From e116f11f0aeb740667294185534c859928dc125d Mon Sep 17 00:00:00 2001 From: Vladislav Vaintroub Date: Wed, 24 Apr 2019 11:15:08 +0200 Subject: MDEV-18131 MariaDB does not verify IP addresses from subject alternative names Added a call to X509_check_ip_asc() in case server_hostname represents an IP address. --- mysql-test/lib/generate-ssl-certs.sh | 2 +- mysql-test/r/ssl.result | 4 +- mysql-test/r/ssl_verify_ip.result | 4 + mysql-test/std_data/cacert.pem | 116 ++++++++-------- mysql-test/std_data/cakey.pem | 52 +++---- mysql-test/std_data/client-cert.pem | 84 ++++++------ mysql-test/std_data/client-key.pem | 26 ++-- mysql-test/std_data/server-cert.pem | 84 ++++++------ mysql-test/std_data/server-key.pem | 26 ++-- mysql-test/std_data/server8k-cert.pem | 242 ++++++++++++++++----------------- mysql-test/std_data/server8k-key.pem | 194 +++++++++++++------------- mysql-test/std_data/serversan-cert.pem | 80 +++++------ mysql-test/std_data/serversan-key.pem | 28 ++-- mysql-test/suite.pm | 5 + mysql-test/t/ssl_verify_ip.opt | 3 + mysql-test/t/ssl_verify_ip.test | 3 + sql-common/client.c | 6 +- 17 files changed, 488 insertions(+), 471 deletions(-) create mode 100644 mysql-test/r/ssl_verify_ip.result create mode 100644 mysql-test/t/ssl_verify_ip.opt create mode 100644 mysql-test/t/ssl_verify_ip.test diff --git a/mysql-test/lib/generate-ssl-certs.sh b/mysql-test/lib/generate-ssl-certs.sh index 8f15ba9d521..4b333854c08 100755 --- a/mysql-test/lib/generate-ssl-certs.sh +++ b/mysql-test/lib/generate-ssl-certs.sh @@ -31,7 +31,7 @@ openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_ # with SubjectAltName, only for OpenSSL 1.0.2+ cat > demoCA/sanext.conf <