | 8a9c1e9ccf227e5f8ee9a4716a9b64665a8489e3 (patch) | |
tree | a2f683f16084e54589c7de16b02f1383d9db634e /mysql-test | |
parent | 33f0270ebbbbb9920ef80556dc91aef0c007ebe7 (diff) | |
download | mariadb-git-8a9c1e9ccf227e5f8ee9a4716a9b64665a8489e3.tar.gz |
MDEV-25785 Add support for OpenSSL 3.0
Summary of changes
- MD_CTX_SIZE is increased
- EVP_CIPHER_CTX_buf_noconst(ctx) does not work anymore, points
to nobody knows where. The assumption made previously was that
(since the function does not seem to be documented)
was that it points to the last partial source block.
Add own partial block buffer for NOPAD encryption instead
- SECLEVEL in CipherString in openssl.cnf
had been downgraded to 0, from 1, to make TLSv1.0 and TLSv1.1 possible
(according to https://github.com/openssl/openssl/blob/openssl-3.0.0/NEWS.md
even though the manual for SSL_CTX_get_security_level claims that it
should not be necessary)
- Workaround Ssl_cipher_list issue, it now returns TLSv1.3 ciphers,
in addition to what was set in --ssl-cipher
- ctx_buf buffer now must be aligned to 16 bytes with openssl(
previously with WolfSSL only), ot crashes will happen
- updated aes-t , to be better debuggable
using function, rather than a huge multiline macro
added test that does "nopad" encryption piece-wise, to test
replacement of EVP_CIPHER_CTX_buf_noconst
part of MDEV-29000
Diffstat (limited to 'mysql-test')
-rw-r--r-- | mysql-test/lib/openssl.cnf | 2 | ||||
-rw-r--r-- | mysql-test/main/ssl_cipher.result | 6 | ||||
-rw-r--r-- | mysql-test/main/ssl_cipher.test | 2 |
3 files changed, 5 insertions, 5 deletions
diff --git a/mysql-test/lib/openssl.cnf b/mysql-test/lib/openssl.cnf index b9ab37ac3a1..7cd6f748af2 100644 --- a/mysql-test/lib/openssl.cnf +++ b/mysql-test/lib/openssl.cnf @@ -9,4 +9,4 @@ ssl_conf = ssl_section system_default = system_default_section [system_default_section] -CipherString = ALL:@SECLEVEL=1 +CipherString = ALL:@SECLEVEL=0 diff --git a/mysql-test/main/ssl_cipher.result b/mysql-test/main/ssl_cipher.result index 930d384eda9..66d817b7b41 100644 --- a/mysql-test/main/ssl_cipher.result +++ b/mysql-test/main/ssl_cipher.result @@ -61,8 +61,8 @@ connect ssl_con,localhost,root,,,,,SSL; SHOW STATUS LIKE 'Ssl_cipher'; Variable_name Value Ssl_cipher AES128-SHA -SHOW STATUS LIKE 'Ssl_cipher_list'; -Variable_name Value -Ssl_cipher_list AES128-SHA +SELECT VARIABLE_VALUE like '%AES128-SHA%' FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_cipher_list'; +VARIABLE_VALUE like '%AES128-SHA%' +1 disconnect ssl_con; connection default; diff --git a/mysql-test/main/ssl_cipher.test b/mysql-test/main/ssl_cipher.test index 36549d76d02..d4cdcffb276 100644 --- a/mysql-test/main/ssl_cipher.test +++ b/mysql-test/main/ssl_cipher.test @@ -98,6 +98,6 @@ let $restart_parameters=--ssl-cipher=AES128-SHA; source include/restart_mysqld.inc; connect (ssl_con,localhost,root,,,,,SSL); SHOW STATUS LIKE 'Ssl_cipher'; -SHOW STATUS LIKE 'Ssl_cipher_list'; +SELECT VARIABLE_VALUE like '%AES128-SHA%' FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_cipher_list'; disconnect ssl_con; connection default; |