summaryrefslogtreecommitdiff
path: root/vio
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '10.0' into 10.1Vicențiu Ciorbaru2017-09-191-4/+0
|\
| * Build improvements and cleanups.Vladislav Vaintroub2017-09-081-4/+0
| | | | | | | | | | | | | | | | | | - the probably ultimate fix for dependencies on VS - remove some GET_TARGET_PROPERTY(LOCATION ...), they are deprecated in cmake 3.9 - simplify signing targets on Windows. - remove INSTALL_DEBUG_TARGET, we do not mix binaries from different builds in the same package
* | Merge branch '10.0' into 10.1Sergei Golubchik2016-08-251-2/+24
|\ \ | |/
| * Cleanups and minor fixesMonty2016-08-211-2/+24
| | | | | | | | | | | | | | | | - Fixed typos - Added --core-on-failure to mysql-test-run - More DBUG_PRINT in viosocket.c - Don't forget CLIENT_REMEMBER_OPTIONS for compressed slave protocol - Removed not used stage variables
* | Merge branch '10.0' into 10.1Sergei Golubchik2016-06-281-3/+3
|\ \ | |/
| * Merge branch '5.5' into bb-10.0Sergei Golubchik2016-06-211-3/+3
| |\
| | * Merge branch 'mysql/5.5' into 5.5Sergei Golubchik2016-06-141-3/+3
| | |\
| | | * Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BEArun Kuruvila2016-03-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FOUND Description:- Failure during the validation of CA certificate path which is provided as an option for 'ssl-ca' returns two different errors for YaSSL and OPENSSL. Analysis:- 'ssl-ca', option used for specifying the ssl ca certificate path. Failing to validate this certificate with OPENSSL returns an error, "ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed". While YASSL returns "ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation". Error returned by the OPENSSL is correct since "SSL_CTX_load_verify_locations()" returns 0 (in case of OPENSSL) for the failure and sets error as "SSL_INITERR_BAD_PATHS". In case of YASSL, "SSL_CTX_load_verify_locations()" returns an error number which is less than or equal to 0 in case of error. Error numbers for YASSL is mentioned in the file, 'extra/yassl/include/openssl/ssl.h'(line no : 292). Also 'ssl-ca' does not accept tilde home directory path substitution. Fix:- The condition which checks for the error in the "SSL_CTX_load_verify_locations()" is changed in order to accommodate YASSL as well. A logic is written in "mysql_ssl_set()" in order accept the tilde home directory path substitution for all ssl options.
| | | * Bug #21221862 NEWEST RHEL/CENTOS OPENSSL UPDATE BREAKS MYSQL DHE CIPHERSV S Murthy Sidagam2015-06-191-15/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Description: The newest RHEL/CentOS/SL 6.6 openssl package (1.0.1e-30.el6_6.9; published around 6/4/2015) contains a fix for LogJam. RedHat's fix for this was to limit the use of any SSL DH key sizes to a minimum of 768 bits. This breaks any DHE SSL ciphers for MySQL clients as soon as you install the openssl update, since in vio/viosslfactories.c, the default DHPARAM is a 512 bit one. This cannot be changed in configuration/runtime; and needs a recompile. Because of this the client connection with --ssl-cipher=DHE-RSA-AES256-SHA is not able to connect the server. Analysis: Openssl has changed Diffie-Hellman key from the 512 to 1024 due to some reasons(please see the details at http://openssl.org/news/secadv_20150611.txt) Because of this the client with DHE cipher is failing to connect the server. This change took place from the openssl-1.0.1n onwards. Fix: Similar bug fix is already pushed to mysql-5.7 under bug#18367167. Hence we backported the same fix to mysql-5.5 and mysql-5.6.
| | | * Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINEDV S Murthy Sidagam2015-04-211-1/+1
| | | | | | | | | | | | | | | | post push change: fixing valgrind failures
| | | * Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINEDV S Murthy Sidagam2015-04-201-1/+5
| | | | | | | | | | | | | | | | | | | | post push change: missed the change in mysql-5.5 (Fixing compiler warning/error)
| | | * Bug #16861371 SSL_OP_NO_COMPRESSION NOT DEFINEDV S Murthy Sidagam2015-04-201-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Description: Can't build mysql-5.5 latest source with openssl 0.9.8e. Analysis: Older OpenSSL versions(prior to openssl 1.0) doesn't have 'SSL_OP_NO_COMPRESSION' defined. Hence the build is failing with SSL_OP_NO_COMPRESSION undeclared. Fix: Added a conditonal compilation for 'SSL_OP_NO_COMPRESSION'. i.e if 'SSL_OP_NO_COMPRESSION' is defined then have the SSL_set_options call for OpenSSL 1.0 versions. Have sk_SSL_COMP_zero() call for OpenSSL 0.9.8 version
* | | | Merge branch '10.0' into 10.1Sergei Golubchik2016-02-231-0/+4
|\ \ \ \ | |/ / /
| * | | Merge branch '5.5' into 10.0Sergei Golubchik2016-02-151-0/+4
| |\ \ \ | | |/ /
| | * | MDEV-9314 fatal build error: viosslfactories.c:58:5: error: dereferencing ↵Sergei Golubchik2016-02-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | pointer to incomplete type ‘DH {aka struct dh_st} fixes for openssl that was built with -DOPENSSL_NO_DEPRECATED
* | | | MDEV-8957 [PATCH] Useless ssl_ctx_set_tmp_dh call in libmysqlOleksandr Byelkin2015-11-151-6/+9
|/ / / | | | | | | | | | Accepted patch of Georg: do not setup Differ-Hellman parameters on client.
* | | Merge commit '96badb16afcf' into 10.0Jan Lindström2015-08-031-18/+29
|\ \ \ | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: client/mysql_upgrade.c mysql-test/r/func_misc.result mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result mysql-test/suite/innodb/r/innodb-fk.result mysql-test/t/subselect_sj_mat.test sql/item.cc sql/item_func.cc sql/log.cc sql/log_event.cc sql/rpl_utility.cc sql/slave.cc sql/sql_class.cc sql/sql_class.h sql/sql_select.cc storage/innobase/dict/dict0crea.c storage/innobase/dict/dict0dict.c storage/innobase/handler/ha_innodb.cc storage/xtradb/dict/dict0crea.c storage/xtradb/dict/dict0dict.c storage/xtradb/handler/ha_innodb.cc vio/viosslfactories.c
| * | MDEV-8352 Increase Diffie-Helman modulus to 2048-bitsSergei Golubchik2015-07-311-18/+29
| | |
| * | MDEV-7695 MariaDB - ssl - fips: can not connect with ↵Sergei Golubchik2015-06-091-26/+26
| | | | | | | | | | | | | | | | | | --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure Change 512bit DH key to 1024bit to meet FIPS requirements
* | | MDEV-8096 vio timeouts are multiplied by 1000 for sslSergei Golubchik2015-05-051-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in when using vio->read_timeout (and write_timeout) to set timeouts of a new vio, as in: vio_timeout(vio, 0, old_vio.read_timeout) vio_timeout(vio, 0, old_vio.write_timeout) remember that timeouts are stored in ms, but vio_timeout()'s argument is in seconds.
* | | MDEV-8014 MariaDB client can hang in an infinite loopSergei Golubchik2015-05-031-0/+3
| | | | | | | | | | | | | | | | | | On EOF vio_read returns 0, it's not an error so the errno is not reset. If the previous error was EINTR the client will loop forever. See also man recv.
* | | SSL: Verbosely report SSL initialization errorsSergei Golubchik2015-05-031-21/+25
| | | | | | | | | | | | And don't ignore SSL_CTX_set_tmp_dh() failures
* | | MDEV-7695 MariaDB - ssl - fips: can not connect with ↵Sergei Golubchik2015-05-031-26/+26
| | | | | | | | | | | | | | | | | | --ssl-cipher=DHE-RSA-AES256-SHA - handshake failure Change 512bit DH key to 1024bit to meet FIPS requirements
* | | Merge branch '5.5' into 10.0Sergei Golubchik2015-02-181-2/+4
|\ \ \ | |/ /
| * | Merge remote-tracking branch 'mysql/5.5' into bb-5.5-merge @ mysql-5.5.42Sergei Golubchik2015-02-111-2/+4
| |\ \ | | |/
| | * Bug#19820550 : DISABLE SSL 3.0 SUPPORT IN OPENSSLHarin Vadodaria2015-01-021-1/+4
| | | | | | | | | | | | Explicitly disable weaker SSL protocols.
| | * Backport from trunk:Tor Didriksen2014-05-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug#18187290 ISSUE WITH BUILDING MYSQL USING CMAKE 2.8.12 We want to upgrade to VS2013 on Windows. In order to do this, we need to upgrade to cmake 2.8.12 This has introduced some incompatibilities for .pdb files, and "make install" no longer works. To reproduce: cmake --build . --target package --config debug The fix: Rather than installing .pdb files for static libraries, we use the /Z7 flag to store symbolic debugging information in the .obj files.
| | * Updated/added copyright headersMurthy Narkedimilli2014-01-063-3/+3
| | |
| | * Bug 13878021 - WINDOWS PACKAGE THAT INCLUDES .PDB FILES FOR INTERMEDIATE ↵Sreedhar.S2013-10-091-0/+5
| | | | | | | | | | | | LIBRARIES USED
| | * BUG#17294150-POTENTIAL CRASH DUE TO BUFFER OVERRUN IN SSL Raghav Kapoor2013-08-281-1/+1
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ERROR HANDLING CODE BACKGROUND: There can be a potential crash due to buffer overrun in SSL error handling code due to missing comma in ssl_error_string[] array in viosslfactories.c. ANALYSIS: Found by code Inspection. FIX: Added the missing comma in SSL error handling code in ssl_error_string[] array in viosslfactories.c.
| | | * BUG#17294150-POTENTIAL CRASH DUE TO BUFFER OVERRUN IN SSL Raghav Kapoor2013-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ERROR HANDLING CODE BACKGROUND: There can be a potential crash due to buffer overrun in SSL error handling code due to missing comma in ssl_error_string[] array in viosslfactories.c. ANALYSIS: Found by code Inspection. FIX: Added the missing comma in SSL error handling code in ssl_error_string[] array in viosslfactories.c.
| | | * Bug 16395495 - OLD FSF ADDRESS IN GPL HEADERMurthy Narkedimilli2013-03-196-6/+6
| | | |
| | | * Updated/added copyright headers.Murthy Narkedimilli2013-02-258-9/+8
| | | |
| | * | Bug#16235681: TURN OFF DEFAULT COMPRESSION WHILE USINGHarin Vadodaria2013-02-191-0/+3
| | |\ \ | | | |/ | | | | | | | | | | | | OPENSSL Description: Merge from 5.1.
| | | * Bug#16235681: TURN OFF DEFAULT COMPRESSION WHILE USINGHarin Vadodaria2013-02-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OPENSSL Description: Specify preference to disable compression while using OpenSSL library. OpenSSL uses zlib compression by default which may lead to some problems.
| | * | Bug #13115401: -SSL-KEY VALUE IS NOT VALIDATED AND IT ALLOWS INSECURE Venkata Sidagam2012-08-111-37/+55
| | |\ \ | | | |/ | | | | | | | | | | | | CONNECTIONS IF SPE Merged from mysql-5.1 to mysql-5.5
| | | * Bug #13115401: -SSL-KEY VALUE IS NOT VALIDATED AND IT ALLOWS INSECURE Venkata Sidagam2012-08-111-37/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CONNECTIONS IF SPE Problem description: -ssl-key value is not validated, you can assign any bogus text to --ssl-key and it is not verified that it exists, and more importantly, it allows the client to connect to mysqld. Fix: Added proper validations checks for --ssl-key. Note: 1) Documentation changes require for 5.1, 5.5, 5.6 and trunk in the sections listed below and the details are : http://dev.mysql.com/doc/refman/5.6/en/ssl-options.html#option_general_ssl and REQUIRE SSL section of http://dev.mysql.com/doc/refman/5.6/en/grant.html 2) Client having with option '--ssl', should able to get ssl connection. This will be implemented as part of separate fix in 5.6 and trunk.
| | * | merge 5.1->5.5Georgi Kodinov2012-05-151-5/+7
| | |\ \ | | | |/
| | | * Bug #11761822: yassl rejects valid certificate which openssl acceptsGeorgi Kodinov2012-05-151-4/+6
| | | | | | | | | | | | | | | | | | | | Applied the fix that updates yaSSL to 2.2.1 and fixes parsing this particular certificate. Added a test case with the certificate itself.
| | * | Merge 5.5.24 back into main 5.5.Joerg Bruehe2012-05-071-2/+38
| | |\ \ | | | | | | | | | | | | | | | | | | | | This is a weave merge, but without any conflicts. In 14 source files, the copyright year needed to be updated to 2012.
| | | * \ BUG#13431369 - MAIN.VARIABLES-NOTEMBEDDED CRASHES THE SERVER SPORADICALLY ON ↵Tatjana Azundris Nuernberg2012-02-191-1/+37
| | | |\ \ | | |/ / / | | | | _ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WINDOWS On shutdown(), Windows can drop traffic still queued for sending even if that wasn't specifically requested. As a result, fatal errors (those after signaling which the server will drop the connection) were sometimes only seen as "connection lost" on the client side, because the server-side shutdown() erraneously discarded the correct error message before sending it. If on Windows, we now use the Windows API to access the (non-broken) equivalent of shutdown(). Backport from trunk
| | | * BUG#13431369 - MAIN.VARIABLES-NOTEMBEDDED CRASHES THE SERVER SPORADICALLY ON ↵Tatjana Azundris Nuernberg2012-02-171-1/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WINDOWS On shutdown(), Windows can drop traffic still queued for sending even if that wasn't specifically requested. As a result, fatal errors (those after signaling which the server will drop the connection) were sometimes only seen as "connection lost" on the client side, because the server-side shutdown() erraneously discarded the correct error message before sending it. If on Windows, we now use the Windows API to access the (non-broken) equivalent of shutdown(). Backport from trunk
| | | * Updated/added copyright headersKent Boortz2011-07-031-14/+14
| | | |\
| | * | \ Updated/added copyright headersKent Boortz2011-07-041-1/+2
| | |\ \ \
| | * \ \ \ Updated/added copyright headersKent Boortz2011-06-3010-16/+47
| | |\ \ \ \ | | | |/ / / | | |/| / / | | | |/ /
| | | * | Updated/added copyright headersKent Boortz2011-06-306-8/+49
| | | |\ \
| | | | * | Updated/added copyright headersKent Boortz2011-06-302-4/+8
| | | | | |
| | * | | | build fixes for -Werror (11745920)Tatjana Azundris Nuernberg2011-05-271-2/+4
| | | | | |
| | * | | | Bug#11745920/Bug#21287: "SSL connection error" is not helpful! ↵Tatjana Azundris Nuernberg2011-05-196-21/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (ssl-verify-server-cert=true vs localhos) SSL errors on client and now more specific to aid end-user with debugging. Also restructures error handling for compliance with SSL docs.
| | * | | | BUG#11762616: BUG#55229: 'POSTION'Luis Soares2011-05-061-13/+15
| | |\ \ \ \ | | | | |_|/ | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual merge from mysql-5.1 into mysql-5.5. Conflicts ========= Text conflict in mysql-test/suite/rpl/t/rpl_row_until.test Text conflict in sql/handler.h Text conflict in storage/archive/ha_archive.cc
View Lorry Controller Status