Skip to content

Commit 0002e13

Browse files
Ramil Kalimullinprashanttekriwal
Ramil Kalimullin
authored and
prashanttekriwal
committed
BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING SSL CONNECTION
MYSQL_OPT_SSL_MODE option introduced. It is set in case of --ssl-mode=REQUIRED and permits only SSL connection. (cherry picked from commit f91b941842d240b8a62645e507f5554e8be76aec)
1 parent 26a4bde commit 0002e13

18 files changed

+133
-52
lines changed

‎client/client_priv.h

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2001, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -127,22 +127,38 @@ enum options_client
127127
/**
128128
Wrapper for mysql_real_connect() that checks if SSL connection is establised.
129129
130-
The function calls mysql_real_connect() first, then if given ssl_required==TRUE
131-
argument (i.e. --ssl-mode=REQUIRED option used) checks current SSL chiper to
132-
ensure that SSL is used for current connection.
133-
Otherwise it returns NULL and sets errno to CR_SSL_CONNECTION_ERROR.
130+
The function calls mysql_real_connect() first. Then, if the ssl_required
131+
argument is TRUE (i.e., the --ssl-mode=REQUIRED option was specified), it
132+
checks the current SSL cipher to ensure that SSL is used for the current
133+
connection. Otherwise, it returns NULL and sets errno to
134+
CR_SSL_CONNECTION_ERROR.
134135
135-
All clients (except mysqlbinlog which disregards SSL options) use this function
136-
instead of mysql_real_connect() to handle --ssl-mode=REQUIRED option.
136+
All clients (except mysqlbinlog, which disregards SSL options) use this
137+
function instead of mysql_real_connect() to handle the --ssl-mode=REQUIRED
138+
option.
137139
*/
138140
MYSQL *mysql_connect_ssl_check(MYSQL *mysql_arg, const char *host,
139141
const char *user, const char *passwd,
140142
const char *db, uint port,
141143
const char *unix_socket, ulong client_flag,
142144
my_bool ssl_required MY_ATTRIBUTE((unused)))
143145
{
144-
MYSQL *mysql= mysql_real_connect(mysql_arg, host, user, passwd, db, port,
145-
unix_socket, client_flag);
146+
MYSQL *mysql;
147+
148+
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
149+
enum mysql_ssl_mode opt_ssl_mode= SSL_MODE_REQUIRED;
150+
if (ssl_required &&
151+
mysql_options(mysql_arg, MYSQL_OPT_SSL_MODE, (char *) &opt_ssl_mode))
152+
{
153+
NET *net= &mysql_arg->net;
154+
net->last_errno= CR_SSL_CONNECTION_ERROR;
155+
strmov(net->last_error, "Client library doesn't support MYSQL_SSL_REQUIRED option");
156+
strmov(net->sqlstate, "HY000");
157+
return NULL;
158+
}
159+
#endif
160+
mysql= mysql_real_connect(mysql_arg, host, user, passwd, db, port,
161+
unix_socket, client_flag);
146162
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
147163
if (mysql && /* connection established. */
148164
ssl_required && /* --ssl-mode=REQUIRED. */

‎client/mysql.cc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1488,7 +1488,8 @@ sig_handler handle_kill_signal(int sig)
14881488
"program_name", "mysql");
14891489
if (!mysql_connect_ssl_check(kill_mysql, current_host, current_user,
14901490
opt_password, "", opt_mysql_port,
1491-
opt_mysql_unix_port, 0, opt_ssl_required))
1491+
opt_mysql_unix_port, 0,
1492+
opt_ssl_mode == SSL_MODE_REQUIRED))
14921493
{
14931494
tee_fprintf(stdout, "%s -- sorry, cannot connect to server to kill query, giving up ...\n", reason);
14941495
goto err;
@@ -4819,7 +4820,7 @@ sql_real_connect(char *host,char *database,char *user,char *password,
48194820
if (!mysql_connect_ssl_check(&mysql, host, user, password,
48204821
database, opt_mysql_port, opt_mysql_unix_port,
48214822
connect_flag | CLIENT_MULTI_STATEMENTS,
4822-
opt_ssl_required))
4823+
opt_ssl_mode == SSL_MODE_REQUIRED))
48234824
{
48244825
if (!silent ||
48254826
(mysql_errno(&mysql) != CR_CONN_HOST_ERROR &&

‎client/mysql_upgrade.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2006, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -401,9 +401,11 @@ static int run_tool(char *tool_path, DYNAMIC_STRING *ds_res, ...)
401401

402402
va_end(args);
403403

404+
#if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
404405
/* If given --ssl-mode=REQUIRED propagate it to the tool. */
405-
if (opt_ssl_required)
406+
if (opt_ssl_mode == SSL_MODE_REQUIRED)
406407
dynstr_append(&ds_cmdline, "--ssl-mode=REQUIRED");
408+
#endif
407409

408410
#ifdef __WIN__
409411
dynstr_append(&ds_cmdline, "\"");

‎client/mysqladmin.cc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -552,8 +552,8 @@ static my_bool sql_connect(MYSQL *mysql, uint wait)
552552
for (;;)
553553
{
554554
if (mysql_connect_ssl_check(mysql, host, user, opt_password, NullS,
555-
tcp_port, unix_port,
556-
CLIENT_REMEMBER_OPTIONS, opt_ssl_required))
555+
tcp_port, unix_port, CLIENT_REMEMBER_OPTIONS,
556+
opt_ssl_mode == SSL_MODE_REQUIRED))
557557
{
558558
mysql->reconnect= 1;
559559
if (info)

‎client/mysqlcheck.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2001, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -937,7 +937,7 @@ static int dbConnect(char *host, char *user, char *passwd)
937937
if (!(sock = mysql_connect_ssl_check(&mysql_connection, host, user, passwd,
938938
NULL, opt_mysql_port,
939939
opt_mysql_unix_port, 0,
940-
opt_ssl_required)))
940+
opt_ssl_mode == SSL_MODE_REQUIRED)))
941941
{
942942
DBerror(&mysql_connection, "when trying to connect");
943943
DBUG_RETURN(1);

‎client/mysqldump.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -1556,7 +1556,7 @@ static int connect_to_db(char *host, char *user,char *passwd)
15561556
if (!(mysql= mysql_connect_ssl_check(&mysql_connection, host, user,
15571557
passwd, NULL, opt_mysql_port,
15581558
opt_mysql_unix_port, 0,
1559-
opt_ssl_required)))
1559+
opt_ssl_mode == SSL_MODE_REQUIRED)))
15601560
{
15611561
DB_error(&mysql_connection, "when trying to connect");
15621562
DBUG_RETURN(1);

‎client/mysqlimport.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -482,7 +482,7 @@ static MYSQL *db_connect(char *host, char *database,
482482
"program_name", "mysqlimport");
483483
if (!(mysql_connect_ssl_check(mysql, host, user, passwd, database,
484484
opt_mysql_port, opt_mysql_unix_port,
485-
0, opt_ssl_required)))
485+
0, opt_ssl_mode == SSL_MODE_REQUIRED)))
486486
{
487487
ignore_errors=0; /* NO RETURN FROM db_error */
488488
db_error(mysql);

‎client/mysqlshow.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -159,7 +159,7 @@ int main(int argc, char **argv)
159159
if (!(mysql_connect_ssl_check(&mysql, host, user, opt_password,
160160
(first_argument_uses_wildcards) ? "" :
161161
argv[0], opt_mysql_port, opt_mysql_unix_port,
162-
0, opt_ssl_required)))
162+
0, opt_ssl_mode == SSL_MODE_REQUIRED)))
163163
{
164164
fprintf(stderr,"%s: %s\n",my_progname,mysql_error(&mysql));
165165
exit(1);

‎client/mysqlslap.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License as published by
@@ -371,7 +371,8 @@ int main(int argc, char **argv)
371371
{
372372
if (!(mysql_connect_ssl_check(&mysql, host, user, opt_password,
373373
NULL, opt_mysql_port, opt_mysql_unix_port,
374-
connect_flags, opt_ssl_required)))
374+
connect_flags,
375+
opt_ssl_mode == SSL_MODE_REQUIRED)))
375376
{
376377
fprintf(stderr,"%s: Error when connecting to server: %s\n",
377378
my_progname,mysql_error(&mysql));

‎client/mysqltest.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5323,7 +5323,7 @@ void safe_connect(MYSQL* mysql, const char *name, const char *host,
53235323
&can_handle_expired_passwords);
53245324
while(!mysql_connect_ssl_check(mysql, host,user, pass, db, port, sock,
53255325
CLIENT_MULTI_STATEMENTS | CLIENT_REMEMBER_OPTIONS,
5326-
opt_ssl_required))
5326+
opt_ssl_mode == SSL_MODE_REQUIRED))
53275327
{
53285328
/*
53295329
Connect failed
@@ -5429,7 +5429,7 @@ int connect_n_handle_errors(struct st_command *command,
54295429
&can_handle_expired_passwords);
54305430
while (!mysql_connect_ssl_check(con, host, user, pass, db, port,
54315431
sock ? sock: 0, CLIENT_MULTI_STATEMENTS,
5432-
opt_ssl_required))
5432+
opt_ssl_mode == SSL_MODE_REQUIRED))
54335433
{
54345434
/*
54355435
If we have used up all our connections check whether this

‎include/mysql.h

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License as published by
@@ -175,7 +175,8 @@ enum mysql_option
175175
MYSQL_OPT_CONNECT_ATTR_DELETE,
176176
MYSQL_SERVER_PUBLIC_KEY,
177177
MYSQL_ENABLE_CLEARTEXT_PLUGIN,
178-
MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS
178+
MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS,
179+
MYSQL_OPT_SSL_MODE
179180
};
180181

181182
/**
@@ -245,6 +246,11 @@ enum mysql_protocol_type
245246
MYSQL_PROTOCOL_PIPE, MYSQL_PROTOCOL_MEMORY
246247
};
247248

249+
enum mysql_ssl_mode
250+
{
251+
SSL_MODE_REQUIRED= 3
252+
};
253+
248254
typedef struct character_set
249255
{
250256
unsigned int number; /* character set number */

‎include/mysql.h.pp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,8 @@
272272
MYSQL_OPT_CONNECT_ATTR_DELETE,
273273
MYSQL_SERVER_PUBLIC_KEY,
274274
MYSQL_ENABLE_CLEARTEXT_PLUGIN,
275-
MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS
275+
MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS,
276+
MYSQL_OPT_SSL_MODE
276277
};
277278
struct st_mysql_options_extention;
278279
struct st_mysql_options {
@@ -319,6 +320,10 @@
319320
MYSQL_PROTOCOL_DEFAULT, MYSQL_PROTOCOL_TCP, MYSQL_PROTOCOL_SOCKET,
320321
MYSQL_PROTOCOL_PIPE, MYSQL_PROTOCOL_MEMORY
321322
};
323+
enum mysql_ssl_mode
324+
{
325+
SSL_MODE_REQUIRED= 3
326+
};
322327
typedef struct character_set
323328
{
324329
unsigned int number;

‎include/sql_common.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SQL_COMMON_INCLUDED
22
#define SQL_COMMON_INCLUDED
33

4-
/* Copyright (c) 2003, 2012, Oracle and/or its affiliates. All rights reserved.
4+
/* Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License as published by
@@ -38,6 +38,7 @@ struct st_mysql_options_extention {
3838
char *server_public_key_path;
3939
size_t connection_attributes_length;
4040
my_bool enable_cleartext_plugin;
41+
unsigned int ssl_mode;
4142
};
4243

4344
typedef struct st_mysql_methods

‎include/sslopt-case.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SSLOPT_CASE_INCLUDED
22
#define SSLOPT_CASE_INCLUDED
33

4-
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
4+
/* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License as published by
@@ -45,7 +45,7 @@
4545
exit(1);
4646
}
4747
else
48-
opt_ssl_required= 1;
48+
opt_ssl_mode= SSL_MODE_REQUIRED;
4949
break;
5050
#endif /* MYSQL_CLIENT */
5151
#endif

‎include/sslopt-vars.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SSLOPT_VARS_INCLUDED
22
#define SSLOPT_VARS_INCLUDED
33

4-
/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
4+
/* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License as published by
@@ -33,10 +33,10 @@ SSL_STATIC char *opt_ssl_crlpath = 0;
3333

3434
#ifdef MYSQL_CLIENT
3535
SSL_STATIC my_bool opt_ssl_verify_server_cert= 0;
36-
SSL_STATIC my_bool opt_ssl_required= 0;
36+
SSL_STATIC uint opt_ssl_mode= 0;
3737
#endif /* MYSQL_CLIENT */
3838
#else /* HAVE_OPENSSL */
39-
#define opt_ssl_required 0
39+
#define opt_ssl_mode 0
4040
#endif /* HAVE_OPENSSL */
4141

4242
#endif /* SSLOPT_VARS_INCLUDED */

‎mysql-test/r/ssl_mode.result

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ DROP TABLE t1;
3838
# mysql
3939
Unknown value to --ssl-mode: ''. Use --ssl-mode=REQUIRED
4040
Unknown value to --ssl-mode: 'DERIUQER'. Use --ssl-mode=REQUIRED
41-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
42-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
43-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
41+
ERROR 2026 (HY000): SSL connection error: Client is not configured to use SSL
42+
ERROR 2026 (HY000): SSL connection error: Client is not configured to use SSL
43+
ERROR 2026 (HY000): SSL connection error: Client is not configured to use SSL
4444

4545
End of tests

‎mysql-test/r/ssl_mode_no_ssl.result

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
# negative client tests
22
# mysql
3-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
4-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
5-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
6-
ERROR 2026 (HY000): --ssl-mode=REQUIRED option forbids non SSL connections
3+
ERROR 2026 (HY000): SSL connection error: Server doesn't support SSL
4+
ERROR 2026 (HY000): SSL connection error: Server doesn't support SSL
5+
ERROR 2026 (HY000): SSL connection error: Server doesn't support SSL
6+
ERROR 2026 (HY000): SSL connection error: Server doesn't support SSL
77
# mysqldump
8-
mysqldump: Got error: 2026: --ssl-mode=REQUIRED option forbids non SSL connections when trying to connect
8+
mysqldump: Got error: 2026: SSL connection error: Server doesn't support SSL when trying to connect
99
# mysqladmin
1010
Warning: Using a password on the command line interface can be insecure.
11-
mysqladmin: error: '--ssl-mode=REQUIRED option forbids non SSL connections'
11+
mysqladmin: error: 'SSL connection error: Server doesn't support SSL'
1212
# mysqlcheck
13-
mysqlcheck: Got error: 2026: --ssl-mode=REQUIRED option forbids non SSL connections when trying to connect
13+
mysqlcheck: Got error: 2026: SSL connection error: Server doesn't support SSL when trying to connect
1414
# mysqlimport
15-
mysqlimport: Error: 2026 --ssl-mode=REQUIRED option forbids non SSL connections
15+
mysqlimport: Error: 2026 SSL connection error: Server doesn't support SSL
1616
# mysqlshow
17-
mysqlshow: --ssl-mode=REQUIRED option forbids non SSL connections
17+
mysqlshow: SSL connection error: Server doesn't support SSL
1818
# mysqlslap
19-
mysqlslap: Error when connecting to server: --ssl-mode=REQUIRED option forbids non SSL connections
19+
mysqlslap: Error when connecting to server: SSL connection error: Server doesn't support SSL
2020
# mysqltest
21-
mysqltest: Could not open connection 'default': 2026 --ssl-mode=REQUIRED option forbids non SSL connections
21+
mysqltest: Could not open connection 'default': 2026 SSL connection error: Server doesn't support SSL
2222

2323
End of tests

0 commit comments

Comments
 (0)