summaryrefslogtreecommitdiff
path: root/vio/viosslfactories.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '10.3' into 10.4Oleksandr Byelkin2022-10-261-5/+6
|\
| * MDEV-29811 server advertises ssl even if it's unusable.Vladislav Vaintroub2022-10-251-5/+6
| | | | | | | | | | | | Abort startup, if SSL setup fails. Also, for the server always check that certificate matches private key (even if ssl_cert is not set, OpenSSL will try to use default one)
* | MDEV-27373 wolfSSL 5.1.1Vladislav Vaintroub2022-01-251-6/+7
| | | | | | | | | | | | | | | | | | - compile wolfcrypt with kdf.c, to avoid undefined symbols in tls13.c - define WOLFSSL_HAVE_ERROR_QUEUE to avoid endless loop SSL_get_error - Do not use SSL_CTX_set_tmp_dh/get_dh2048, this would require additional compilation options in WolfSSL. Disable it for WolfSSL build, it works without it anyway. - fix "macro already defined" Windows warning.
* | Merge branch 10.3 into 10.4Julius Goryavsky2021-12-251-12/+69
|\ \ | |/
| * MDEV-27181 fixup: compatibility with Windows + small correctionsbb-10.2-MDEV-27181-fixJulius Goryavsky2021-12-171-12/+69
| | | | | | | | | | | | | | 1) Removed symlinks that are not very well supported in tar under Windows. 2) Added comment + changed code formatting in viosslfactories.c 3) Fixed a small bug in the yassl code. 4) Fixed a typo in the script code.
| * MDEV-27181: Galera SST scripts should use ssl_capath for CA directorybb-10.2-MDEV-27181-galeraJulius Goryavsky2021-12-141-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Galera SST scripts should use ssl_capath (not ssl_ca) for CA directory. The current implementation tries to automatically detect the path using the trailing slash in the ssl_ca variable value, but this approach is not compatible with the server configuration. Now, by analogy with the server, SST scripts also use a separate ssl_capath variable. In addition, a similar tcapath variable has been added for the old-style configuration (in the "sst" section). 2. Openssl utility detection made more reliable. 3. Removed extra spaces in automatically generated command lines - to simplify debugging of the SST scripts. 4. In general, the code for detecting the presence or absence of auxiliary utilities has been improved - it is made more reliable in some configurations (and for shells other than bash).
* | MDEV-27181: Galera SST scripts should use ssl_capath for CA directorybb-10.4-MDEV-27181-galeraJulius Goryavsky2021-12-141-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Galera SST scripts should use ssl_capath (not ssl_ca) for CA directory. The current implementation tries to automatically detect the path using the trailing slash in the ssl_ca variable value, but this approach is not compatible with the server configuration. Now, by analogy with the server, SST scripts also use a separate ssl_capath variable. In addition, a similar tcapath variable has been added for the old-style configuration (in the "sst" section). 2. Openssl utility detection made more reliable. 3. Removed extra spaces in automatically generated command lines - to simplify debugging of the SST scripts. 4. In general, the code for detecting the presence or absence of auxiliary utilities has been improved - it is made more reliable in some configurations (and for shells other than bash).
* | MDEV-22917 wolfssl might crash at startup when both SSL and encryption ↵Vladislav Vaintroub2020-06-171-2/+2
| | | | | | | | | | | | plugin are enabled Make sure to initialize SSL early enough, when encryption plugins is loaded
* | MDEV-14101 Provide an option to select TLS protocol versionGeorg Richter2019-06-171-7/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Server and command line tools now support option --tls_version to specify the TLS version between client and server. Valid values are TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 or a combination of them. E.g. --tls_version=TLSv1.3 --tls_version=TLSv1.2,TLSv1.3 In case there is a gap between versions, the lowest version will be used: --tls_version=TLSv1.1,TLSv1.3 -> Only TLSv1.1 will be available. If the used TLS library doesn't support the specified TLS version, it will use the default configuration. Limitations: SSLv3 is not supported. The default configuration doesn't support TLSv1.0 anymore. TLSv1.3 protocol currently is only supported by OpenSSL 1.1.0 (client and server) and GnuTLS 3.6.5 (client only). Overview of TLS implementations and protocols Server: +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | WolfSSL | TLSv1.1, TLSv1,2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ Client (MariaDB Connector/C) +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | GnuTLS | (TLSv1.0), TLSv1.1, TLSv1.2, TLSv1.3 | +-----------+-----------------------------------------+ | Schannel | (TLSv1.0), TLSv1.1, TLSv1.2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+
* | MDEV-18531 : Use WolfSSL instead of YaSSL as "bundled" SSL/encryption libraryVladislav Vaintroub2019-05-221-5/+30
|/ | | | | | | | - Add new submodule for WolfSSL - Build and use wolfssl and wolfcrypt instead of yassl/taocrypt - Use HAVE_WOLFSSL instead of HAVE_YASSL - Increase MY_AES_CTX_SIZE, to avoid compile time asserts in my_crypt.cc (sizeof(EVP_CIPHER_CTX) is larger on WolfSSL)
* Merge 10.1 into 10.2Marko Mäkelä2019-05-131-1/+1
|\
| * Merge branch '5.5' into 10.1Vicențiu Ciorbaru2019-05-111-1/+1
| |\
| | * Update FSF AddressVicențiu Ciorbaru2019-05-111-1/+1
| | | | | | | | | | | | * Update wrong zip-code
* | | MDEV-15596 10.2 doesn't work with openssl 1.1.1Georg Richter2018-06-211-0/+1
| | |
* | | MDEV-13844 : Fix Windows warnings. Fix DBUG_PRINT.Vladislav Vaintroub2017-09-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fix win64 pointer truncation warnings (usually coming from misusing 0x%lx and long cast in DBUG) - Also fix printf-format warnings Make the above mentioned warnings fatal. - fix pthread_join on Windows to set return value.
* | | MDEV-10332 support for OpenSSL 1.1 and LibreSSLSergei Golubchik2017-05-091-62/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | post-review fixes: * move all ssl implementation related ifdefs/defines to one file (ssl_compat.h) * work around OpenSSL-1.1 desire to malloc every EVP context by run-time checking that context allocated on the stack is big enough (openssl.c) * use newer version of the AWS SDK for OpenSSL 1.1 * use get_dh2048() function as generated by openssl 1.1 (viosslfactories.c)
* | | MDEV-10332 support for OpenSSL 1.1 and LibreSSLGeorg Richter2017-05-091-16/+38
|/ / | | | | | | | | | | | | | | | | | | | | Initial support tested against OpenSSL 1.0.1, 1.0.2, 1.1.0, Yassl and LibreSSL not working on Windows with native SChannel support, due to wrong cipher mapping: Latter one requires push of CONC-241 fixes. Please note that OpenSSL 0.9.8 and OpenSSL 1.1.0 will not work: Even if the build succeeds, test cases will fail with various errors, especially when using different tls libraries or versions for client and server.
* | Merge branch '10.0' into 10.1Sergei Golubchik2016-06-281-3/+3
|\ \
| * \ Merge branch '5.5' into bb-10.0Sergei Golubchik2016-06-211-3/+3
| |\ \ | | |/
| | * Merge branch 'mysql/5.5' into 5.5Sergei Golubchik2016-06-141-3/+3
| | |\
| | | * Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BEArun Kuruvila2016-03-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FOUND Description:- Failure during the validation of CA certificate path which is provided as an option for 'ssl-ca' returns two different errors for YaSSL and OPENSSL. Analysis:- 'ssl-ca', option used for specifying the ssl ca certificate path. Failing to validate this certificate with OPENSSL returns an error, "ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed". While YASSL returns "ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation". Error returned by the OPENSSL is correct since "SSL_CTX_load_verify_locations()" returns 0 (in case of OPENSSL) for the failure and sets error as "SSL_INITERR_BAD_PATHS". In case of YASSL, "SSL_CTX_load_verify_locations()" returns an error number which is less than or equal to 0 in case of error. Error numbers for YASSL is mentioned in the file, 'extra/yassl/include/openssl/ssl.h'(line no : 292). Also 'ssl-ca' does not accept tilde home directory path substitution. Fix:- The condition which checks for the error in the "SSL_CTX_load_verify_locations()" is changed in order to accommodate YASSL as well. A logic is written in "mysql_ssl_set()" in order accept the tilde home directory path substitution for all ssl options.
| | | * Bug #21221862 NEWEST RHEL/CENTOS OPENSSL UPDATE BREAKS MYSQL DHE CIPHERSV S Murthy Sidagam2015-06-191-15/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Description: The newest RHEL/CentOS/SL 6.6 openssl package (1.0.1e-30.el6_6.9; published around 6/4/2015) contains a fix for LogJam. RedHat's fix for this was to limit the use of any SSL DH key sizes to a minimum of 768 bits. This breaks any DHE SSL ciphers for MySQL clients as soon as you install the openssl update, since in vio/viosslfactories.c, the default DHPARAM is a 512 bit one. This cannot be changed in configuration/runtime; and needs a recompile. Because of this the client connection with --ssl-cipher=DHE-RSA-AES256-SHA is not able to connect the server. Analysis: Openssl has changed Diffie-Hellman key from the 512 to 1024 due to some reasons(please see the details at http://openssl.org/news/secadv_20150611.txt) Because of this the client with DHE cipher is failing to connect the server. This change took place from the openssl-1.0.1n onwards. Fix: Similar bug fix is already pushed to mysql-5.7 under bug#18367167. Hence we backported the same fix to mysql-5.5 and mysql-5.6.
* | | | Merge branch '10.0' into 10.1Sergei Golubchik2016-02-231-0/+4
|\ \ \ \ | |/ / /
| * | | Merge branch '5.5' into 10.0Sergei Golubchik2016-02-151-0/+4
| |\ \ \ | | |/ /
| | * | MDEV-9314 fatal build error: viosslfactories.c:58:5: error: dereferencing ↵Sergei Golubchik2016-02-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | pointer to incomplete type ‘DH {aka struct dh_st} fixes for openssl that was built with -DOPENSSL_NO_DEPRECATED
* | | | MDEV-8957 [PATCH] Useless ssl_ctx_set_tmp_dh call in libmysqlOleksandr Byelkin2015-11-151-6/+9
|/ / / | | | | | | | | | Accepted patch of Georg: do not setup Differ-Hellman parameters on client.
* | | Merge commit '96badb16afcf' into 10.0Jan Lindström2015-08-031-18/+29
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: client/mysql_upgrade.c mysql-test/r/func_misc.result mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result mysql-test/suite/innodb/r/innodb-fk.result mysql-test/t/subselect_sj_mat.test sql/item.cc sql/item_func.cc sql/log.cc sql/log_event.cc sql/rpl_utility.cc sql/slave.cc sql/sql_class.cc sql/sql_class.h sql/sql_select.cc storage/innobase/dict/dict0crea.c storage/innobase/dict/dict0dict.c storage/innobase/handler/ha_innodb.cc storage/xtradb/dict/dict0crea.c storage/xtradb/dict/dict0dict.c storage/xtradb/handler/ha_innodb.cc vio/viosslfactories.c
| * | MDEV-8352 Increase Diffie-Helman modulus to 2048-bitsSergei Golubchik2015-07-311-18/+29
| | |
| * | MDEV-7695 MariaDB - ssl - fips: can not connect with ↵Sergei Golubchik2015-06-091-26/+26
| | | | | | | | | | | | | | | | | | --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure Change 512bit DH key to 1024bit to meet FIPS requirements
* | | SSL: Verbosely report SSL initialization errorsSergei Golubchik2015-05-031-21/+25
| | | | | | | | | | | | And don't ignore SSL_CTX_set_tmp_dh() failures
* | | MDEV-7695 MariaDB - ssl - fips: can not connect with ↵Sergei Golubchik2015-05-031-26/+26
| | | | | | | | | | | | | | | | | | --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure Change 512bit DH key to 1024bit to meet FIPS requirements
* | | Merge branch '5.5' into 10.0Sergei Golubchik2015-02-181-2/+4
|\ \ \ | |/ /
| * | Merge remote-tracking branch 'mysql/5.5' into bb-5.5-merge @ mysql-5.5.42Sergei Golubchik2015-02-111-2/+4
| |\ \ | | |/
| | * Bug#19820550 : DISABLE SSL 3.0 SUPPORT IN OPENSSLHarin Vadodaria2015-01-021-1/+4
| | | | | | | | | | | | Explicitly disable weaker SSL protocols.
| | * Updated/added copyright headersMurthy Narkedimilli2014-01-061-1/+1
| | |
| | * BUG#17294150-POTENTIAL CRASH DUE TO BUFFER OVERRUN IN SSL Raghav Kapoor2013-08-281-1/+1
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ERROR HANDLING CODE BACKGROUND: There can be a potential crash due to buffer overrun in SSL error handling code due to missing comma in ssl_error_string[] array in viosslfactories.c. ANALYSIS: Found by code Inspection. FIX: Added the missing comma in SSL error handling code in ssl_error_string[] array in viosslfactories.c.
| | | * BUG#17294150-POTENTIAL CRASH DUE TO BUFFER OVERRUN IN SSL Raghav Kapoor2013-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ERROR HANDLING CODE BACKGROUND: There can be a potential crash due to buffer overrun in SSL error handling code due to missing comma in ssl_error_string[] array in viosslfactories.c. ANALYSIS: Found by code Inspection. FIX: Added the missing comma in SSL error handling code in ssl_error_string[] array in viosslfactories.c.
| | | * Updated/added copyright headers.Murthy Narkedimilli2013-02-251-2/+1
| | | |
| | * | Bug #13115401: -SSL-KEY VALUE IS NOT VALIDATED AND IT ALLOWS INSECURE Venkata Sidagam2012-08-111-37/+55
| | |\ \ | | | |/ | | | | | | | | | | | | CONNECTIONS IF SPE Merged from mysql-5.1 to mysql-5.5
| | | * Bug #13115401: -SSL-KEY VALUE IS NOT VALIDATED AND IT ALLOWS INSECURE Venkata Sidagam2012-08-111-37/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CONNECTIONS IF SPE Problem description: -ssl-key value is not validated, you can assign any bogus text to --ssl-key and it is not verified that it exists, and more importantly, it allows the client to connect to mysqld. Fix: Added proper validations checks for --ssl-key. Note: 1) Documentation changes require for 5.1, 5.5, 5.6 and trunk in the sections listed below and the details are : http://dev.mysql.com/doc/refman/5.6/en/ssl-options.html#option_general_ssl and REQUIRE SSL section of http://dev.mysql.com/doc/refman/5.6/en/grant.html 2) Client having with option '--ssl', should able to get ssl connection. This will be implemented as part of separate fix in 5.6 and trunk.
| | * | merge 5.1->5.5Georgi Kodinov2012-05-151-5/+7
| | |\ \ | | | |/
| | | * Bug #11761822: yassl rejects valid certificate which openssl acceptsGeorgi Kodinov2012-05-151-4/+6
| | | | | | | | | | | | | | | | | | | | Applied the fix that updates yaSSL to 2.2.1 and fixes parsing this particular certificate. Added a test case with the certificate itself.
| | * | Updated/added copyright headersKent Boortz2011-06-301-2/+2
| | |\ \ | | | |/
| | | * Updated/added copyright headersKent Boortz2011-06-301-2/+5
| | | |\
| | | | * Updated/added copyright headersKent Boortz2011-06-301-2/+5
| | | | |
| | * | | Bug#11745920/Bug#21287: "SSL connection error" is not helpful! ↵Tatjana Azundris Nuernberg2011-05-191-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (ssl-verify-server-cert=true vs localhos) SSL errors on client and now more specific to aid end-user with debugging. Also restructures error handling for compliance with SSL docs.
| | * | | WL#5486: Remove code for unsupported platformsDavi Arnaut2010-07-151-34/+0
| | | | | | | | | | | | | | | Remove Netware specific code.
| | * | | Bug#34043: Server loops excessively in _checkchunk() when safemalloc is enabledDavi Arnaut2010-07-081-5/+5
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Essentially, the problem is that safemalloc is excruciatingly slow as it checks all allocated blocks for overrun at each memory management primitive, yielding a almost exponential slowdown for the memory management functions (malloc, realloc, free). The overrun check basically consists of verifying some bytes of a block for certain magic keys, which catches some simple forms of overrun. Another minor problem is violation of aliasing rules and that its own internal list of blocks is prone to corruption. Another issue with safemalloc is rather the maintenance cost as the tool has a significant impact on the server code. Given the magnitude of memory debuggers available nowadays, especially those that are provided with the platform malloc implementation, maintenance of a in-house and largely obsolete memory debugger becomes a burden that is not worth the effort due to its slowness and lack of support for detecting more common forms of heap corruption. Since there are third-party tools that can provide the same functionality at a lower or comparable performance cost, the solution is to simply remove safemalloc. Third-party tools can provide the same functionality at a lower or comparable performance cost. The removal of safemalloc also allows a simplification of the malloc wrappers, removing quite a bit of kludge: redefinition of my_malloc, my_free and the removal of the unused second argument of my_free. Since free() always check whether the supplied pointer is null, redudant checks are also removed. Also, this patch adds unit testing for my_malloc and moves my_realloc implementation into the same file as the other memory allocation primitives.
| | * | Post-merge fixes: fix typo and remove unused variables.Davi Arnaut2009-11-211-1/+0
| | | |
| | * | mergeGeorgi Kodinov2009-10-271-59/+2
| | |\ \ | | | |/
View Lorry Controller Status