1
0
mirror of https://github.com/MariaDB/server.git synced 2025-07-24 19:42:23 +03:00
Commit Graph

756 Commits

Author SHA1 Message Date
72b6d01848 MDEV-10246 ssl-* config file options have no effect without mysql_ssl_set()
Partially revert 4ef7497996
that caused regression.

Any ssl- option must imply use_ssl=1, even if mysql_set_ssl() was not
used.
2018-06-05 22:13:19 +01:00
1d58d184c2 protocol: verify that number of rows is correct 2018-05-04 14:40:19 +02:00
fab383aac0 Use after free in authentication 2018-05-01 00:30:17 +02:00
a52c46e069 Bug#25471090: MYSQL USE AFTER FREE
a better fix
2018-04-30 15:49:19 +02:00
5cfe52314e Bug#25471090: MYSQL USE AFTER FREE
fix another similar line

followup for 7828ba0df4
2018-04-27 11:32:19 +02:00
7828ba0df4 Bug#25471090: MYSQL USE AFTER FREE
in a specially crafted invalid packet, one can get end_pos < pos here
2018-04-19 22:49:19 +02:00
f5369faf5b don't disable SSL when connecting via libmysqld 2018-04-03 16:19:10 +02:00
d76f5774fe MDEV-13459 Warnings, when compiling with gcc-7.x
mostly caused by -Wimplicit-fallthrough
2017-10-17 07:37:39 +02:00
c6ee3fe9d4 respect client's desire to force ssl even when WITH_SSL=NO
of course, this combination can never succeed,
we must fail to connect here.
2017-04-20 16:36:23 +02:00
eef2101489 MDEV-11933 Wrong usage of linked list in mysql_prune_stmt_list
mysql_prune_stmt_list() was walking the list following
element->next pointers, but inside the loop it was invoking
list_add(element) that modified element->next. So, mysql_prune_stmt_list()
failed to visit and reset all elements, and some of them were left
with pointers to invalid MYSQL.
2017-02-27 12:35:10 +01:00
ae29ea2d86 Merge branch 'mysql/5.5' into 5.5 2016-06-14 13:55:28 +02:00
c7e68606c0 Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BE
FOUND

Description:- Failure during the validation of CA
certificate path which is provided as an option for 'ssl-ca'
returns two different errors for YaSSL and OPENSSL.

Analysis:- 'ssl-ca', option used for specifying the ssl ca
certificate path. Failing to validate this certificate with
OPENSSL returns an error, "ERROR 2026 (HY000): SSL
connection error: SSL_CTX_set_default_verify_paths failed".
While YASSL returns "ERROR 2026 (HY000): SSL connection
error: ASN: bad other signature confirmation". Error
returned by the OPENSSL is correct since
"SSL_CTX_load_verify_locations()" returns 0 (in case of
OPENSSL) for the failure and sets error as
"SSL_INITERR_BAD_PATHS". In case of YASSL,
"SSL_CTX_load_verify_locations()" returns an error number
which is less than or equal to 0 in case of error. Error
numbers for YASSL is mentioned in the file,
'extra/yassl/include/openssl/ssl.h'(line no : 292). Also
'ssl-ca' does not accept tilde home directory path
substitution.

Fix:- The condition which checks for the error in the
"SSL_CTX_load_verify_locations()" is changed in order to
accommodate YASSL as well. A logic is written in
"mysql_ssl_set()" in order accept the tilde home directory
path substitution for all ssl options.
2016-03-01 10:17:25 +05:30
f3444df415 Merge branch 'mysql/5.5' into 5.5
reverted about half of commits as either not applicable or
outright wrong
2016-02-09 11:27:40 +01:00
8cf1f50967 MDEV-9112: Non-blocking client API missing on non-x86 platforms
The check for UCONTEXT in cmake was somehow become broken, disabling the
fallback to ucontext. This caused the non-blocking client API to not be
available for non-x86 platforms, on which no hand-crafted assembler
implementation of my_context is available.
2016-02-01 16:12:00 +01:00
13380bf81f Bug #22295186: CERTIFICATE VALIDATION BUG IN MYSQL MAY ALLOW MITM 2016-01-11 07:09:13 +05:30
f0d774d484 MDEV-9212 ssl-validate-cert incorrect hostname check
Reimplement ssl_verify_server_cert() using the logic
from https://wiki.openssl.org/index.php/Hostname_validation

The bug was discovered by Alex Gaynor.
2015-12-08 09:46:52 +01:00
4ef7497996 MDEV-7937: Enforce SSL when --ssl client option is used
Using --ssl-verify-server-cert and --ssl[-*] implies that
the ssl connection is required. The mysql client will now print an error if ssl
is required, but the server can not handle a ssl connection.
2015-06-09 16:08:14 +03:00
18215dd9fa MDEV-7859 SSL hostname verification fails for long subject names
Don't use a fixed buffer for X509_NAME_oneline() in the client.
Do as the server does - allocate it dynamically.

For a test - regenerate certificates to have the server cert with
a long subject.
2015-04-27 15:42:12 +02:00
8e80f91fa3 Merge remote-tracking branch 'mysql/5.5' into bb-5.5-merge @ mysql-5.5.42 2015-02-11 23:50:40 +01:00
8bc712e481 MDEV-6671 mysql_server_end breaks OpenSSL 2015-01-19 17:31:59 +01:00
a9b61b0029 Bug#17599258:- ERROR 1160 (08S01): GOT AN ERROR WRITING
COMMUNICATION PACKETS; FEDERATED TABLE

Description:- Execution of FLUSH TABLES on a federated
table which has been idle for wait_timeout (on the remote
server) + tcp_keepalive_time, fails with an error,
"ERROR 1160 (08S01): Got an error writing communication
packets."

Analysis:- During FLUSH TABLE execution the federated
table is closed which will inturn close the federated
connection. While closing the connection, federated server
tries to communincate with the remote server. Since the
connection was idle for wait_timeout(on the remote server)+
tcp_keepalive_time, the socket gets closed. So this
communication fails because of broken pipe and the error is
thrown. But federated connections are expected to reconnect
silently. And also it cannot reconnect because the 
"auto_reconnect" variable is set to 0 in "mysql_close()".

Fix:- Before closing the federated connection, in
"ha_federated_close()", a check is added which will verify
wheather the connection is alive or not. If the connection
is not alive, then "mysql->net.error" is set to 2 which
will indicate that the connetion is broken. Also the
setting of "auto_reconnect" variable to 0 is delayed and is
done after "COM_QUIT" command.
      
NOTE:- For reproducing this issue, "tcp_keepalive_time" has
to be set to a smaller value. This value is set in the
"/proc/sys/net/ipv4/tcp_keepalive_time" file in Unix
systems. So we need root permission for changing it, which
can't be done through mtr test. So submitting the patch
without mtr test.
2014-11-10 16:21:59 +05:30
1ddfce4840 mysql-5.5.40 2014-10-06 19:53:55 +02:00
229cb8ec88 Bug #18384260: MULTIPLE SECURITY ISSUES IN CERTIFICATE VALIDATION
the 5.5 version of the fix.
Added a call to X509_verify_cert_error_string() into the client certificate
verification code.
2014-07-31 12:52:49 +03:00
10956689cb Bug #18384260: MULTIPLE SECURITY ISSUES IN CERTIFICATE VALIDATION
the 5.5 version of the fix.
Added a call to X509_verify_cert_error_string() into the client certificate
verification code.
2014-07-31 12:52:49 +03:00
5d16592d44 mysql-5.5.38 merge 2014-06-03 09:55:08 +02:00
22e9aa1c1a Bug #18053212 MYSQL_GET_SERVER_VERSION() CALL WITHOUT A VALID CONNECTION RESULTS IN SEG FAULT
When there is no connection mysql_get_server_version() will return 0
and report CR_COMMANDS_OUT_OF_SYNC error.
2014-04-17 16:33:55 +03:00
9688cbc250 Bug #18053212 MYSQL_GET_SERVER_VERSION() CALL WITHOUT A VALID CONNECTION RESULTS IN SEG FAULT
When there is no connection mysql_get_server_version() will return 0
and report CR_COMMANDS_OUT_OF_SYNC error.
2014-04-17 16:33:55 +03:00
37d240ecf9 MySQL-5.5.35 merge 2014-01-22 15:29:36 +01:00
ee15c1fd5f Bug #17297012 MEMORY LEAK IN MYSQL_OPTIONS WHILE CALLING WITH OPTION MYSQL_SET_CLIENT_IP
Memory Leak in mysql_options() was caused by missing call
to my_free() in MYSQL_SET_CLIENT_IP branch. Fixed by adding
my_free() to cleanup mysql->options.client_ip value before
assigning new value.
2013-08-30 20:22:09 +03:00
730fb2881f Bug #17297012 MEMORY LEAK IN MYSQL_OPTIONS WHILE CALLING WITH OPTION MYSQL_SET_CLIENT_IP
Memory Leak in mysql_options() was caused by missing call
to my_free() in MYSQL_SET_CLIENT_IP branch. Fixed by adding
my_free() to cleanup mysql->options.client_ip value before
assigning new value.
2013-08-30 20:22:09 +03:00
005c7e5421 mysql-5.5.32 merge 2013-07-16 19:09:54 +02:00
43a6831fe0 MDEV-4574 Missing connection option MYSQL_ENABLE_CLEARTEXT_PLUGIN
recognize the constant, to be compatible with MySQL clients.
2013-06-11 11:11:05 +02:00
5730786041 Fixed some cache variables that could be set to higher value than what the code supported (size_t)
Fixed some cases that didn't work with > 4G buffers.
Fixed compiler warnings


include/mysql_com.h:
  Avoid compiler warning with strncmp()
sql-common/client.c:
  Fixed long comment; Added ()
sql/filesort.cc:
  Fix code to get filesort to work with big buffers
sql/sys_vars.cc:
  Fixed some cache variables that could be set to higher value than the size_t
  Limit query cache to ULONG_MAX as the query cache buffer variables are ulong
storage/federatedx/ha_federatedx.cc:
  Remove not used variable
storage/maria/ha_maria.cc:
  Fix that bulk_insert() works with big buffers
storage/maria/ma_write.c:
  Fix that bulk_insert() works with big buffers
storage/myisam/ha_myisam.cc:
  Fix that bulk_insert() works with big buffers
storage/myisam/mi_write.c:
  Fix that bulk_insert() works with big buffers
storage/sphinx/snippets_udf.cc:
  Fixed compiler warnings
2013-06-06 15:14:23 +03:00
4297893ccc Bug #16680313: CLIENT DOESN'T READ PLUGIN-DIR FROM MY.CNF SET BY
MYSQL_READ_DEFAULT_FILE
Parsing of the plugin-dir config file option was not working due to a typo.
Fixed the typo. No test case can be added due to lack of support for 
defaults-exitra-file testing in mysql-test-run.pl.
Thanks to Sinisa for contributing the fix.
2013-04-24 17:21:42 +03:00
4814d82d08 Bug #16680313: CLIENT DOESN'T READ PLUGIN-DIR FROM MY.CNF SET BY
MYSQL_READ_DEFAULT_FILE
Parsing of the plugin-dir config file option was not working due to a typo.
Fixed the typo. No test case can be added due to lack of support for 
defaults-exitra-file testing in mysql-test-run.pl.
Thanks to Sinisa for contributing the fix.
2013-04-24 17:21:42 +03:00
07315d3603 strmake_buf(X,Y) helper, equivalent to strmake(X,Y,sizeof(X)-1)
with a bit of lame protection against abuse.
2013-04-17 19:42:34 +02:00
ce926c90ac 5.3 merge 2013-04-12 01:01:18 +02:00
ea4a417a8d 5.2 merge 2013-04-11 19:35:39 +02:00
61ed0ebe73 5.1 merge 2013-04-11 19:30:59 +02:00
87a452f6d5 MDEV-4088 Replication 10.0 -> 5.5 fails
update 5.1 to replicate from 10.0 and
to show the server version (as of 10.0) correctly

sql-common/client.c:
  mdev:4088
sql/slave.cc:
  use the version number, not just the first character of the version string
  (we want 10 > 4 not "10" < "4").
2013-04-04 11:35:10 +02:00
102a7a2a76 MDEV-4307 Support at least 48 utf8 characters in username in server and PAM
Extend plugin auth api to support up to 512 bytes in the user names.
Use the API versioning to support old auth plugins too!
2013-03-26 19:17:26 +01:00
8afe262ae5 Fix for Bug 16395495 - OLD FSF ADDRESS IN GPL HEADER 2013-03-19 15:53:48 +01:00
d978016d93 Fix for Bug 16395495 - OLD FSF ADDRESS IN GPL HEADER 2013-03-19 15:53:48 +01:00
6d6af5477e Merge of patch for bug#14685362 from mysql-5.1. 2013-03-18 12:46:06 +05:30
fb401ad38e Merge of patch for bug#14685362 from mysql-5.1. 2013-03-18 12:46:06 +05:30
806e6cda27 MDEV-4249 : when autodetecting default client charset on Windows, fallback to GetACP() whenever GetConsoleCP() returns 0 (i.e appkication does not have a console , which is the case for GUI apps, Windows services etc) 2013-03-06 13:30:40 +01:00
aca8e7ed6b 5.3 merge 2013-01-15 19:07:46 +01:00
4f67a14700 5.2->5.3 merge 2013-01-10 15:40:21 +01:00
532d9c3028 one-byte overflow with old passwords 2012-12-11 09:50:48 +01:00
f72a765997 5.2 merge.
two tests still fail:
  main.innodb_icp and main.range_vs_index_merge_innodb
  call records_in_range() with both range ends being open
  (which triggers an assert)
2012-08-22 16:45:25 +02:00