From 3e3c5d72c8fbff5994edcb43d3cf387628de2d32 Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Wed, 22 Apr 2026 22:21:23 +0200 Subject: [PATCH] MDEV-39413 wsrep unsafe handling of parameters introduce safe() wrapper for parameters that can later be interpolated into command line. Use as - var="foo$BAR" + var="foo$(safe BAR)" A parameter is safe, if it contains no spaces, single quotes or backticks --- mysql-test/lib/generate-ssl-certs.sh | 4 +- mysql-test/std_data/server-new-cert.pem | 205 +++++++++--------- mysql-test/std_data/server-new-key.pem | 103 ++++----- ...mariabackup_encrypt_with_key_server.result | 22 +- ...t_mariabackup_encrypt_with_key_server.test | 52 ++++- scripts/wsrep_sst_common.sh | 9 + scripts/wsrep_sst_mariabackup.sh | 14 +- 7 files changed, 236 insertions(+), 173 deletions(-) diff --git a/mysql-test/lib/generate-ssl-certs.sh b/mysql-test/lib/generate-ssl-certs.sh index 57caf3b7a4e..cdd73702867 100755 --- a/mysql-test/lib/generate-ssl-certs.sh +++ b/mysql-test/lib/generate-ssl-certs.sh @@ -27,8 +27,8 @@ openssl rsa -in server-key.pem -out server-key.pem # sign the server certificate with CA certificate openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server-cert.pem -in demoCA/server-req.pem -# server certificate with different validity period (MDEV-7598) -openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj '/CN=server-new/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' +# server certificate with different validity period (MDEV-7598) and unsafe for shell interpolation (MDEV-39413) +openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj /CN="'\`touch A\`'"'-"`touch B`"/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' openssl rsa -in server-new-key.pem -out server-new-key.pem openssl ca -keyfile cakey.pem -days 7301 -batch -cert cacert.pem -policy policy_anything -out server-new-cert.pem -in demoCA/server-new-req.pem diff --git a/mysql-test/std_data/server-new-cert.pem b/mysql-test/std_data/server-new-cert.pem index 14a732495bc..6a580881ed1 100644 --- a/mysql-test/std_data/server-new-cert.pem +++ b/mysql-test/std_data/server-new-cert.pem @@ -1,123 +1,120 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 2 (0x2) + Serial Number: 3 (0x3) Signature Algorithm: sha256WithRSAEncryption Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB Validity - Not Before: Mar 3 03:03:03 2020 GMT - Not After : Feb 28 03:03:03 2040 GMT - Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN=server-new + Not Before: Apr 22 18:06:08 2026 GMT + Not After : Apr 18 18:06:08 2046 GMT + Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN='`touch A`'-"`touch B`" Subject Public Key Info: Public Key Algorithm: rsaEncryption - RSA Public-Key: (4096 bit) + Public-Key: (4096 bit) Modulus: - 00:bb:a2:d6:cc:2d:ff:d1:91:03:41:0a:d9:e8:78: - cd:f7:6c:b7:8a:b0:37:e7:a2:79:c3:4e:08:da:f2: - ec:bd:ba:83:e8:e9:3d:56:56:8e:d3:b8:d7:f2:b4: - 95:99:39:26:a5:b2:92:b0:09:5d:42:ee:61:06:45: - 9c:e6:c6:f4:7a:ee:45:5f:bb:4b:29:1d:f2:1d:4b: - 64:16:ca:c3:0c:58:95:1a:db:d4:54:f4:2d:d7:84: - 76:69:75:cc:b1:a4:0b:4c:83:d5:ba:9f:f5:d0:d7: - 58:b9:ed:35:da:b5:d1:88:1e:85:db:94:b7:2b:f3: - b7:a1:85:73:dc:92:b8:bb:80:79:85:e2:7e:d6:f6: - bb:72:fe:8c:65:64:35:99:8a:d9:74:c6:86:ef:ad: - 61:cb:50:ff:1c:44:72:a0:42:c6:8f:19:60:ab:8f: - 00:3b:6f:94:ae:be:88:70:72:61:80:4d:68:4f:c6: - 54:9c:d6:a4:e3:85:a8:51:4f:76:dc:b1:5b:4b:c2: - ac:07:ec:12:4d:c8:ba:c7:b0:80:ef:57:00:75:4f: - b0:fa:c2:a1:70:4d:0d:75:c6:a9:3d:b8:1f:5b:fd: - 0c:34:84:5c:4f:10:35:62:90:7b:d5:6b:b7:78:cd: - 54:e2:13:ba:9f:81:c2:f1:84:e3:74:b3:27:46:4a: - ef:48:59:75:58:53:a9:92:e0:c8:3e:44:86:72:f0: - 67:64:1a:72:db:33:68:bb:51:a4:39:9c:30:f4:38: - 9f:c1:74:ab:57:6b:99:3b:e7:19:34:96:44:2b:f3: - 7b:58:82:b7:eb:eb:74:5a:66:8e:be:68:2b:71:85: - 01:b4:d5:0d:e0:1e:17:5f:e1:12:72:f3:71:d8:41: - 9a:4e:be:a4:2c:bb:80:48:e9:2d:74:1e:57:12:d0: - 90:c2:66:2d:1c:d1:7c:c7:e0:5d:7f:a0:a7:46:fb: - 31:a7:37:c7:19:22:4f:f6:7f:8d:b8:d4:9b:f7:b1: - fa:6f:77:68:b2:e2:a1:e4:05:e9:22:79:09:f0:59: - 21:c0:49:0e:1c:31:0e:3d:f4:1d:4e:d5:51:8f:e4: - 40:66:a6:a0:63:0c:dc:66:5b:08:d6:6c:ee:2b:08: - 7f:1e:a8:ac:10:69:8f:78:49:5e:8e:20:f1:81:c8: - b2:6a:36:4a:43:e2:0f:47:7b:8f:ba:06:52:2a:2d: - 05:c0:03:f7:11:ed:ed:c1:e8:48:9c:3f:c1:cf:2c: - 88:c8:57:de:81:e3:59:2e:db:51:6e:23:0d:7e:a8: - 75:a4:6d:cd:9e:56:7f:19:f9:43:ee:2b:3a:dd:c5: - af:e9:1a:3e:1d:dc:57:a3:dd:56:14:ed:ff:33:40: - 0f:c3:e9 + 00:b0:bd:aa:b2:7b:3a:b8:98:2b:48:36:c0:f2:c9: + 90:b1:88:39:1d:58:e3:0b:1c:b3:73:ae:8c:b1:db: + 9b:93:40:d8:4e:2a:bb:3c:65:a5:02:78:fd:1d:04: + 24:c6:8b:b6:5e:21:13:bb:cf:20:5c:d6:d2:fb:3b: + 2b:03:cc:4d:e7:e6:06:8c:2f:10:9c:d2:77:af:1c: + 1d:d3:d0:02:88:f0:17:3f:79:4c:bf:c6:95:63:05: + 04:02:1d:a2:ba:eb:e8:6a:e4:8b:80:48:b4:28:8d: + ed:46:28:79:87:e3:58:42:65:3f:20:14:c9:16:93: + 9d:14:86:b3:4e:b5:30:98:9d:83:00:a1:30:56:38: + 1d:67:f3:ff:3e:39:d9:c4:30:0a:4b:b1:6d:a1:17: + 0b:9e:a0:0b:c2:16:fd:7f:72:ba:f9:3c:00:58:87: + 8d:3c:16:a6:1e:00:ae:33:9c:aa:a2:d7:37:c7:1c: + 66:2a:c4:cf:32:9d:02:08:6b:3f:2b:c8:9c:26:3c: + 53:57:69:73:f6:83:84:cd:fc:42:ad:a9:9f:37:ef: + c2:f0:72:0a:84:52:92:f8:d8:cf:10:54:02:24:93: + a4:b1:48:1c:34:74:1e:1c:3e:61:46:93:6c:b5:5b: + a5:fc:a7:9d:4e:76:72:e6:85:b4:57:5f:c8:da:7a: + fd:71:98:ca:70:2e:92:3a:83:d9:6a:54:d6:d0:31: + ae:dc:ad:49:f4:76:f7:d4:f4:79:a6:b5:a2:5f:da: + d3:ed:f2:cf:4e:55:e1:f2:64:9e:9f:b4:a8:df:f6: + 53:21:15:b4:fe:f8:72:c4:d0:1d:b5:35:b8:ca:c7: + 65:ae:b6:24:24:a8:a6:e7:5b:d1:de:e7:c4:53:21: + 13:64:ff:89:d4:4f:79:03:6a:37:cf:d9:ef:0c:ce: + 6f:92:ae:fb:0b:d9:a8:3e:67:0f:b7:71:88:dc:ba: + a8:b1:8d:fa:fa:2e:53:54:80:c4:a2:a4:26:a5:c9: + 66:5e:75:d5:1f:99:d9:90:c2:77:89:60:13:f1:71: + e8:a2:f5:4a:62:b2:3c:8d:e1:22:75:b0:bb:29:83: + bb:69:b2:ab:08:28:0d:63:70:12:4c:ec:fe:08:e4: + d2:ca:21:48:3c:f4:3c:e6:14:e9:3e:5a:50:89:3d: + 0d:4d:93:73:7f:ff:3d:13:2c:b1:fb:81:a0:24:7a: + e7:66:43:40:47:24:e2:c5:ca:7d:8b:af:70:8d:63: + 2d:f8:f7:70:99:46:ba:48:7c:d1:08:3b:7b:78:05: + fe:bc:0c:09:ab:7d:43:ba:b1:a9:fd:62:be:2c:8c: + 9d:68:b6:43:4a:cc:40:25:3a:62:e2:52:95:e8:3d: + 6f:34:19 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE - Netscape Comment: - OpenSSL Generated Certificate X509v3 Subject Key Identifier: - 41:73:D1:5E:AA:7D:59:3C:6F:4D:43:E8:20:AE:A1:D3:9C:26:B1:C4 + 15:B2:A0:7E:13:1F:B0:88:CE:E5:E0:FF:D6:8F:8A:D1:01:B6:F2:00 X509v3 Authority Key Identifier: - keyid:4D:FC:7A:19:F3:2B:0C:7D:F6:C0:7C:4D:F8:72:34:4C:8C:35:52:74 - + 4D:FC:7A:19:F3:2B:0C:7D:F6:C0:7C:4D:F8:72:34:4C:8C:35:52:74 Signature Algorithm: sha256WithRSAEncryption - 49:7c:18:c2:1b:5b:de:5e:15:84:18:f6:6b:1c:03:d6:8e:75: - 34:f6:6c:0c:e3:64:60:65:6e:19:1d:26:3b:c8:ed:96:99:30: - 19:7e:3d:d9:c5:a1:19:8e:c6:15:c1:60:74:7e:b6:8b:78:d8: - 46:43:f7:ad:b0:96:fa:51:4e:52:c2:67:da:da:a8:70:f3:40: - c5:80:b4:cc:36:18:81:98:d2:af:94:bc:82:ba:4a:7e:e6:d6: - a3:4b:2b:6f:f6:45:b3:82:07:2b:32:68:7a:d5:fc:7d:70:75: - 7b:4e:b6:33:4c:3d:c2:46:3b:89:c8:77:d8:8d:da:20:88:1d: - 0c:76:2a:79:92:9c:91:44:44:c8:c7:5e:53:8c:d3:29:f6:e9: - 3e:26:9f:47:ac:ca:03:4a:90:ba:c7:ba:0e:31:61:fe:89:af: - 2b:eb:07:aa:7d:10:fd:f5:f0:ba:09:f0:58:1b:86:9b:d2:0b: - b8:c8:db:f4:be:6c:ba:96:dd:3c:5d:7f:ec:4b:8e:93:46:b4: - 78:d2:c7:02:c7:26:e5:d9:ba:3d:93:3f:85:ea:bc:3a:ab:54: - bf:d5:2c:6a:49:f4:d7:d4:72:cd:5d:33:d2:cf:c8:c6:98:1e: - d2:de:72:53:8c:c3:47:f7:43:aa:ca:0f:ca:0f:24:d0:7a:0f: - 43:fa:9c:cc:2a:39:2b:0f:ee:89:91:91:6b:e7:89:80:fd:bf: - 87:c2:9f:0a:7d:f5:e1:33:72:8e:02:35:d4:c6:ec:1d:e7:e0: - f2:9b:ff:c3:d0:f2:ae:52:9a:41:87:65:24:d4:2e:3d:61:fb: - ef:6d:9a:e9:b2:09:af:6b:d9:72:1a:c5:e7:45:1f:4d:bb:2a: - 9e:af:25:b8:cd:d0:fc:43:70:45:55:a0:23:4e:23:00:de:65: - dc:f6:bb:d9:a3:b3:61:28:5c:10:09:c1:ca:d5:63:4d:cb:e0: - 1b:36:e1:e6:4c:25:1f:c2:00:d2:93:1f:c4:c9:64:b0:0d:dd: - fb:dd:b4:0a:57:24:8a:d5:20:c3:d2:54:a3:c3:8e:c1:e7:c4: - fe:30:14:dc:f2:69:6c:8b:67:1f:2b:a7:90:bb:da:f7:81:0d: - 33:24:3a:21:d6:5d:7f:ed:9a:b1:99:47:8e:42:53:f4:e1:86: - da:15:c3:88:bf:e6:4e:29:48:b3:bf:2e:ac:ef:b9:04:74:2f: - 48:b7:13:ef:fa:92:a5:93:99:e1:0e:3b:86:d1:3b:f9:49:b0: - ad:b9:e4:88:e6:db:10:58:5e:b3:61:bf:5c:74:ef:a0:76:99: - 2e:0f:b8:68:01:9e:32:ae:af:cf:14:45:af:45:0a:f0:b7:f9: - 41:3b:45:52:7b:a0:44:eb + Signature Value: + 4a:4b:4b:69:2e:c9:d7:c1:ce:63:e2:76:9b:3d:09:76:98:1c: + 73:cc:38:c2:e7:be:d6:14:de:38:97:e5:ed:53:e2:60:e2:1b: + 7f:6c:68:1c:f8:90:6c:0d:fc:1e:1a:ee:b6:53:77:5f:71:66: + 9d:81:a5:ba:c2:92:c7:77:eb:a7:f1:2f:8f:b0:37:68:97:25: + 18:a7:88:6a:b0:b6:26:32:a7:dc:55:e1:e2:7e:12:03:70:c5: + 28:c3:4d:32:d7:d8:b6:21:a3:8a:34:b6:6e:2b:b4:43:31:48: + 82:1b:84:4d:28:39:1c:e2:f1:70:eb:7b:2f:1b:7b:d7:6e:2a: + eb:76:15:5c:71:0b:e6:ff:66:4c:ad:92:da:06:f7:fe:28:99: + 00:ce:3c:e9:20:c1:e2:bd:f8:2b:cb:35:3a:5a:74:01:91:a6: + 86:e4:c3:8c:5b:ab:c8:5d:f3:0f:d7:fe:0e:02:e4:70:08:f8: + 0a:15:87:26:24:62:77:5b:51:97:3c:37:71:fe:5b:2c:5d:66: + 79:78:ee:42:59:9e:03:a7:05:83:f5:89:12:fe:ce:53:f5:68: + 45:aa:7a:6d:ac:44:84:a2:42:e3:5f:8e:e5:00:23:fe:55:0f: + 2a:5f:43:8b:34:bf:29:fe:48:57:00:f0:8a:13:f9:21:e5:ec: + 2c:d0:22:48:5d:b1:7e:b7:13:e1:e1:05:9a:8c:8c:fb:76:a0: + 42:51:98:24:7e:03:46:5a:de:c7:f9:72:6a:87:02:a7:72:b9: + 6c:71:08:ff:20:e2:77:c1:5e:42:54:06:bd:d7:21:05:a6:aa: + 89:3b:a6:cc:41:27:02:88:9a:83:39:38:85:1f:f4:76:7a:cd: + 90:c4:7a:12:1e:92:6e:8a:b0:be:c4:d3:2f:5e:8d:bb:86:bc: + 31:39:d0:3d:65:6b:90:af:3d:b3:c6:69:b5:ce:55:f1:d7:e5: + a2:8b:f1:6f:51:71:f9:17:aa:ce:a2:8a:a9:9a:a5:aa:6c:22: + 72:d6:d9:7e:a8:0d:b5:c3:34:ef:1a:95:24:0b:a9:4e:bc:b1: + 60:08:b8:c7:b4:2c:79:93:49:5e:ec:df:8c:28:da:cb:c0:59: + f2:28:58:e6:54:17:b4:c1:6a:ea:a3:7b:e3:95:1e:04:a6:7e: + bf:50:2b:27:94:83:3e:42:7e:8e:c1:db:92:48:41:19:b0:82: + 96:fa:f5:67:3c:24:8b:e8:4b:a9:09:5c:61:75:55:ed:74:23: + 8d:ac:67:d8:41:44:67:41:81:2f:ec:44:18:f5:93:49:88:e1: + 31:4a:0c:a4:e0:2c:ef:f6:4c:8c:95:be:49:5c:1b:d2:f8:5b: + c6:8e:ce:08:a1:4b:be:b3 -----BEGIN CERTIFICATE----- -MIIFpjCCA46gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl +MIIFhTCCA22gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl cnQxCzAJBgNVBAYTAkZJMREwDwYDVQQIDAhIZWxzaW5raTERMA8GA1UEBwwISGVs -c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMjAwMzAzMDMwMzAzWhcNNDAwMjI4 -MDMwMzAzWjBaMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV -BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMRMwEQYDVQQDDApzZXJ2ZXIt -bmV3MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu6LWzC3/0ZEDQQrZ -6HjN92y3irA356J5w04I2vLsvbqD6Ok9VlaO07jX8rSVmTkmpbKSsAldQu5hBkWc -5sb0eu5FX7tLKR3yHUtkFsrDDFiVGtvUVPQt14R2aXXMsaQLTIPVup/10NdYue01 -2rXRiB6F25S3K/O3oYVz3JK4u4B5heJ+1va7cv6MZWQ1mYrZdMaG761hy1D/HERy -oELGjxlgq48AO2+Urr6IcHJhgE1oT8ZUnNak44WoUU923LFbS8KsB+wSTci6x7CA -71cAdU+w+sKhcE0NdcapPbgfW/0MNIRcTxA1YpB71Wu3eM1U4hO6n4HC8YTjdLMn -RkrvSFl1WFOpkuDIPkSGcvBnZBpy2zNou1GkOZww9DifwXSrV2uZO+cZNJZEK/N7 -WIK36+t0WmaOvmgrcYUBtNUN4B4XX+EScvNx2EGaTr6kLLuASOktdB5XEtCQwmYt -HNF8x+Bdf6CnRvsxpzfHGSJP9n+NuNSb97H6b3dosuKh5AXpInkJ8FkhwEkOHDEO -PfQdTtVRj+RAZqagYwzcZlsI1mzuKwh/HqisEGmPeElejiDxgciyajZKQ+IPR3uP -ugZSKi0FwAP3Ee3twehInD/BzyyIyFfegeNZLttRbiMNfqh1pG3NnlZ/GflD7is6 -3cWv6Ro+HdxXo91WFO3/M0APw+kCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB -hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE -FEFz0V6qfVk8b01D6CCuodOcJrHEMB8GA1UdIwQYMBaAFE38ehnzKwx99sB8Tfhy -NEyMNVJ0MA0GCSqGSIb3DQEBCwUAA4ICAQBJfBjCG1veXhWEGPZrHAPWjnU09mwM -42RgZW4ZHSY7yO2WmTAZfj3ZxaEZjsYVwWB0fraLeNhGQ/etsJb6UU5Swmfa2qhw -80DFgLTMNhiBmNKvlLyCukp+5tajSytv9kWzggcrMmh61fx9cHV7TrYzTD3CRjuJ -yHfYjdogiB0Mdip5kpyRRETIx15TjNMp9uk+Jp9HrMoDSpC6x7oOMWH+ia8r6weq -fRD99fC6CfBYG4ab0gu4yNv0vmy6lt08XX/sS46TRrR40scCxybl2bo9kz+F6rw6 -q1S/1SxqSfTX1HLNXTPSz8jGmB7S3nJTjMNH90Oqyg/KDyTQeg9D+pzMKjkrD+6J -kZFr54mA/b+Hwp8KffXhM3KOAjXUxuwd5+Dym//D0PKuUppBh2Uk1C49YfvvbZrp -sgmva9lyGsXnRR9NuyqeryW4zdD8Q3BFVaAjTiMA3mXc9rvZo7NhKFwQCcHK1WNN -y+AbNuHmTCUfwgDSkx/EyWSwDd373bQKVySK1SDD0lSjw47B58T+MBTc8mlsi2cf -K6eQu9r3gQ0zJDoh1l1/7ZqxmUeOQlP04YbaFcOIv+ZOKUizvy6s77kEdC9ItxPv -+pKlk5nhDjuG0Tv5SbCtueSI5tsQWF6zYb9cdO+gdpkuD7hoAZ4yrq/PFEWvRQrw -t/lBO0VSe6BE6w== +c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMjYwNDIyMTgwNjA4WhcNNDYwNDE4 +MTgwNjA4WjBnMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV +BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMSAwHgYDVQQDDBcnYHRvdWNo +IEFgJy0iYHRvdWNoIEJgIjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +ALC9qrJ7OriYK0g2wPLJkLGIOR1Y4wscs3OujLHbm5NA2E4quzxlpQJ4/R0EJMaL +tl4hE7vPIFzW0vs7KwPMTefmBowvEJzSd68cHdPQAojwFz95TL/GlWMFBAIdorrr +6Grki4BItCiN7UYoeYfjWEJlPyAUyRaTnRSGs061MJidgwChMFY4HWfz/z452cQw +CkuxbaEXC56gC8IW/X9yuvk8AFiHjTwWph4ArjOcqqLXN8ccZirEzzKdAghrPyvI +nCY8U1dpc/aDhM38Qq2pnzfvwvByCoRSkvjYzxBUAiSTpLFIHDR0Hhw+YUaTbLVb +pfynnU52cuaFtFdfyNp6/XGYynAukjqD2WpU1tAxrtytSfR299T0eaa1ol/a0+3y +z05V4fJknp+0qN/2UyEVtP74csTQHbU1uMrHZa62JCSopudb0d7nxFMhE2T/idRP +eQNqN8/Z7wzOb5Ku+wvZqD5nD7dxiNy6qLGN+vouU1SAxKKkJqXJZl511R+Z2ZDC +d4lgE/Fx6KL1SmKyPI3hInWwuymDu2myqwgoDWNwEkzs/gjk0sohSDz0POYU6T5a +UIk9DU2Tc3//PRMssfuBoCR652ZDQEck4sXKfYuvcI1jLfj3cJlGukh80Qg7e3gF +/rwMCat9Q7qxqf1iviyMnWi2Q0rMQCU6YuJSleg9bzQZAgMBAAGjTTBLMAkGA1Ud +EwQCMAAwHQYDVR0OBBYEFBWyoH4TH7CIzuXg/9aPitEBtvIAMB8GA1UdIwQYMBaA +FE38ehnzKwx99sB8TfhyNEyMNVJ0MA0GCSqGSIb3DQEBCwUAA4ICAQBKS0tpLsnX +wc5j4nabPQl2mBxzzDjC577WFN44l+XtU+Jg4ht/bGgc+JBsDfweGu62U3dfcWad +gaW6wpLHd+un8S+PsDdolyUYp4hqsLYmMqfcVeHifhIDcMUow00y19i2IaOKNLZu +K7RDMUiCG4RNKDkc4vFw63svG3vXbirrdhVccQvm/2ZMrZLaBvf+KJkAzjzpIMHi +vfgryzU6WnQBkaaG5MOMW6vIXfMP1/4OAuRwCPgKFYcmJGJ3W1GXPDdx/lssXWZ5 +eO5CWZ4DpwWD9YkS/s5T9WhFqnptrESEokLjX47lACP+VQ8qX0OLNL8p/khXAPCK +E/kh5ews0CJIXbF+txPh4QWajIz7dqBCUZgkfgNGWt7H+XJqhwKncrlscQj/IOJ3 +wV5CVAa91yEFpqqJO6bMQScCiJqDOTiFH/R2es2QxHoSHpJuirC+xNMvXo27hrwx +OdA9ZWuQrz2zxmm1zlXx1+Wii/FvUXH5F6rOooqpmqWqbCJy1tl+qA21wzTvGpUk +C6lOvLFgCLjHtCx5k0le7N+MKNrLwFnyKFjmVBe0wWrqo3vjlR4Epn6/UCsnlIM+ +Qn6OwduSSEEZsIKW+vVnPCSL6EupCVxhdVXtdCONrGfYQURnQYEv7EQY9ZNJiOEx +Sgyk4Czv9kyMlb5JXBvS+FvGjs4IoUu+sw== -----END CERTIFICATE----- diff --git a/mysql-test/std_data/server-new-key.pem b/mysql-test/std_data/server-new-key.pem index 05f0e5451d6..7b0b5d5cb14 100644 --- a/mysql-test/std_data/server-new-key.pem +++ b/mysql-test/std_data/server-new-key.pem @@ -1,51 +1,52 @@ ------BEGIN RSA PRIVATE KEY----- -MIIJKgIBAAKCAgEAu6LWzC3/0ZEDQQrZ6HjN92y3irA356J5w04I2vLsvbqD6Ok9 -VlaO07jX8rSVmTkmpbKSsAldQu5hBkWc5sb0eu5FX7tLKR3yHUtkFsrDDFiVGtvU -VPQt14R2aXXMsaQLTIPVup/10NdYue012rXRiB6F25S3K/O3oYVz3JK4u4B5heJ+ -1va7cv6MZWQ1mYrZdMaG761hy1D/HERyoELGjxlgq48AO2+Urr6IcHJhgE1oT8ZU -nNak44WoUU923LFbS8KsB+wSTci6x7CA71cAdU+w+sKhcE0NdcapPbgfW/0MNIRc -TxA1YpB71Wu3eM1U4hO6n4HC8YTjdLMnRkrvSFl1WFOpkuDIPkSGcvBnZBpy2zNo -u1GkOZww9DifwXSrV2uZO+cZNJZEK/N7WIK36+t0WmaOvmgrcYUBtNUN4B4XX+ES -cvNx2EGaTr6kLLuASOktdB5XEtCQwmYtHNF8x+Bdf6CnRvsxpzfHGSJP9n+NuNSb -97H6b3dosuKh5AXpInkJ8FkhwEkOHDEOPfQdTtVRj+RAZqagYwzcZlsI1mzuKwh/ -HqisEGmPeElejiDxgciyajZKQ+IPR3uPugZSKi0FwAP3Ee3twehInD/BzyyIyFfe -geNZLttRbiMNfqh1pG3NnlZ/GflD7is63cWv6Ro+HdxXo91WFO3/M0APw+kCAwEA -AQKCAgEAthrLZyx5rHWV9+lFJYchNrIvzA1MpKWekTtKAt1jgJvlbAX5/rJROhCa -nTZAPo4mAQi3rtvXxJ7AUar8JUoQesKHV+rZflVO5rmFsU0mUfQi+gdCIxU87H7l -wWKPwBRa1u7YXqDinMZzmTcsXlC5w+cDuOGziJenr75qfTd0zJ1a0+LHgW/C6087 -CShhkNweQmRvD2xxjjbU8SVJLlrAhJ93n+lQq16WqaXHm4KXOENoKoxtEC6NpzfP -7OI3lOcYmQWdmq618QIQrL+T0zXX/wLR2/1LW0ec+aJOHNV2sft8ffe78wvjE/7w -AGjjjv2RFT1akXYJsgdsDZXWVzVg1mfou1f0/ywmFNqtB2lKGnpte+3nre4ip7nw -lB8STjdByPhPNPb0xeMYlPmG05LY/nGJsExiTt9PHPj6+e2z0y3jZprbklsm/3od -FuzQ88kLeme2tuMDqedzTD38oaj39CnKjxoAXqQezc46LytDDpwgU/Or5Xu6UFV0 -lS0Pv0ua79zo+1to+DX0+V9vuwnXJmo7YFrGtZmpmRFG1r9Eakz0IbH9E8Pwd5FI -7oVF007ooNyAR7yC4VlK2u7V0i0ZdJGNhIvE6P0/NxKyoxNdrfhoyNA3AFtFCA42 -FNb7I6LgxPa9CR8zTjDmwe4AWcdEO2vIX/sihYsuHOZLaveNCYECggEBAOa2Vmzo -xg7BX5iS94RSN1ApFMlUibnc04hIaU7046N7kOF9FfFmc5gdXjRpNc2b7S3dmcWf -MycgBTCZeVq25zOA3NlD61BT1w/4u7dpCDuDK1zh/0xjkmHJ3KWxtOdStn0uU7Yx -pqhngHF+XnGwqhOCdC3wEHwLua7NtfoSwO2XyyRRsTomT/MhPZFNLRB2CvO6IU/F -xog4MC4aGBv1blYV2aBkXvyUzdQBxZQfcCSzAG56YvwBZ/1bORmGTHdfnirzGt8x -MRV+yp8JOUz33JRgOzkWANQxc4nZuvZD4TnZokTJaHLc7XWNZwKgiGo9XqlY9Bao -MgpRGu9GelQeBpkCggEBANAzzqqZuv1iqxo1Q4YgGWyuv7MJ60FpWMkMk6f332Jy -eGOG8TrLM45uo4Z9jNTtbjbmrKQYyA0D+++HXF7EPDNmJLH6950GtNN607hK1UA3 -1P7XW30mS6aHOckPO1Aing6Asvu1QqviwW/d5XTCiFGpU88BSh9l8A1ao+ePr+Lz -kYnuyT5yc2tBlUknv/SZ6eqbptKP2dh3cR5sn+8jRjXuXhONMjDisZH3IjMEdO5W -re1Qa/2LEnpB71g5qmb4Xj/o/uJlwQZAXXUBwEKid3Q5wa03DFFOUQmNGYrhYAl9 -4AYENQC2FESdo5dPGyOx/mBgx3B0Cg2S/ytX/P95CdECggEAaqmj/UgEwS+fna9c -pZ1JG1NS292sqvQwC9LGdQ187Mkk60rkSS2/hXUWZ464pC1RkyHfhOEcShtgqt5Z -n5nt+/64m+3trb6FMEojpyD1AGadNpz5Zfym4XTtAOHOrB+uZON1Kkd8MGFhnZb5 -3P/7MXffdJmHVYIqP2m1lz7yWSYTceAe2q55ygL1LucKTZD1cUb9PZ9HMRUhGT9R -JCPs9fm2GpQs4gN9wWVsThXWx/DF403L04xm4lg5ZtaTJaFcQ6kPJF7evXxX+vzN -tArnvOVcnADTM0cFjpbN/CrXxuIaRkkDdA817WIJXMqRJuTmjc6lUpBCSkjC9hqU -Va1oCQKCAQEAvJkRboyPTBRi9fylzAurvD2XvTERAFHTcVuJLbBllCIpV87XGfEU -JMOoMZ3tQrxJCEZwwL0KCnA/eTzeuaF8/vpZ5zd1sbJvftpWiyyOe/uXX7npUDau -dI0uFSlNC0wwbOa8OzJ40Ic5voH85oWJQp/mITAD2ulWSGKA8rPAGg+VGKNLfNvk -HZZtCrWNNp9tu21/8mEIbwPTXkH7pn4Hjbb9VSyj+JCBVb3OJvS0j2nJZ51gFW4z -MLglfX/PEjON/MqsiJyv+1+2yNTrOfE9z/S5spSY/dW5prNAHgQGINL7abfJ43kM -ZxN9KwUninAkA13ni8AxkxZDOxobPbiA4QKCAQEAwMLRfOulmo6psfMW7JhlRdZa -aAo8loLuK4S0nn4B3alUqjinVZPmgDRUu1XjtwbJ4mvbWjMxOQrYlRkp+RsxYZOy -hiTWkUgMNFLbMBuwsS4+pBiYrkcbyNAxg8TjlTIp1XMUdCsOd2JrSWG6eAekIv9e -9yOW7eOt8epnoAnCFpFBfdJvjCvWyKY/Sxk1ISskpVZoxFHk9Dc+38Rmy13hLyE0 -UyJnSX3x4Dw83cyV6/KqJWDkQlvVGoXG56gM2VZwLqvHHYDVOV/1u8k0KtZdxJFe -FANJfgYUb6c8SFYVbwc4Rjeb2nq/fnbUyUQpbZ278Xf5Oe594KBdYj9qltlGbA== ------END RSA PRIVATE KEY----- +-----BEGIN PRIVATE KEY----- +MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCwvaqyezq4mCtI +NsDyyZCxiDkdWOMLHLNzroyx25uTQNhOKrs8ZaUCeP0dBCTGi7ZeIRO7zyBc1tL7 +OysDzE3n5gaMLxCc0nevHB3T0AKI8Bc/eUy/xpVjBQQCHaK66+hq5IuASLQoje1G +KHmH41hCZT8gFMkWk50UhrNOtTCYnYMAoTBWOB1n8/8+OdnEMApLsW2hFwueoAvC +Fv1/crr5PABYh408FqYeAK4znKqi1zfHHGYqxM8ynQIIaz8ryJwmPFNXaXP2g4TN +/EKtqZ8378LwcgqEUpL42M8QVAIkk6SxSBw0dB4cPmFGk2y1W6X8p51OdnLmhbRX +X8jaev1xmMpwLpI6g9lqVNbQMa7crUn0dvfU9HmmtaJf2tPt8s9OVeHyZJ6ftKjf +9lMhFbT++HLE0B21NbjKx2WutiQkqKbnW9He58RTIRNk/4nUT3kDajfP2e8Mzm+S +rvsL2ag+Zw+3cYjcuqixjfr6LlNUgMSipCalyWZeddUfmdmQwneJYBPxceii9Upi +sjyN4SJ1sLspg7tpsqsIKA1jcBJM7P4I5NLKIUg89DzmFOk+WlCJPQ1Nk3N//z0T +LLH7gaAkeudmQ0BHJOLFyn2Lr3CNYy3493CZRrpIfNEIO3t4Bf68DAmrfUO6san9 +Yr4sjJ1otkNKzEAlOmLiUpXoPW80GQIDAQABAoICABQRmrC6QMMLNwbz01mo56Qx +Cq3kFPaDDiFu9Yzl7zbQ9dQnvVZbWFmn3AiPxY6XTgrxiJMahDCROCh3jH0u6r26 +pzhYc8jK4Uo3UBpoE+bxaZe3MgQots0lRFI/2Trjug1r4XycmiXCD+pCgveaKhXH +91tbi4XjwcITQDMKF02NEn4KJOSgFJQO5wcYJzvEFLc0RiA0713WCzUWdTcj6PU6 +CfQDgwG1X1bSzvUPWhTe3qIzqFTnlNDIy/Khcu00J1RJefvX/pHvAdp98CMAur1C +8rNoz6bngBwqSkDZY9uRZEcOdXLDU1PzsAoFMs0ubfJQJL2ZwkGeIbSLgibE28L5 +5b1V1QpzPaMHeXvHwkfSAMJKi4DJjmcf3psbDi3YeOZlsmGbpMPY/PyC6qkz7IFu +e54o/8G2/chY6m3GgqxnHH6QAqdjwTC/2awM2FRrbfawP6TSwFDYSGb/wZLhsnU4 +plLms2OIt5Dy5vKvPsTXzbF9fHEqMhKgDDliOBfbI6oUldItMQ7VUF05G6/Z2sos +tKg6Ih4qZpTAHKyYfshsQnJoZ8N+kdsEzN6P4WWD2ccWBZZqKf15ZS5/1wvKOgoi +CAouSEKSgoCobQkbjI5mu6dwox0hCbd+8lF+brQLgJw1A3ZFsoDdGJzEhDZI+zWM +mrATaRqeRhcri4Bhmas9AoIBAQD2IAo2C+WJd01CQLLTvQiN5Kk5C3wezSLIzTMe +Lzj5qeeM7YXOC8PLgNdQyBcItDUXJok80TAlUcexsM2x8GoicyyEfzFttdlQfFra +eDhbjwa22ytG14qrDY3/9nPgsxY7AglymOgqdNqGfLvnYElJpoTlaWiKOOagpyGI +59//9doyU0iOYqpP8XoTaNPHM//592oG8JDrf+sK4nszjQhz9TWOsop7ErJPSGZI +y8DncNQGGF3yRIqyJ4ee/s1g5f8X7nJBxwB3gZwWGWpjI0ez9JXPXAWGeTl9P035 +0UIox6akg65KCJUkDER4MaBXMamRikOq1972O+iB4QVoNz6zAoIBAQC31PqHUkYP +soWosbrYjw4fz747zxVWi2jjW9rop7/DoIbcSMPCWmnG7uZOchJSQCpurBvcBndq +Y7WZ9ngbc/4SclPoYNwn/Y5imIikXKmv4PhTDQZ3R5d99qHGkBcb39TH1hpwJvRL +wLM/aNwxjEMqdmy2Ppk/S6qyMAqqI0hSd8fettRKcVdidxUtH6yQKCM86TZ/tF9q +r0D7UGE64RYWY36rYIBhWXV0Kr+Yvp8nMXshQtPdfFmINU0AHxjY5Hg+lPQzejub +rAZjjFCdE0M1iOqPWCMYJGsubf4pNeVhwyDQxGHotBeoVEf2UJgAZGDJyBVha9QH +4WP3TeF/zKgDAoIBAQCVp0uuKzOpj1H5y+8wUgumg3flyLby35ab9DF11A7Xt9ik +VzR54atuzOufIdrnnvN9HSBrS2Lz/jLnN3MLE/zk75UNB23doKn/h22S03CpM2FI +xCEfVSXq9jX2gjtZUGte+9EUzia00hKhnax/dot5bff2qk43ZXvOCXGZliwcrbe7 +y+odMZ8PNuwcaywCPvsRWcAtcg8cMs6O8sEoykNuhpXHK4aKaQbksEgJUWL9FxzE +jAJrsgOHagPLyHDGz3J5cbIljsQY5kUrJs8KcsRBhqGk0PZHGuS65Egcc4G/3A3W +kH7kYy2UGqVzU/GDsx3A8gpNEi9vF2Q7vMAV6ymDAoIBADpsOWKgRxveBJRkR5lj +fX2mrDKd0Y47qA35t0yRY2Rss+92QKCX014htpffsOrq8ZFSqVf3xiPNpH1V0z4G +UwzRwNDtV4puDr5O874opNT8jm72iMOHwSGLLEbKrE1ziVApPyW9e45Ho6/XR4OH +rCDmmg4hPtra1Vjj47/GjsmGv8KMIFO4SalFZzl8A3+dAfXtuCBF1r01DVXRadUo +i7h5zlvww1ws7iMJIvMMQdBW7WbYsjSFvH6JUftj5qWnln9tH17szdzfgvhIM6Z3 +5Lgy1zjPLfgSOu36jvfR5SB4vwkaIHOwKISapHQnkOcu/4OhTwozFqOaggaqfav8 +ArkCggEBAM+Rx6FPe+QR9wRWFrrpum9VAJcE0+XrHGgCFl3QXjlAfMRIsCzH0jNC +ll54kFUZI9ircEvXfJd5sd8EBITwsV6aFzV1UIIX/Wp1qzdR7u/AzmvG/8R7hCD6 +SiZCgK5nye5x9eM7oC71InyYYtqXErQMUUvCKBx8F14i0pqbQk6s6cjnZqAXHaoa +vC8Vu7ODqy5CnezrBatcOXdCpqLhStZPgSHlmYWGUZKZPtxPiAIU5lB2iq1YDLsh +rTAv/V8tfYxjm02psk+0SE5+FTgiITO3n8ZQOQ7/clA4asztwUbenyGv+qX+RAlp +GRuROj++HIUxkCf8fgVsxrWSmMDc8oc= +-----END PRIVATE KEY----- diff --git a/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result b/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result index f3a140c5dce..9b96a21f6d0 100644 --- a/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result +++ b/mysql-test/suite/galera/r/galera_sst_mariabackup_encrypt_with_key_server.result @@ -3,4 +3,24 @@ connection node_1; SELECT 1; 1 1 -include/assert_grep.inc [Using openssl based encryption with socat] +FOUND 1 /Using openssl based encryption with socat: with key and crt/ in mysqld.1.err +# +# MDEV-39413 wsrep unsafe handling of parameters +# +call mtr.add_suppression('Invalid value for WSREP_SST_OPT_REMOTE_USER'); +call mtr.add_suppression('Failed to read from: wsrep_sst_mariabackup'); +call mtr.add_suppression('Process completed with error: wsrep_sst_mariabackup'); +call mtr.add_suppression('Command did not run: wsrep_sst_mariabackup'); +call mtr.add_suppression('State transfer to .* failed'); +call mtr.add_suppression('Will never receive state. Need to abort'); +call mtr.add_suppression('Error while getting data from donor node'); +call mtr.add_suppression('Cleanup after exit with status'); +call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal'); +connection node_2; +# force SST again +# using a cert with shell-unsafe CN +# start the server +# the server failed to start +FOUND 1 /Invalid value for WSREP_SST_OPT_REMOTE_USER/ in mysqld.1.err +# cleanup +# restart diff --git a/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test b/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test index 5673dda30cb..238158a2dc0 100644 --- a/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test +++ b/mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.test @@ -1,11 +1,10 @@ # -# This test checks that if SST SSL is not explicitly donfigured mariabackup SST +# This test checks that if SST SSL is not explicitly configured mariabackup SST # uses server SSL configuration if present. # Initial SST happens via mariabackup, so there is not much to do in the body # of the test # ---source include/big_test.inc --source include/galera_cluster.inc --source include/have_innodb.inc --source include/have_mariabackup.inc @@ -17,9 +16,46 @@ SELECT 1; --source include/wait_condition.inc # Confirm that transfer was SSL-encrypted ---let $assert_text = Using openssl based encryption with socat ---let $assert_select = Using openssl based encryption with socat: with key and crt ---let $assert_count = 1 ---let $assert_file = $MYSQLTEST_VARDIR/log/mysqld.1.err ---let $assert_only_after = CURRENT_TEST ---source include/assert_grep.inc +--let SEARCH_FILE = $MYSQLTEST_VARDIR/log/mysqld.1.err +--let SEARCH_PATTERN = Using openssl based encryption with socat: with key and crt +--source include/search_pattern_in_file.inc + +--echo # +--echo # MDEV-39413 wsrep unsafe handling of parameters +--echo # + +call mtr.add_suppression('Invalid value for WSREP_SST_OPT_REMOTE_USER'); +call mtr.add_suppression('Failed to read from: wsrep_sst_mariabackup'); +call mtr.add_suppression('Process completed with error: wsrep_sst_mariabackup'); +call mtr.add_suppression('Command did not run: wsrep_sst_mariabackup'); +call mtr.add_suppression('State transfer to .* failed'); +call mtr.add_suppression('Will never receive state. Need to abort'); +call mtr.add_suppression('Error while getting data from donor node'); +call mtr.add_suppression('Cleanup after exit with status'); +call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal'); + +--connection node_2 +--source include/shutdown_mysqld.inc + +--echo # force SST again +--remove_file $MYSQLTEST_VARDIR/mysqld.2/data/grastate.dat +--echo # using a cert with shell-unsafe CN +--exec echo '[mysqld.2]' >> $MYSQLTEST_VARDIR/my.cnf +--exec echo ssl-cert=$MYSQL_TEST_DIR/std_data/server-new-cert.pem >> $MYSQLTEST_VARDIR/my.cnf +--exec echo ssl-key=$MYSQL_TEST_DIR/std_data/server-new-key.pem >> $MYSQLTEST_VARDIR/my.cnf + +--echo # start the server +--error 0 +--exec $MYSQLD_LAST_CMD +--echo # the server failed to start + +--let SEARCH_PATTERN = Invalid value for WSREP_SST_OPT_REMOTE_USER +--source include/search_pattern_in_file.inc + +--echo # cleanup +# we have to kill joiner's socat here, because the donor has aborted SST +# and joiner's socat will timeout in 5 minutes +--exec pkill -f 'socat.*server-new-cert' +--exec echo ssl-cert=$MYSQL_TEST_DIR/std_data/server-cert.pem >> $MYSQLTEST_VARDIR/my.cnf +--exec echo ssl-key=$MYSQL_TEST_DIR/std_data/server-key.pem >> $MYSQLTEST_VARDIR/my.cnf +--source $MYSQL_TEST_DIR/include/start_mysqld.inc diff --git a/scripts/wsrep_sst_common.sh b/scripts/wsrep_sst_common.sh index f23707c497a..0e05f8d621e 100644 --- a/scripts/wsrep_sst_common.sh +++ b/scripts/wsrep_sst_common.sh @@ -29,6 +29,15 @@ if [ "$OS" != 'Darwin' ]; then export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}/usr/local/lib:/lib:/usr/lib:/opt/lib" fi +safe() +{ + if [[ "${!1}" = *[\ \'\`]* ]]; then + wsrep_log_error "Invalid value for $1: ${!1}" + exit 21 + fi + echo "${!1}" +} + commandex() { if [ -n "$BASH_VERSION" ]; then diff --git a/scripts/wsrep_sst_mariabackup.sh b/scripts/wsrep_sst_mariabackup.sh index d6de8fc1127..1ced7087f70 100644 --- a/scripts/wsrep_sst_mariabackup.sh +++ b/scripts/wsrep_sst_mariabackup.sh @@ -279,7 +279,7 @@ get_transfer() wsrep_log_info "Using traditional netcat as streamer" tcmd="$tcmd -q0" fi - tcmd="$tcmd $WSREP_SST_OPT_HOST_UNESCAPED $SST_PORT" + tcmd="$tcmd $(safe WSREP_SST_OPT_HOST_UNESCAPED) $SST_PORT" fi else tfmt='socat' @@ -404,14 +404,14 @@ get_transfer() # CA verification verify_ca_matches_cert "$tpem" "$tcert" "$tcap" if [ -n "$WSREP_SST_OPT_REMOTE_USER" ]; then - CN_option=",commonname='$WSREP_SST_OPT_REMOTE_USER'" + CN_option=",commonname='$(safe WSREP_SST_OPT_REMOTE_USER)'" elif [ "$WSREP_SST_OPT_ROLE" = 'joiner' -o $encrypt -eq 4 ] then CN_option=",commonname=''" elif is_local_ip "$WSREP_SST_OPT_HOST_UNESCAPED"; then CN_option=',commonname=localhost' else - CN_option=",commonname='$WSREP_SST_OPT_HOST_UNESCAPED'" + CN_option=",commonname='$(safe WSREP_SST_OPT_HOST_UNESCAPED)'" fi tcmd="$tcmd,cert='$tpem',key='$tkey'" if [ -n "$tcert" ]; then @@ -757,11 +757,11 @@ cleanup_at_exit() setup_ports() { - SST_PORT="$WSREP_SST_OPT_PORT" + SST_PORT="$(safe WSREP_SST_OPT_PORT)" if [ "$WSREP_SST_OPT_ROLE" = 'donor' ]; then - REMOTEIP="$WSREP_SST_OPT_HOST" - lsn="$WSREP_SST_OPT_LSN" - sst_ver="$WSREP_SST_OPT_SST_VER" + REMOTEIP="$(safe WSREP_SST_OPT_HOST)" + lsn="$(safe WSREP_SST_OPT_LSN)" + sst_ver="$(safe WSREP_SST_OPT_SST_VER)" fi }