MDEV-19168: Add ssl-flush command. (#1749)

* MDEV-19168: Add ssl-flush command.
Improve flush error messages and move error printing into the `flush` function.

client/mysqladmin.cc

@@ -109,7 +109,7 @@ enum commands {
   ADMIN_FLUSH_TABLE_STATISTICS, ADMIN_FLUSH_INDEX_STATISTICS,
   ADMIN_FLUSH_USER_STATISTICS, ADMIN_FLUSH_CLIENT_STATISTICS,
   ADMIN_FLUSH_USER_RESOURCES,
-  ADMIN_FLUSH_ALL_STATUS, ADMIN_FLUSH_ALL_STATISTICS
+  ADMIN_FLUSH_ALL_STATUS, ADMIN_FLUSH_ALL_STATISTICS, ADMIN_FLUSH_SSL
 };
 static const char *command_names[]= {
   "create",               "drop",                "shutdown",
@@ -124,7 +124,7 @@ static const char *command_names[]= {
   "flush-error-log", "flush-general-log", "flush-relay-log", "flush-slow-log",
   "flush-table-statistics", "flush-index-statistics",
   "flush-user-statistics", "flush-client-statistics", "flush-user-resources",
-  "flush-all-status", "flush-all-statistics",
+  "flush-all-status", "flush-all-statistics", "flush-ssl",
   NullS
 };
 
@@ -623,7 +623,14 @@ int flush(MYSQL *mysql, const char *what)
   char buf[FN_REFLEN];
   my_snprintf(buf, sizeof(buf), "flush %s%s",
               (opt_local && !sql_log_bin_off ? "local " : ""), what);
-  return mysql_query(mysql, buf);
+
+  if (mysql_query(mysql, buf))
+  {
+    my_printf_error(0, "flush %s failed; error: '%s'", error_flags, what,
+                    mysql_error(mysql));
+    return -1;
+  }
+  return 0;
 }
 
 
@@ -739,11 +746,7 @@ static int execute_commands(MYSQL *mysql,int argc, char **argv)
     case ADMIN_FLUSH_PRIVILEGES:
     case ADMIN_RELOAD:
       if (flush(mysql, "privileges"))
-      {
-	my_printf_error(0, "reload failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     case ADMIN_REFRESH:
       if (mysql_refresh(mysql,
@@ -943,173 +946,111 @@ static int execute_commands(MYSQL *mysql,int argc, char **argv)
     case ADMIN_FLUSH_LOGS:
     {
       if (flush(mysql, "logs"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_BINARY_LOG:
     {
       if (flush(mysql, "binary logs"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_ENGINE_LOG:
     {
       if (flush(mysql, "engine logs"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_ERROR_LOG:
     {
       if (flush(mysql, "error logs"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_GENERAL_LOG:
     {
       if (flush(mysql, "general logs"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_RELAY_LOG:
     {
       if (flush(mysql, "relay logs"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_SLOW_LOG:
     {
       if (flush(mysql, "slow logs"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_HOSTS:
     {
       if (flush(mysql, "hosts"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_TABLES:
     {
       if (flush(mysql, "tables"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_STATUS:
     {
       if (flush(mysql, "status"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_TABLE_STATISTICS:
     {
       if (flush(mysql, "table_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_INDEX_STATISTICS:
     {
       if (flush(mysql, "index_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
+      break;
+    }
+    case ADMIN_FLUSH_SSL:
+    {
+      if (flush(mysql, "ssl"))
+	return -1;
       break;
     }
     case ADMIN_FLUSH_USER_STATISTICS:
     {
       if (flush(mysql, "user_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_USER_RESOURCES:
     {
       if (flush(mysql, "user_resources"))
-      {
-        my_printf_error(0, "flush failed; error: '%s'", error_flags,
-                        mysql_error(mysql));
         return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_CLIENT_STATISTICS:
     {
       if (flush(mysql, "client_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_ALL_STATISTICS:
     {
       if (flush(mysql, "table_statistics,index_statistics,"
                        "user_statistics,client_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_FLUSH_ALL_STATUS:
     {
       if (flush(mysql, "status,table_statistics,index_statistics,"
                        "user_statistics,client_statistics"))
-      {
-	my_printf_error(0, "flush failed; error: '%s'", error_flags,
-			mysql_error(mysql));
 	return -1;
-      }
       break;
     }
     case ADMIN_OLD_PASSWORD:
@@ -1418,6 +1359,7 @@ static void usage(void)
   flush-general-log       Flush general log\n\
   flush-relay-log         Flush relay log\n\
   flush-slow-log          Flush slow query log\n\
+  flush-ssl               Flush SSL certificates\n\
   flush-status            Clear status variables\n\
   flush-table-statistics  Clear table statistics\n\
   flush-tables            Flush all tables\n\

mysql-test/main/mysqladmin.result

@@ -17,3 +17,14 @@ mysqld is alive
 # Creating an empty file 'cnf_file'
 # Using --defaults-extra-file option with 'cnf_file'.
 mysqld is alive
+# Kill the server
+# restart: --ssl-key=MYSQLTEST_VARDIR/tmp/ssl_key.pem --ssl-cert=MYSQLTEST_VARDIR/tmp/ssl_cert.pem
+connect  ssl_con,localhost,root,,,,,SSL;
+SELECT VARIABLE_VALUE INTO @ssl_not_after FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after';
+# Use a different certificate ("Not after" certificate field changed)
+# Check new certificate used by new connection
+Result
+OK
+# Cleanup
+# Kill the server
+# restart

mysql-test/main/mysqladmin.test

@@ -51,3 +51,50 @@ EOF
 #
 --error 1
 --exec $MYSQLADMIN -u root -p 2>&1 > /dev/null
+
+#
+# MDEV-19168 Reload SSL certificate
+# This test reloads server SSL certs ./mysqladmin flush-ssl, and checks that new SSL
+# connection use new certificate.
+# SWtatus variable Ssl_server_not_after is used to tell the old certificate from new.
+#
+
+source include/have_ssl_communication.inc;
+
+# Restart server with cert. files located in temp directory
+# We are going to remove / replace them within the test,
+# so we can't use the ones in std_data directly.
+
+let $ssl_cert=$MYSQLTEST_VARDIR/tmp/ssl_cert.pem;
+let $ssl_key=$MYSQLTEST_VARDIR/tmp/ssl_key.pem;
+
+copy_file $MYSQL_TEST_DIR/std_data/server-key.pem $ssl_key;
+copy_file $MYSQL_TEST_DIR/std_data/server-cert.pem $ssl_cert;
+
+let $restart_parameters=--ssl-key=$ssl_key --ssl-cert=$ssl_cert;
+--source include/kill_mysqld.inc
+--source include/start_mysqld.inc
+
+connect  ssl_con,localhost,root,,,,,SSL;
+SELECT VARIABLE_VALUE INTO @ssl_not_after FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after';
+let $ssl_not_after=`SELECT @ssl_not_after`;
+
+remove_file $ssl_cert;
+remove_file $ssl_key;
+
+--echo # Use a different certificate ("Not after" certificate field changed)
+copy_file $MYSQL_TEST_DIR/std_data/server-new-key.pem $ssl_key;
+copy_file $MYSQL_TEST_DIR/std_data/server-new-cert.pem $ssl_cert;
+
+--exec $MYSQLADMIN --default-character-set=latin1 -S $MASTER_MYSOCK -P $MASTER_MYPORT  -u root --password= flush-ssl 2>&1
+
+--echo # Check new certificate used by new connection
+exec $MYSQL --ssl  -e  "SELECT IF(VARIABLE_VALUE <> '$ssl_not_after', 'OK', 'FAIL') as Result FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_server_not_after'";
+
+--echo # Cleanup
+remove_file $ssl_cert;
+remove_file $ssl_key;
+# restart with usuall SSL
+let $restart_parameters=;
+--source include/kill_mysqld.inc
+--source include/start_mysqld.inc