mirror of
https://github.com/MariaDB/server.git
synced 2025-11-03 14:33:32 +03:00
2544aa7b9f
- Small difference in output from 'X509_NAME_Oneline' between OpenSSL and yaSSL. OpenSSL uses an extension that allow's the email adress of the cert holder. - Imported patch for yaSSL "add email to DN output" extra/yassl/taocrypt/src/asn.cpp: Import patch yassl.diff mysql-test/r/openssl_1.result: Update result file mysql-test/t/openssl_1.test: Update test to include "emailAddress=" tag in the required SUBJECT for grant.
99 lines
2.9 KiB
Plaintext
99 lines
2.9 KiB
Plaintext
# We test openssl. Result set is optimized to be compiled with --with-openssl.
|
|
# Use mysql-test-run with --with-openssl option.
|
|
-- source include/have_openssl.inc
|
|
|
|
--disable_warnings
|
|
drop table if exists t1;
|
|
--enable_warnings
|
|
create table t1(f1 int);
|
|
insert into t1 values (5);
|
|
|
|
grant select on test.* to ssl_user1@localhost require SSL;
|
|
grant select on test.* to ssl_user2@localhost require cipher "DHE-RSA-AES256-SHA";
|
|
grant select on test.* to ssl_user3@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Uppsala/L=Uppsala/O=MySQL AB/emailAddress=abstract.mysql.developer@mysql.com";
|
|
grant select on test.* to ssl_user4@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Uppsala/L=Uppsala/O=MySQL AB/emailAddress=abstract.mysql.developer@mysql.com" ISSUER "/C=SE/ST=Uppsala/L=Uppsala/O=MySQL AB";
|
|
grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx";
|
|
flush privileges;
|
|
|
|
connect (con1,localhost,ssl_user1,,,,,SSL);
|
|
connect (con2,localhost,ssl_user2,,,,,SSL);
|
|
connect (con3,localhost,ssl_user3,,,,,SSL);
|
|
connect (con4,localhost,ssl_user4,,,,,SSL);
|
|
--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
|
|
--error 1045
|
|
connect (con5,localhost,ssl_user5,,,,,SSL);
|
|
|
|
connection con1;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error 1142
|
|
delete from t1;
|
|
|
|
connection con2;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error 1142
|
|
delete from t1;
|
|
|
|
connection con3;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error 1142
|
|
delete from t1;
|
|
|
|
connection con4;
|
|
# Check ssl turned on
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
select * from t1;
|
|
--error 1142
|
|
delete from t1;
|
|
|
|
connection default;
|
|
drop user ssl_user1@localhost, ssl_user2@localhost,
|
|
ssl_user3@localhost, ssl_user4@localhost, ssl_user5@localhost;
|
|
|
|
drop table t1;
|
|
|
|
# End of 4.1 tests
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a different cacert
|
|
#
|
|
--exec echo "this query should not execute;" > $MYSQLTEST_VARDIR/tmp/test.sql
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca=$MYSQL_TEST_DIR/std_data/untrusted-cacert.pem --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank ca
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a nonexistent ca file
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-ca=nonexisting_file.pem --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank client-key
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-key= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
#
|
|
# Test that we can't open connection to server if we are using
|
|
# a blank client-cert
|
|
#
|
|
--error 1
|
|
--exec $MYSQL_TEST --ssl-cert= --max-connect-retries=1 < $MYSQLTEST_VARDIR/tmp/test.sql 2>&1
|
|
|
|
|