summaryrefslogtreecommitdiff
path: root/mysys_ssl
Commit message (Collapse)AuthorAgeFilesLines
* Merge 10.2 into 10.3Marko Mäkelä2020-10-221-1/+2
|\
| * MDEV-23925: Fixed warnings generated during compilation of ↵Dmitry Shulga2020-10-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mysys_ssl/openssl.c on MacOS Compiler warnings like one listed below are generated during server build on MacOS: In file included from server-10.2-MDEV-23564/mysys_ssl/openssl.c:33: In file included from /usr/local/include/openssl/evp.h:16: In file included from /usr/local/include/openssl/bio.h:20: /usr/local/include/openssl/crypto.h:206:10: warning: 'CRYPTO_cleanup_all_ex_data' macro redefined [-Wmacro-redefined] ^ /mariadb/server-10.2-MDEV-23564/include/ssl_compat.h:46:9: note: previous definition is here ^ In case MariaDB serer is build with -DCMAKE_BUILD_TYPE=Debug it results in build error. The reason of compiler warnings is that header file <ssl_compat.h> included before the openssl system header files. File ssl_compat.h contains some macros with the same names as SSL API functions declared in the openssl system header files. It resulted in duplicate symbols that produces compiler warnings. To fix the issue the header file ssl_compat.h should be included after a line where openssl system header is included.
* | Merge 10.2 into 10.3Marko Mäkelä2019-05-1410-10/+10
|\ \ | |/
| * Merge 10.1 into 10.2Marko Mäkelä2019-05-1310-10/+10
| |\
| | * Merge branch '5.5' into 10.1Vicențiu Ciorbaru2019-05-113-3/+3
| | |
| | * Update FSF addressVicențiu Ciorbaru2019-05-117-7/+7
| | |
* | | Merge branch '10.2' into 10.3Sergei Golubchik2019-03-291-2/+3
|\ \ \ | |/ /
| * | MDEV-15587 AES test fails, segfaults in EVP_CipherInit_exMarko Mäkelä2019-03-291-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When HAVE_YASSL is defined (due to cmake -DWITH_SSL=bundled or otherwise), mysys_ssl/my_crypt.cc will #include "yassl.cc" from the same directory. When MariaDB 10.2 or later is compiled with GCC 8 and optimizations are enabled, then the check if (iv) in EVP_CipherInit_ex() can be wrongly optimized away. The reason appears to be that __attribute__((nonnull)) is attached to the variable iv, because there is a (no-op) call memcpy(oiv, iv, ivlen=0) earlier in the code path. It is possible that this started failing after the code was refactored in MDEV-10332 (MariaDB 10.2.6). In MariaDB 10.1, there is a similar memcpy() call in MyCTX_nopad::init(), but the code appears to work fine.
* | | Windows : fix broken build with OpenSSLVladislav Vaintroub2018-09-081-1/+2
| | |
* | | MDEV-15513 use EVP_MD_CTX_{new,free} instead of EVP_MD_CTX_{create, destroy}Alexander Kuleshov2018-05-211-2/+2
|/ / | | | | | | | | | | | | | | | | | | | | for consistency with EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free(). As the EVP_DIGESTINIT(3) man page says: EVP_MD_CTX_create() and EVP_MD_CTX_destroy() were renamed to EVP_MD_CTX_new() and EVP_MD_CTX_free() in OpenSSL 1.1. Closes #621
* | MDEV-14567: CRYPTO_set_mem_functions fails in FIPS modeDaniel Black2018-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | If the CRYPTO_set_mem_functions fails just return success from check_openssl_compatibility. The only case where CRYPTO_set_mem_functions fails is the allow_customize==0 (aka FIPS mode). The check_openssl_compatibility isn't able to complete unless this function returns success. ref: https://github.com/openssl/openssl/blob/OpenSSL_1_1_0g/crypto/mem.c#L34
* | Merge branch 'github/10.1' into 10.2Sergei Golubchik2018-02-062-14/+2
|\ \ | |/
| * MDEV-14343 Server crash on FIPS with openssl-1.0.2kSergei Golubchik2018-01-302-21/+3
| | | | | | | | don't use internal undocumented OpenSSL functionality
* | MDEV-13384 - misc Windows warnings fixedVladislav Vaintroub2017-09-282-5/+5
| |
* | MDEV-13844 : Fix Windows warnings. Fix DBUG_PRINT.Vladislav Vaintroub2017-09-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | - Fix win64 pointer truncation warnings (usually coming from misusing 0x%lx and long cast in DBUG) - Also fix printf-format warnings Make the above mentioned warnings fatal. - fix pthread_join on Windows to set return value.
* | MDEV-13698 stack overflow (OpenSSL on Windows)Sergei Golubchik2017-09-181-1/+1
| | | | | | | | avoid CRYPTO_free recursively calling itself on Windows
* | MDEV-12763 10.2 uses deprecated openssl 1.0 apis even with 1.1Sergei Golubchik2017-09-182-2/+2
| | | | | | | | | | Use OpenSSL 1.1 when applicable. Create compatibility macros for OpenSSL 1.0- and YaSSL.
* | fix compilation with OpenSSL 1.1Sergei Golubchik2017-07-131-1/+2
| |
* | cleanup: check_openssl_compatibility()Sergei Golubchik2017-07-051-22/+22
| | | | | | | | | | | | | | | | | | CRYPTO_set_mem_functions() works only until the first allocation is done: * remove the second CRYPTO_set_mem_functions() call * check whether the first CRYPTO_set_mem_functions() call worked * stricter memory checks (==1, not >1, etc) * as coc_malloc cannot be removed, make the counter a bit cheaper * only do the check for OpenSSL 1.1 (because of OpenSSL 1.0 bug)
* | fix crashes with openssl fips buildsSergei Golubchik2017-05-101-2/+2
| | | | | | | | | | | | Apparently openssl ignores CRYPTO_set_mem_functions() in fips mode, so we cannot detect structure sizes. Don't freak out when no mallocs were detected.
* | MDEV-10332 support for OpenSSL 1.1 and LibreSSLSergei Golubchik2017-05-095-138/+140
| | | | | | | | | | | | | | | | | | | | | | | | post-review fixes: * move all ssl implementation related ifdefs/defines to one file (ssl_compat.h) * work around OpenSSL-1.1 desire to malloc every EVP context by run-time checking that context allocated on the stack is big enough (openssl.c) * use newer version of the AWS SDK for OpenSSL 1.1 * use get_dh2048() function as generated by openssl 1.1 (viosslfactories.c)
* | MDEV-10332 support for OpenSSL 1.1 and LibreSSLGeorg Richter2017-05-093-47/+122
| | | | | | | | | | | | | | | | | | | | | | Initial support tested against OpenSSL 1.0.1, 1.0.2, 1.1.0, Yassl and LibreSSL not working on Windows with native SChannel support, due to wrong cipher mapping: Latter one requires push of CONC-241 fixes. Please note that OpenSSL 0.9.8 and OpenSSL 1.1.0 will not work: Even if the build succeeds, test cases will fail with various errors, especially when using different tls libraries or versions for client and server.
* | Merge 10.1 into 10.2Marko Mäkelä2017-05-061-0/+26
|\ \ | |/ | | | | | | | | Also, include fixes by Vladislav Vaintroub to the aws_key_management plugin. The AWS C++ SDK specifically depends on OPENSSL_LIBRARIES, not generic SSL_LIBRARIES (such as YaSSL).
| * MDEV-11663 Create services for functionality used by pluginsVladislav Vaintroub2017-04-271-0/+26
| | | | | | | | | | | | Added service for - encryption (AES) - error reporting, e.g my_printf_error()
* | Merge branch '10.1' into 10.2Sergei Golubchik2017-03-309-315/+278
|\ \ | |/
| * remove old API for SHA2Sergei Golubchik2017-03-102-69/+0
| |
| * my_sha2 serviceSergei Golubchik2017-03-106-11/+91
| |
| * cleanup: generalize my_sha1.ccSergei Golubchik2017-03-102-133/+189
| | | | | | | | | | move most of the code into my_sha.ic, making it independent from the actual SHAx variant.
| * cleanup: remove a duplicate fileSergei Golubchik2017-03-102-104/+0
| |
* | Fix many -Wconversion warnings.Marko Mäkelä2017-03-071-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define my_thread_id as an unsigned type, to avoid mismatch with ulonglong. Change some parameters to this type. Use size_t in a few more places. Declare many flag constants as unsigned to avoid sign mismatch when shifting bits or applying the unary ~ operator. When applying the unary ~ operator to enum constants, explictly cast the result to an unsigned type, because enum constants can be treated as signed. In InnoDB, change the source code line number parameters from ulint to unsigned type. Also, make some InnoDB functions return a narrower type (unsigned or uint32_t instead of ulint; bool instead of ibool).
* | Fix for MDEV-11174:Georg Richter2017-02-011-0/+3
|/ | | | A GCM encrypted ciphertext must contain an authentication tag with AES_BLOCK_SIZE length, so we need to check that the length of ciphertext is at least AES_BLOCK_SIZE.
* Merge branch '10.0' into 10.1Sergei Golubchik2015-12-211-0/+4
|\
| * after-merge: 10.0 part of MDEV-9249 (ERR_remove_state)Sergei Golubchik2015-12-211-0/+4
| |
* | New encryption API. Piece-wise encryption.Sergei Golubchik2015-09-042-275/+368
| | | | | | | | | | | | | | | | | | | | | | | | | | Instead of encrypt(src, dst, key, iv) that encrypts all data in one go, now we have encrypt_init(key,iv), encrypt_update(src,dst), and encrypt_finish(dst). This also causes collateral changes in the internal my_crypt.cc encryption functions and in the encryption service. There are wrappers to provide the old all-at-once encryption functionality. But binlog events are often written piecewise, they'll need the new api.
* | MDEV-8281 aes_decrypt crashes in block_crypt()Sergei Golubchik2015-06-271-1/+1
| | | | | | | | fix aes_decrypt of yassl to support zero-length input
* | my_aes_encrypt_gcm() and my_aes_decrypt_gcm()Sergei Golubchik2015-06-021-1/+85
| |
* | my_aes_get_size()Sergei Golubchik2015-06-021-8/+10
| | | | | | | | | | return unsigned, not signed. return a value large enough for GCM
* | Merge tag 'mariadb-10.0.19' into 10.1Sergei Golubchik2015-06-012-21/+29
|\ \ | |/
| * MDEV-7788 my_md5 crashes with openssl in fips modeSergei Golubchik2015-05-031-6/+12
| | | | | | | | | | | | | | Tell OpenSSL to use MD5 even if FIPS prohibits it. This is fine as long as we do not use MD5 for cryptographical purposes (md5 is used internally for P_S message digests and for view checksums)
| * MDEV-7697 Client reports ERROR 2006 (MySQL server has gone away) or ERROR ↵Sergei Golubchik2015-05-031-6/+13
| | | | | | | | | | | | | | 2013 (Lost connection to MySQL server during query) while executing AES* functions under SSL Clear OpenSSL error queue after an error in AES_ENCRYPT/AES_DECRYPT. Otherwise it might affect current ssl-encrypted connection.
* | MDEV-8162 func_str crashes on SELECT AES_DECRYPT(AES_ENCRYPT(...)) on line 107Sergei Golubchik2015-05-151-23/+24
| | | | | | | | encrypting 0 byte string *is* possible
* | MDEV-8022 Assertion `rc == 0' failed in ma_encrypt on dropping an encrypted ↵Sergei Golubchik2015-05-131-51/+61
| | | | | | | | | | | | | | | | | | | | | | Aria table fix encryption of the last partial block * now really encrypt it, using key and iv * support the case of very short plaintext (less than one block) * recommend aes_ctr over aes_cbc, because the former doesn't have problems with partial blocks
* | move AES_CTR to its own greatly simplified functionSergei Golubchik2015-05-131-32/+41
| | | | | | | | | | * don't use do_crypt() for stream cipher AES_CTR * rename do_crypt to block_crypt to emphasize its specialization
* | remove now-empty my_aes.{h,cc}Sergei Golubchik2015-04-093-52/+28
| | | | | | | | move remaning defines to my_crypt, add MY_ namespace prefix
* | encryption plugin controls the encryptionSergei Golubchik2015-04-092-193/+39
| | | | | | | | | | | | | | | | | | * no --encryption-algorithm option anymore * encrypt/decrypt methods in the encryption plugin * ecnrypt/decrypt methods in the encryption_km service * file_km plugin has --file-key-management-encryption-algorithm * debug_km always uses aes_cbc * example_km changes between aes_cbc and aes_ecb for different key versions
* | remove old my_aes_encrypt/decryptSergei Golubchik2015-04-081-229/+0
| | | | | | | | and simplify Item_func_aes_encrypt/decrypt
* | yassl paddingSergei Golubchik2015-04-081-11/+33
| |
* | my_aes* functions: support for different key lengthsSergei Golubchik2015-04-081-14/+38
| | | | | | | | to: different key lengths
* | yassl supportSergei Golubchik2015-04-051-30/+63
| |
* | unify my_{en|de}crypt_{cbc|ecb|ctr}. no yassl support yet.Sergei Golubchik2015-04-052-559/+96
| |
View Lorry Controller Status