Skip to content

Commit 074a15c

Browse files
author
Ramil Kalimullin
committed
WL#9072: Backport WL#8785 to 5.5
1 parent db58dc6 commit 074a15c

18 files changed

Lines changed: 265 additions & 40 deletions

‎client/client_priv.h‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2001, 2014, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -100,6 +100,7 @@ enum options_client
100100
OPT_SERVER_PUBLIC_KEY,
101101
OPT_ENABLE_CLEARTEXT_PLUGIN,
102102
OPT_CONNECTION_SERVER_ID,
103+
OPT_SSL_MODE,
103104
OPT_MAX_CLIENT_OPTION
104105
};
105106

@@ -123,3 +124,36 @@ enum options_client
123124
*/
124125
#define PERFORMANCE_SCHEMA_DB_NAME "performance_schema"
125126

127+
/**
128+
Wrapper for mysql_real_connect() that checks if SSL connection is establised.
129+
130+
The function calls mysql_real_connect() first, then if given ssl_required==TRUE
131+
argument (i.e. --ssl-mode=REQUIRED option used) checks current SSL chiper to
132+
ensure that SSL is used for current connection.
133+
Otherwise it returns NULL and sets errno to CR_SSL_CONNECTION_ERROR.
134+
135+
All clients (except mysqlbinlog which disregards SSL options) use this function
136+
instead of mysql_real_connect() to handle --ssl-mode=REQUIRED option.
137+
*/
138+
MYSQL *mysql_connect_ssl_check(MYSQL *mysql_arg, const char *host,
139+
const char *user, const char *passwd,
140+
const char *db, uint port,
141+
const char *unix_socket, ulong client_flag,
142+
my_bool ssl_required __attribute__((unused)))
143+
{
144+
MYSQL *mysql= mysql_real_connect(mysql_arg, host, user, passwd, db, port,
145+
unix_socket, client_flag);
146+
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
147+
if (mysql && /* connection established. */
148+
ssl_required && /* --ssl-mode=REQUIRED. */
149+
!mysql_get_ssl_cipher(mysql)) /* non-SSL connection. */
150+
{
151+
NET *net= &mysql->net;
152+
net->last_errno= CR_SSL_CONNECTION_ERROR;
153+
strmov(net->last_error, "--ssl-mode=REQUIRED option forbids non SSL connections");
154+
strmov(net->sqlstate, "HY000");
155+
return NULL;
156+
}
157+
#endif
158+
return mysql;
159+
}

‎client/mysql.cc‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -1486,8 +1486,9 @@ sig_handler handle_kill_signal(int sig)
14861486
mysql_options(kill_mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
14871487
mysql_options4(kill_mysql, MYSQL_OPT_CONNECT_ATTR_ADD,
14881488
"program_name", "mysql");
1489-
if (!mysql_real_connect(kill_mysql,current_host, current_user, opt_password,
1490-
"", opt_mysql_port, opt_mysql_unix_port,0))
1489+
if (!mysql_connect_ssl_check(kill_mysql, current_host, current_user,
1490+
opt_password, "", opt_mysql_port,
1491+
opt_mysql_unix_port, 0, opt_ssl_required))
14911492
{
14921493
tee_fprintf(stdout, "%s -- sorry, cannot connect to server to kill query, giving up ...\n", reason);
14931494
goto err;
@@ -4815,9 +4816,10 @@ sql_real_connect(char *host,char *database,char *user,char *password,
48154816
"program_name", "mysql");
48164817
mysql_options(&mysql, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS, &handle_expired);
48174818

4818-
if (!mysql_real_connect(&mysql, host, user, password,
4819-
database, opt_mysql_port, opt_mysql_unix_port,
4820-
connect_flag | CLIENT_MULTI_STATEMENTS))
4819+
if (!mysql_connect_ssl_check(&mysql, host, user, password,
4820+
database, opt_mysql_port, opt_mysql_unix_port,
4821+
connect_flag | CLIENT_MULTI_STATEMENTS,
4822+
opt_ssl_required))
48214823
{
48224824
if (!silent ||
48234825
(mysql_errno(&mysql) != CR_CONN_HOST_ERROR &&

‎client/mysql_upgrade.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -310,6 +310,7 @@ get_one_option(int optid, const struct my_option *opt,
310310
case OPT_DEFAULT_AUTH: /* --default-auth */
311311
add_one_option(&conn_args, opt, argument);
312312
break;
313+
#include <sslopt-case.h>
313314
}
314315

315316
if (add_option)
@@ -400,6 +401,10 @@ static int run_tool(char *tool_path, DYNAMIC_STRING *ds_res, ...)
400401

401402
va_end(args);
402403

404+
/* If given --ssl-mode=REQUIRED propagate it to the tool. */
405+
if (opt_ssl_required)
406+
dynstr_append(&ds_cmdline, "--ssl-mode=REQUIRED");
407+
403408
#ifdef __WIN__
404409
dynstr_append(&ds_cmdline, "\"");
405410
#endif

‎client/mysqladmin.cc‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -551,8 +551,9 @@ static my_bool sql_connect(MYSQL *mysql, uint wait)
551551

552552
for (;;)
553553
{
554-
if (mysql_real_connect(mysql,host,user,opt_password,NullS,tcp_port,
555-
unix_port, CLIENT_REMEMBER_OPTIONS))
554+
if (mysql_connect_ssl_check(mysql, host, user, opt_password, NullS,
555+
tcp_port, unix_port,
556+
CLIENT_REMEMBER_OPTIONS, opt_ssl_required))
556557
{
557558
mysql->reconnect= 1;
558559
if (info)

‎client/mysqlcheck.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2001, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -924,8 +924,10 @@ static int dbConnect(char *host, char *user, char *passwd)
924924
mysql_options(&mysql_connection, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
925925
mysql_options4(&mysql_connection, MYSQL_OPT_CONNECT_ATTR_ADD,
926926
"program_name", "mysqlcheck");
927-
if (!(sock = mysql_real_connect(&mysql_connection, host, user, passwd,
928-
NULL, opt_mysql_port, opt_mysql_unix_port, 0)))
927+
if (!(sock = mysql_connect_ssl_check(&mysql_connection, host, user, passwd,
928+
NULL, opt_mysql_port,
929+
opt_mysql_unix_port, 0,
930+
opt_ssl_required)))
929931
{
930932
DBerror(&mysql_connection, "when trying to connect");
931933
DBUG_RETURN(1);

‎client/mysqldump.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -1553,9 +1553,10 @@ static int connect_to_db(char *host, char *user,char *passwd)
15531553
mysql_options(&mysql_connection, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
15541554
mysql_options4(&mysql_connection, MYSQL_OPT_CONNECT_ATTR_ADD,
15551555
"program_name", "mysqldump");
1556-
if (!(mysql= mysql_real_connect(&mysql_connection,host,user,passwd,
1557-
NULL,opt_mysql_port,opt_mysql_unix_port,
1558-
0)))
1556+
if (!(mysql= mysql_connect_ssl_check(&mysql_connection, host, user,
1557+
passwd, NULL, opt_mysql_port,
1558+
opt_mysql_unix_port, 0,
1559+
opt_ssl_required)))
15591560
{
15601561
DB_error(&mysql_connection, "when trying to connect");
15611562
DBUG_RETURN(1);

‎client/mysqlimport.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -468,9 +468,9 @@ static MYSQL *db_connect(char *host, char *database,
468468
mysql_options(mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
469469
mysql_options4(mysql, MYSQL_OPT_CONNECT_ATTR_ADD,
470470
"program_name", "mysqlimport");
471-
if (!(mysql_real_connect(mysql,host,user,passwd,
472-
database,opt_mysql_port,opt_mysql_unix_port,
473-
0)))
471+
if (!(mysql_connect_ssl_check(mysql, host, user, passwd, database,
472+
opt_mysql_port, opt_mysql_unix_port,
473+
0, opt_ssl_required)))
474474
{
475475
ignore_errors=0; /* NO RETURN FROM db_error */
476476
db_error(mysql);

‎client/mysqlshow.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -156,10 +156,10 @@ int main(int argc, char **argv)
156156
mysql_options(&mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
157157
mysql_options4(&mysql, MYSQL_OPT_CONNECT_ATTR_ADD,
158158
"program_name", "mysqlshow");
159-
if (!(mysql_real_connect(&mysql,host,user,opt_password,
160-
(first_argument_uses_wildcards) ? "" :
161-
argv[0],opt_mysql_port,opt_mysql_unix_port,
162-
0)))
159+
if (!(mysql_connect_ssl_check(&mysql, host, user, opt_password,
160+
(first_argument_uses_wildcards) ? "" :
161+
argv[0], opt_mysql_port, opt_mysql_unix_port,
162+
0, opt_ssl_required)))
163163
{
164164
fprintf(stderr,"%s: %s\n",my_progname,mysql_error(&mysql));
165165
exit(1);

‎client/mysqlslap.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -369,9 +369,9 @@ int main(int argc, char **argv)
369369
(char*) &opt_enable_cleartext_plugin);
370370
if (!opt_only_print)
371371
{
372-
if (!(mysql_real_connect(&mysql, host, user, opt_password,
373-
NULL, opt_mysql_port,
374-
opt_mysql_unix_port, connect_flags)))
372+
if (!(mysql_connect_ssl_check(&mysql, host, user, opt_password,
373+
NULL, opt_mysql_port, opt_mysql_unix_port,
374+
connect_flags, opt_ssl_required)))
375375
{
376376
fprintf(stderr,"%s: Error when connecting to server: %s\n",
377377
my_progname,mysql_error(&mysql));

‎client/mysqltest.cc‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5315,8 +5315,9 @@ void safe_connect(MYSQL* mysql, const char *name, const char *host,
53155315
"program_name", "mysqltest");
53165316
mysql_options(mysql, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS,
53175317
&can_handle_expired_passwords);
5318-
while(!mysql_real_connect(mysql, host,user, pass, db, port, sock,
5319-
CLIENT_MULTI_STATEMENTS | CLIENT_REMEMBER_OPTIONS))
5318+
while(!mysql_connect_ssl_check(mysql, host,user, pass, db, port, sock,
5319+
CLIENT_MULTI_STATEMENTS | CLIENT_REMEMBER_OPTIONS,
5320+
opt_ssl_required))
53205321
{
53215322
/*
53225323
Connect failed
@@ -5420,8 +5421,9 @@ int connect_n_handle_errors(struct st_command *command,
54205421
mysql_options4(con, MYSQL_OPT_CONNECT_ATTR_ADD, "program_name", "mysqltest");
54215422
mysql_options(con, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS,
54225423
&can_handle_expired_passwords);
5423-
while (!mysql_real_connect(con, host, user, pass, db, port, sock ? sock: 0,
5424-
CLIENT_MULTI_STATEMENTS))
5424+
while (!mysql_connect_ssl_check(con, host, user, pass, db, port,
5425+
sock ? sock: 0, CLIENT_MULTI_STATEMENTS,
5426+
opt_ssl_required))
54255427
{
54265428
/*
54275429
If we have used up all our connections check whether this

0 commit comments

Comments
 (0)