Galera MTR: disable SSL by default for SST, guard tests missing stunnel

Set ssl-mode=DISABLED in [sst] across all top-level galera/galera_3nodes
topology .cnf files, so tests no longer implicitly require stunnel via
inherited ssl-ca/ssl-cert/ssl-key. Also add the missing have_stunnel.inc
skip guard to galera_ist_rsync_verify_ca and galera_sst_cn_injection's
rsync combination, which intentionally test SSL SST but were not
skipped when stunnel is absent.

mysql-test/suite/galera/galera_2nodes.cnf

@@ -34,6 +34,8 @@ wsrep_node_incoming_address=127.0.0.1:@mysqld.2.port
 wsrep_sst_receive_address='127.0.0.1:@mysqld.2.#sst_port'
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_2nodes_as_master.cnf

@@ -48,6 +48,8 @@ wsrep-on=OFF
 server-id=3
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_2nodes_as_replica_2primary.cnf

@@ -54,6 +54,8 @@ gtid_domain_id=4
 
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_2nodes_as_slave.cnf

@@ -47,6 +47,8 @@ wsrep-on=OFF
 server-id=3
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_2x2nodes.cnf

@@ -61,6 +61,8 @@ wsrep_node_incoming_address=127.0.0.1:@mysqld.4.port
 wsrep_sst_receive_address='127.0.0.1:@mysqld.4.#sst_port'
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_3nodes_as_slave.cnf

@@ -60,6 +60,8 @@ wsrep-on=OFF
 server-id=4
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/galera_4nodes.cnf

@@ -61,6 +61,8 @@ wsrep_sst_receive_address='127.0.0.1:@mysqld.4.#sst_port'
 auto-increment-offset=4
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera/suite.pm

@@ -79,6 +79,10 @@ sub skip_combinations {
             unless which("lsof") || which("sockstat") || which("ss");
   $skip{'include/have_stunnel.inc'} = "Need 'stunnel' utility"
             unless which("stunnel");
+  # 'mariabackup' combination doesn't need stunnel: only 'rsync' SST goes
+  # through it.
+  $skip{'t/galera_sst_cn_injection.combinations'} = [ 'rsync' ]
+            unless which("stunnel");
   $skip{'include/have_qpress.inc'} = "Need 'qpress' utility"
             unless which("qpress");
   $skip{'../encryption/include/have_file_key_management_plugin.combinations'} = [ 'ctr' ]

mysql-test/suite/galera/t/galera_ist_rsync_verify_ca.test

@@ -1,6 +1,7 @@
 --source include/big_test.inc
 --source include/galera_cluster.inc
 --source include/have_innodb.inc
+--source include/have_stunnel.inc
 
 --let $node_1=node_1
 --let $node_2=node_2

mysql-test/suite/galera_3nodes/galera_2x3nodes.cnf

@@ -85,6 +85,8 @@ wsrep_node_incoming_address=127.0.0.1:@mysqld.6.port
 wsrep_sst_receive_address='127.0.0.1:@mysqld.6.#sst_port'
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 
 [ENV]

mysql-test/suite/galera_3nodes/galera_3nodes.cnf

@@ -50,6 +50,8 @@ wsrep_sst_receive_address='127.0.0.1:@mysqld.3.#sst_port'
 wsrep_node_name=node3
 
 [sst]
+# SSL mode is disabled for SST unless tests specifically enable it.
+ssl-mode=DISABLED
 sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
 transferfmt=@ENV.MTR_GALERA_TFMT