Skip to content

Commit c7e6860

Browse files
author
Arun Kuruvila
committed
Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE
 FOUND Description:- Failure during the validation of CA certificate path which is provided as an option for 'ssl-ca' returns two different errors for YaSSL and OPENSSL. Analysis:- 'ssl-ca', option used for specifying the ssl ca certificate path. Failing to validate this certificate with OPENSSL returns an error, "ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed". While YASSL returns "ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation". Error returned by the OPENSSL is correct since "SSL_CTX_load_verify_locations()" returns 0 (in case of OPENSSL) for the failure and sets error as "SSL_INITERR_BAD_PATHS". In case of YASSL, "SSL_CTX_load_verify_locations()" returns an error number which is less than or equal to 0 in case of error. Error numbers for YASSL is mentioned in the file, 'extra/yassl/include/openssl/ssl.h'(line no : 292). Also 'ssl-ca' does not accept tilde home directory path substitution. Fix:- The condition which checks for the error in the "SSL_CTX_load_verify_locations()" is changed in order to accommodate YASSL as well. A logic is written in "mysql_ssl_set()" in order accept the tilde home directory path substitution for all ssl options.
1 parent 96f680a commit c7e6860

4 files changed

Lines changed: 80 additions & 6 deletions

File tree

‎mysql-test/r/ssl_ca.result‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#
2+
# Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE FOUND
3+
#
4+
# try to connect with wrong '--ssl-ca' path : should fail
5+
ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed
6+
# try to connect with correct '--ssl-ca' path : should connect
7+
Variable_name Value
8+
Ssl_cipher DHE-RSA-AES256-SHA
9+
#
10+
# Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
11+
# PATH SUBSTITUTION
12+
#
13+
# try to connect with '--ssl-ca' option using tilde home directoy
14+
# path substitution : should connect
15+
Variable_name Value
16+
Ssl_cipher DHE-RSA-AES256-SHA
17+
# try to connect with '--ssl-key' option using tilde home directoy
18+
# path substitution : should connect
19+
Variable_name Value
20+
Ssl_cipher DHE-RSA-AES256-SHA
21+
# try to connect with '--ssl-cert' option using tilde home directoy
22+
# path substitution : should connect
23+
Variable_name Value
24+
Ssl_cipher DHE-RSA-AES256-SHA

‎mysql-test/t/ssl_ca.test‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--source include/have_ssl.inc
2+
--source include/not_embedded.inc
3+
4+
--echo #
5+
--echo # Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE FOUND
6+
--echo #
7+
8+
--echo # try to connect with wrong '--ssl-ca' path : should fail
9+
--error 1
10+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/wrong-cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'" 2>&1
11+
12+
--echo # try to connect with correct '--ssl-ca' path : should connect
13+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
14+
15+
--echo #
16+
--echo # Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
17+
--echo # PATH SUBSTITUTION
18+
--echo #
19+
20+
--let $mysql_test_dir_path= `SELECT REPLACE('$MYSQL_TEST_DIR', '$HOME', '~')`
21+
22+
--echo # try to connect with '--ssl-ca' option using tilde home directoy
23+
--echo # path substitution : should connect
24+
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
25+
--exec $MYSQL --ssl-ca=$mysql_test_dir_path/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
26+
27+
--echo # try to connect with '--ssl-key' option using tilde home directoy
28+
--echo # path substitution : should connect
29+
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
30+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$mysql_test_dir_path/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
31+
32+
--echo # try to connect with '--ssl-cert' option using tilde home directoy
33+
--echo # path substitution : should connect
34+
--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
35+
--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$mysql_test_dir_path/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"

‎sql-common/client.c‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1204,6 +1204,21 @@ static int add_init_command(struct st_mysql_options *options, const char *cmd)
12041204
my_strdup((STR), MYF(MY_WME)) : NULL; \
12051205
} while (0)
12061206

1207+
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
1208+
static char *set_ssl_option_unpack_path(const char *arg)
1209+
{
1210+
char *opt_var= NULL;
1211+
if (arg)
1212+
{
1213+
char *buff= (char *)my_malloc(FN_REFLEN + 1, MYF(MY_WME));
1214+
unpack_filename(buff, (char *)arg);
1215+
opt_var= my_strdup(buff, MYF(MY_WME));
1216+
my_free(buff);
1217+
}
1218+
return opt_var;
1219+
}
1220+
#endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */
1221+
12071222
void mysql_read_default_options(struct st_mysql_options *options,
12081223
const char *filename,const char *group)
12091224
{
@@ -1798,10 +1813,10 @@ mysql_ssl_set(MYSQL *mysql __attribute__((unused)) ,
17981813
{
17991814
DBUG_ENTER("mysql_ssl_set");
18001815
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
1801-
mysql->options.ssl_key= strdup_if_not_null(key);
1802-
mysql->options.ssl_cert= strdup_if_not_null(cert);
1803-
mysql->options.ssl_ca= strdup_if_not_null(ca);
1804-
mysql->options.ssl_capath= strdup_if_not_null(capath);
1816+
mysql->options.ssl_key= set_ssl_option_unpack_path(key);
1817+
mysql->options.ssl_cert= set_ssl_option_unpack_path(cert);
1818+
mysql->options.ssl_ca= set_ssl_option_unpack_path(ca);
1819+
mysql->options.ssl_capath= set_ssl_option_unpack_path(capath);
18051820
mysql->options.ssl_cipher= strdup_if_not_null(cipher);
18061821
#endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY */
18071822
DBUG_RETURN(0);

‎vio/viosslfactories.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -250,7 +250,7 @@ new_VioSSLFd(const char *key_file, const char *cert_file,
250250
}
251251

252252
/* Load certs from the trusted ca */
253-
if (SSL_CTX_load_verify_locations(ssl_fd->ssl_context, ca_file, ca_path) == 0)
253+
if (SSL_CTX_load_verify_locations(ssl_fd->ssl_context, ca_file, ca_path) <= 0)
254254
{
255255
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
256256
if (ca_file || ca_path)

0 commit comments

Comments
 (0)