1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
|
From d5bedd07c111676695270cdf35d23f9026a78113 Mon Sep 17 00:00:00 2001
From: Thomas Deutschmann <whissi@gentoo.org>
Date: Tue, 22 Jun 2021 23:56:54 +0200
Subject: [PATCH 6/6] Add OpenSSL 3.0.0 support
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
---
cmake/ssl.cmake | 59 +++++++++++++------
mysys/my_md5.cc | 2 +
.../xcom_network_provider_ssl_native_lib.cc | 4 ++
plugin/x/client/xconnection_impl.cc | 4 ++
sql-common/client.cc | 2 +
sql/mysqld.cc | 2 +
sql/sys_vars.cc | 18 +++++-
vio/viosslfactories.cc | 6 ++
8 files changed, 78 insertions(+), 19 deletions(-)
diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
index 293281cf1..4732d8bf4 100644
--- a/cmake/ssl.cmake
+++ b/cmake/ssl.cmake
@@ -205,34 +205,59 @@ MACRO (MYSQL_CHECK_SSL)
NAMES crypto libcrypto libeay32
HINTS ${OPENSSL_ROOT_DIR}/lib)
- IF(OPENSSL_INCLUDE_DIR)
+ IF(OPENSSL_INCLUDE_DIR AND EXISTS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h")
# Verify version number. Version information looks like:
# #define OPENSSL_VERSION_NUMBER 0x1000103fL
# Encoded as MNNFFPPS: major minor fix patch status
FILE(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h"
OPENSSL_VERSION_NUMBER
- REGEX "^#[ ]*define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x[0-9].*"
- )
- STRING(REGEX REPLACE
- "^.*OPENSSL_VERSION_NUMBER[\t ]+0x([0-9]).*$" "\\1"
- OPENSSL_MAJOR_VERSION "${OPENSSL_VERSION_NUMBER}"
- )
- STRING(REGEX REPLACE
- "^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9]([0-9][0-9]).*$" "\\1"
- OPENSSL_MINOR_VERSION "${OPENSSL_VERSION_NUMBER}"
- )
- STRING(REGEX REPLACE
- "^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9][0-9][0-9]([0-9][0-9]).*$" "\\1"
- OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}"
+ REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x[0-9].*"
)
+
+ IF(OPENSSL_VERSION_NUMBER)
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_NUMBER[\t ]+0x([0-9]).*$" "\\1"
+ OPENSSL_MAJOR_VERSION "${OPENSSL_VERSION_NUMBER}"
+ )
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9]([0-9][0-9]).*$" "\\1"
+ OPENSSL_MINOR_VERSION "${OPENSSL_VERSION_NUMBER}"
+ )
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9][0-9][0-9]([0-9][0-9]).*$" "\\1"
+ OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}"
+ )
+ ELSE()
+ FILE(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h"
+ OPENSSL_VERSION_STR
+ REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_STR[\t ]+\"([0-9])+\\.([0-9])+\\.([0-9])+\".*"
+ )
+
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_STR[\t ]+\"([0-9]+)\\.[0-9]+\\.[0-9]+\".*$" "\\1"
+ OPENSSL_MAJOR_VERSION "${OPENSSL_VERSION_STR}"
+ )
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_STR[\t ]+\"[0-9]+\\.([0-9]+)\\.[0-9]+\".*$" "\\1"
+ OPENSSL_MINOR_VERSION "${OPENSSL_VERSION_STR}"
+ )
+ STRING(REGEX REPLACE
+ "^.*OPENSSL_VERSION_STR[\t ]+\"[0-9]+\\.[0-9]+\\.([0-9]+)\".*$" "\\1"
+ OPENSSL_FIX_VERSION "${OPENSSL_VERSION_STR}"
+ )
+ ENDIF()
ENDIF()
- IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0")
+
+ INCLUDE(CheckSymbolExists)
+
+ CHECK_SYMBOL_EXISTS(TLS1_3_VERSION "openssl/tls1.h" HAVE_TLS1_3_VERSION)
+ IF(HAVE_TLS1_3_VERSION)
ADD_DEFINITIONS(-DHAVE_TLSv13)
ENDIF()
IF(OPENSSL_INCLUDE_DIR AND
OPENSSL_LIBRARY AND
CRYPTO_LIBRARY AND
- OPENSSL_MAJOR_VERSION STREQUAL "1"
+ OPENSSL_MAJOR_VERSION VERSION_GREATER_EQUAL "1"
)
SET(OPENSSL_FOUND TRUE)
FIND_PROGRAM(OPENSSL_EXECUTABLE openssl
@@ -296,8 +321,6 @@ MACRO (MYSQL_CHECK_SSL)
MESSAGE(STATUS "OPENSSL_MINOR_VERSION = ${OPENSSL_MINOR_VERSION}")
MESSAGE(STATUS "OPENSSL_FIX_VERSION = ${OPENSSL_FIX_VERSION}")
- INCLUDE(CheckSymbolExists)
-
CMAKE_PUSH_CHECK_STATE()
SET(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
CHECK_SYMBOL_EXISTS(SHA512_DIGEST_LENGTH "openssl/sha.h"
diff --git a/mysys/my_md5.cc b/mysys/my_md5.cc
index 86203619f..37ed3c8b2 100644
--- a/mysys/my_md5.cc
+++ b/mysys/my_md5.cc
@@ -56,7 +56,9 @@ static void my_md5_hash(unsigned char *digest, unsigned const char *buf,
int compute_md5_hash(char *digest, const char *buf, int len) {
int retval = 0;
int fips_mode = 0;
+#if defined(OPENSSL_FIPS)
fips_mode = FIPS_mode();
+#endif
/* If fips mode is ON/STRICT restricted method calls will result into abort,
* skipping call. */
if (fips_mode == 0) {
diff --git a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/network/xcom_network_provider_ssl_native_lib.cc b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/network/xcom_network_provider_ssl_native_lib.cc
index 8d4af3c04..de67c9e7c 100644
--- a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/network/xcom_network_provider_ssl_native_lib.cc
+++ b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/network/xcom_network_provider_ssl_native_lib.cc
@@ -316,6 +316,7 @@ error:
return 1;
}
+#if defined(OPENSSL_FIPS)
#define OPENSSL_ERROR_LENGTH 512
static int configure_ssl_fips_mode(const int fips_mode) {
int rc = -1;
@@ -339,6 +340,7 @@ static int configure_ssl_fips_mode(const int fips_mode) {
EXIT:
return rc;
}
+#endif
static int configure_ssl_ca(SSL_CTX *ssl_ctx, const char *ca_file,
const char *ca_path) {
@@ -478,12 +480,14 @@ int Xcom_network_provider_ssl_library::xcom_init_ssl(
int verify_server = SSL_VERIFY_NONE;
int verify_client = SSL_VERIFY_NONE;
+#if defined(OPENSSL_FIPS)
if (configure_ssl_fips_mode(
Network_provider_manager::getInstance().xcom_get_ssl_fips_mode()) !=
1) {
G_ERROR("Error setting the ssl fips mode");
goto error;
}
+#endif
SSL_library_init();
SSL_load_error_strings();
diff --git a/plugin/x/client/xconnection_impl.cc b/plugin/x/client/xconnection_impl.cc
index aaf37a1b3..753944889 100644
--- a/plugin/x/client/xconnection_impl.cc
+++ b/plugin/x/client/xconnection_impl.cc
@@ -617,6 +617,7 @@ XError Connection_impl::get_ssl_error(const int error_id) {
return XError(CR_SSL_CONNECTION_ERROR, buffer);
}
+#if defined(OPENSSL_FIPS)
/**
Set fips mode in openssl library,
When we set fips mode ON/STRICT, it will perform following operations:
@@ -656,6 +657,7 @@ int set_fips_mode(const uint32_t fips_mode,
EXIT:
return rc;
}
+#endif
XError Connection_impl::activate_tls() {
if (nullptr == m_vio) return get_socket_error(SOCKET_ECONNRESET);
@@ -666,12 +668,14 @@ XError Connection_impl::activate_tls() {
if (!m_context->m_ssl_config.is_configured())
return XError{CR_SSL_CONNECTION_ERROR, ER_TEXT_TLS_NOT_CONFIGURATED, true};
+#if defined(OPENSSL_FIPS)
char err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
if (set_fips_mode(
static_cast<uint32_t>(m_context->m_ssl_config.m_ssl_fips_mode),
err_string) != 1) {
return XError{CR_SSL_CONNECTION_ERROR, err_string, true};
}
+#endif
auto ssl_ctx_flags = process_tls_version(
details::null_when_empty(m_context->m_ssl_config.m_tls_version));
diff --git a/sql-common/client.cc b/sql-common/client.cc
index 5de2a1fb9..102e663d9 100644
--- a/sql-common/client.cc
+++ b/sql-common/client.cc
@@ -8286,6 +8286,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
return 1;
break;
case MYSQL_OPT_SSL_FIPS_MODE: {
+#if defined(OPENSSL_FIPS)
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
ENSURE_EXTENSIONS_PRESENT(&mysql->options);
mysql->options.extension->ssl_fips_mode =
@@ -8298,6 +8299,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
"Set Fips mode ON/STRICT failed, detail: '%s'.", ssl_err_string);
return 1;
}
+#endif
} break;
case MYSQL_OPT_SSL_MODE:
ENSURE_EXTENSIONS_PRESENT(&mysql->options);
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 8105d4b73..b580f1c4d 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -5292,12 +5292,14 @@ static void init_ssl() {
}
static int init_ssl_communication() {
+#if defined(OPENSSL_FIPS)
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
int ret_fips_mode = set_fips_mode(opt_ssl_fips_mode, ssl_err_string);
if (ret_fips_mode != 1) {
LogErr(ERROR_LEVEL, ER_SSL_FIPS_MODE_ERROR, ssl_err_string);
return 1;
}
+#endif
if (TLS_channel::singleton_init(&mysql_main, mysql_main_channel, opt_use_ssl,
&server_main_callback, opt_initialize))
return 1;
diff --git a/sql/sys_vars.cc b/sql/sys_vars.cc
index 4592e4bbb..320f458fd 100644
--- a/sql/sys_vars.cc
+++ b/sql/sys_vars.cc
@@ -4799,6 +4799,7 @@ static Sys_var_ulong Sys_max_execution_time(
HINT_UPDATEABLE SESSION_VAR(max_execution_time), CMD_LINE(REQUIRED_ARG),
VALID_RANGE(0, ULONG_MAX), DEFAULT(0), BLOCK_SIZE(1));
+#if defined(OPENSSL_FIPS)
static bool update_fips_mode(sys_var *, THD *, enum_var_type) {
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
if (set_fips_mode(opt_ssl_fips_mode, ssl_err_string) != 1) {
@@ -4809,15 +4810,30 @@ static bool update_fips_mode(sys_var *, THD *, enum_var_type) {
return false;
}
}
+#endif
+#if defined(OPENSSL_FIPS)
static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", nullptr};
+#else
+static const char *ssl_fips_mode_names[] = {"OFF", 0};
+#endif
static Sys_var_enum Sys_ssl_fips_mode(
"ssl_fips_mode",
"SSL FIPS mode (applies only for OpenSSL); "
+#if defined(OPENSSL_FIPS)
"permitted values are: OFF, ON, STRICT",
+#else
+ "permitted values are: OFF",
+#endif
GLOBAL_VAR(opt_ssl_fips_mode), CMD_LINE(REQUIRED_ARG, OPT_SSL_FIPS_MODE),
ssl_fips_mode_names, DEFAULT(0), NO_MUTEX_GUARD, NOT_IN_BINLOG,
- ON_CHECK(nullptr), ON_UPDATE(update_fips_mode), nullptr);
+ ON_CHECK(NULL),
+#if defined(OPENSSL_FIPS)
+ ON_UPDATE(update_fips_mode),
+#else
+ ON_UPDATE(NULL),
+#endif
+ NULL);
static Sys_var_bool Sys_auto_generate_certs(
"auto_generate_certs",
diff --git a/vio/viosslfactories.cc b/vio/viosslfactories.cc
index 618be1511..672fc74ca 100644
--- a/vio/viosslfactories.cc
+++ b/vio/viosslfactories.cc
@@ -472,6 +472,7 @@ void ssl_start() {
}
}
+#if defined(OPENSSL_FIPS)
/**
Set fips mode in openssl library,
When we set fips mode ON/STRICT, it will perform following operations:
@@ -525,6 +526,7 @@ EXIT:
@returns openssl current fips mode
*/
uint get_fips_mode() { return FIPS_mode(); }
+#endif
/**
Toggle FIPS mode, to see whether it is available with the current SSL library.
@@ -532,12 +534,16 @@ uint get_fips_mode() { return FIPS_mode(); }
@retval non-zero: FIPS is supported.
*/
int test_ssl_fips_mode(char *err_string) {
+#if defined(OPENSSL_FIPS)
int ret = FIPS_mode_set(FIPS_mode() == 0 ? 1 : 0);
unsigned long err = (ret == 0) ? ERR_get_error() : 0;
if (err != 0) {
ERR_error_string_n(err, err_string, OPENSSL_ERROR_LENGTH - 1);
}
+#else
+ int ret = 0;
+#endif
return ret;
}
--
2.34.0
|
