Skip to content

Commit

Permalink
cleanup: unify client's setting of ssl options
Browse files Browse the repository at this point in the history
  • Loading branch information
@vuvova
vuvova committed Feb 3, 2024
1 parent 03094bb commit 585c096
Show file tree
Hide file tree
Showing 10 changed files with 37 additions and 122 deletions.
13 changes: 1 addition & 12 deletions client/mysql.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1496,18 +1496,7 @@ static bool do_connect(MYSQL *mysql, const char *host, const char *user,
{
if (opt_secure_auth)
mysql_options(mysql, MYSQL_SECURE_AUTH, (char *) &opt_secure_auth);
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
if (opt_use_ssl && opt_protocol <= MYSQL_PROTOCOL_SOCKET)
{
mysql_ssl_set(mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(mysql);
if (opt_protocol)
mysql_options(mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);
if (opt_plugin_dir && *opt_plugin_dir)
Expand Down
15 changes: 3 additions & 12 deletions client/mysqladmin.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -370,18 +370,9 @@ int main(int argc,char *argv[])
uint tmp=opt_connect_timeout;
mysql_options(&mysql,MYSQL_OPT_CONNECT_TIMEOUT, (char*) &tmp);
}
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(&mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(&mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif

SET_SSL_OPTS(&mysql);

if (opt_protocol)
mysql_options(&mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);
if (!strcmp(default_charset,MYSQL_AUTODETECT_CHARSET_NAME))
Expand Down
13 changes: 1 addition & 12 deletions client/mysqlbinlog.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2351,18 +2351,7 @@ static Exit_status safe_connect()
return ERROR_STOP;
}

#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif /*HAVE_OPENSSL*/
SET_SSL_OPTS(mysql);

if (opt_plugindir && *opt_plugindir)
mysql_options(mysql, MYSQL_PLUGIN_DIR, opt_plugindir);
Expand Down
13 changes: 1 addition & 12 deletions client/mysqlcheck.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1124,18 +1124,7 @@ static int dbConnect(char *host, char *user, char *passwd)
mysql_init(&mysql_connection);
if (opt_compress)
mysql_options(&mysql_connection, MYSQL_OPT_COMPRESS, NullS);
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(&mysql_connection, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(&mysql_connection, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(&mysql_connection, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(&mysql_connection);
if (opt_protocol)
mysql_options(&mysql_connection,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);

Expand Down
13 changes: 1 addition & 12 deletions client/mysqldump.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1992,18 +1992,7 @@ static MYSQL* connect_to_db(char *host, char *user,char *passwd)
MYSQL* con = mysql_init(NULL);
if (opt_compress)
mysql_options(con,MYSQL_OPT_COMPRESS,NullS);
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(con, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(con, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(con, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(con, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(con,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(con);
if (opt_protocol)
mysql_options(con,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);
mysql_options(con, MYSQL_SET_CHARSET_NAME, default_charset);
Expand Down
13 changes: 1 addition & 12 deletions client/mysqlimport.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -461,18 +461,7 @@ static MYSQL *db_connect(char *host, char *database,
if (opt_local_file)
mysql_options(mysql,MYSQL_OPT_LOCAL_INFILE,
(char*) &opt_local_file);
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(mysql);
if (opt_protocol)
mysql_options(mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);

Expand Down
13 changes: 1 addition & 12 deletions client/mysqlshow.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,18 +120,7 @@ int main(int argc, char **argv)
mysql_init(&mysql);
if (opt_compress)
mysql_options(&mysql,MYSQL_OPT_COMPRESS,NullS);
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(&mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(&mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(&mysql);
if (opt_protocol)
mysql_options(&mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);

Expand Down
13 changes: 1 addition & 12 deletions client/mysqlslap.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -295,18 +295,7 @@ void set_mysql_connect_options(MYSQL *mysql)
{
if (opt_compress)
mysql_options(mysql,MYSQL_OPT_COMPRESS,NullS);
#ifdef HAVE_OPENSSL
if (opt_use_ssl)
{
mysql_ssl_set(mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
}
mysql_options(mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
(char*)&opt_ssl_verify_server_cert);
#endif
SET_SSL_OPTS(mysql);
if (opt_protocol)
mysql_options(mysql,MYSQL_OPT_PROTOCOL,(char*)&opt_protocol);
mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset);
Expand Down
37 changes: 11 additions & 26 deletions client/mysqltest.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,13 @@ DYNAMIC_ARRAY q_lines;

#include "sslopt-vars.h"

#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
static void set_ssl_opts(MYSQL *mysql, my_bool opt_use_ssl, char *opt_ssl_cipher)
{
SET_SSL_OPTS(mysql);
}
#endif

struct Parser
{
int read_lines,current_line;
Expand Down Expand Up @@ -6166,19 +6173,9 @@ void do_connect(struct st_command *command)
opt_charsets_dir);

#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
if (con_ssl == USE_SSL_IF_POSSIBLE && opt_use_ssl)
con_ssl= USE_SSL_REQUIRED;

if (con_ssl == USE_SSL_REQUIRED)
{
mysql_ssl_set(con_slot->mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, ssl_cipher ? ssl_cipher : opt_ssl_cipher);
mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(con_slot->mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
mysql_options(con_slot->mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
&opt_ssl_verify_server_cert);
}
set_ssl_opts(con_slot->mysql, con_ssl == USE_SSL_FORBIDDEN ? 0 :
con_ssl == USE_SSL_REQUIRED ? 1 : opt_use_ssl,
ssl_cipher ? ssl_cipher : opt_ssl_cipher);
#endif

if (protocol)
Expand Down Expand Up @@ -10116,19 +10113,7 @@ int main(int argc, char **argv)
if (opt_plugin_dir && *opt_plugin_dir)
mysql_options(con->mysql, MYSQL_PLUGIN_DIR, opt_plugin_dir);

#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)

if (opt_use_ssl)
{
mysql_ssl_set(con->mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
opt_ssl_capath, opt_ssl_cipher);
mysql_options(con->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
mysql_options(con->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
mysql_options(con->mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
mysql_options(con->mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
&opt_ssl_verify_server_cert);
}
#endif
SET_SSL_OPTS(con->mysql);

if (!(con->name = my_strdup(PSI_NOT_INSTRUMENTED, "default", MYF(MY_WME))))
die("Out of memory");
Expand Down
16 changes: 16 additions & 0 deletions include/sslopt-vars.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,22 @@ SSL_STATIC char *opt_ssl_crlpath = 0;
SSL_STATIC char *opt_tls_version = 0;
#ifdef MYSQL_CLIENT
SSL_STATIC my_bool opt_ssl_verify_server_cert= 0;

#define SET_SSL_OPTS(M) \
do { \
if (opt_use_ssl) \
{ \
mysql_ssl_set((M), opt_ssl_key, opt_ssl_cert, opt_ssl_ca, \
opt_ssl_capath, opt_ssl_cipher); \
mysql_options((M), MYSQL_OPT_SSL_CRL, opt_ssl_crl); \
mysql_options((M), MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath); \
mysql_options((M), MARIADB_OPT_TLS_VERSION, opt_tls_version); \
} \
mysql_options((M),MYSQL_OPT_SSL_VERIFY_SERVER_CERT, \
&opt_ssl_verify_server_cert); \

This comment has been minimized.

Sign in to view

Copy link
@dlenski

dlenski Apr 4, 2024 •
edited

Contributor

⚠️ This, along with the mysqltest.cc changes, breaks every single MTR that tries to use NOSSL, because both the USE_SSL_FORBIDDEN and USE_SSL_REQUIRED cases will follow the same branch of this if statement.

This comment has been minimized.

Sign in to view

Copy link
@dlenski

dlenski Apr 4, 2024

Contributor

That's because they are defined as follows…

enum use_ssl
{
  USE_SSL_FORBIDDEN = -1,
  USE_SSL_IF_POSSIBLE /* = 0 */,
  USE_SSL_REQUIRED /* = 1 */
};

This comment has been minimized.

Sign in to view

Copy link
@grooverdan

grooverdan Apr 4, 2024

Member

bug report with test case please. Too easy to loose this assessment otherwise.

This comment has been minimized.

Sign in to view

Copy link
@dlenski

dlenski Apr 4, 2024

Contributor

Already created https://jira.mariadb.org/browse/MDEV-33822

This comment has been minimized.

Sign in to view

Copy link
@dlenski

dlenski Apr 4, 2024

Contributor

I am definitely seeing failures in all the tests with NOSSL, but may have jumped to a premature conclusion about exactly which commit broke this. Will update tomorrow.
} while(0)
#endif
#else
#define SET_SSL_OPTS(M) do { } while(0)
#endif
#endif /* SSLOPT_VARS_INCLUDED */

0 comments on commit 585c096

Please sign in to comment.