summaryrefslogtreecommitdiff
path: root/mysys_ssl
Commit message (Collapse)AuthorAgeFilesLines
* Merge 10.4 into 10.5Marko Mäkelä2023-02-101-1/+1
|\
| * Apply clang-tidy to remove empty constructors / destructorsVicențiu Ciorbaru2023-02-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is the result of running run-clang-tidy -fix -header-filter=.* -checks='-*,modernize-use-equals-default' . Code style changes have been done on top. The result of this change leads to the following improvements: 1. Binary size reduction. * For a -DBUILD_CONFIG=mysql_release build, the binary size is reduced by ~400kb. * A raw -DCMAKE_BUILD_TYPE=Release reduces the binary size by ~1.4kb. 2. Compiler can better understand the intent of the code, thus it leads to more optimization possibilities. Additionally it enabled detecting unused variables that had an empty default constructor but not marked so explicitly. Particular change required following this patch in sql/opt_range.cc result_keys, an unused template class Bitmap now correctly issues unused variable warnings. Setting Bitmap template class constructor to default allows the compiler to identify that there are no side-effects when instantiating the class. Previously the compiler could not issue the warning as it assumed Bitmap class (being a template) would not be performing a NO-OP for its default constructor. This prevented the "unused variable warning".
* | MDEV-27778 md5 in FIPS crashes with OpenSSL 3.0.0Honza Horak2022-07-041-0/+11
| | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.0+ does not support EVP_MD_CTX_FLAG_NON_FIPS_ALLOW any longer. In OpenSSL 1.1.1 the non FIPS allowed flag is context specific, while in 3.0.0+ it is a different EVP_MD provider. Fixes #2010 part of MDEV-29000
* | MDEV-25785 Add support for OpenSSL 3.0Vladislav Vaintroub2022-07-041-17/+29
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes - MD_CTX_SIZE is increased - EVP_CIPHER_CTX_buf_noconst(ctx) does not work anymore, points to nobody knows where. The assumption made previously was that (since the function does not seem to be documented) was that it points to the last partial source block. Add own partial block buffer for NOPAD encryption instead - SECLEVEL in CipherString in openssl.cnf had been downgraded to 0, from 1, to make TLSv1.0 and TLSv1.1 possible (according to https://github.com/openssl/openssl/blob/openssl-3.0.0/NEWS.md even though the manual for SSL_CTX_get_security_level claims that it should not be necessary) - Workaround Ssl_cipher_list issue, it now returns TLSv1.3 ciphers, in addition to what was set in --ssl-cipher - ctx_buf buffer now must be aligned to 16 bytes with openssl( previously with WolfSSL only), ot crashes will happen - updated aes-t , to be better debuggable using function, rather than a huge multiline macro added test that does "nopad" encryption piece-wise, to test replacement of EVP_CIPHER_CTX_buf_noconst part of MDEV-29000
* Merge branch '10.3' into 10.4Oleksandr Byelkin2022-01-306-5/+5
|\
| * Merge branch '10.2' into 10.3mariadb-10.3.33Oleksandr Byelkin2022-01-296-5/+5
| |\
| | * MDEV-27494 Rename .ic files to .inlVladislav Vaintroub2022-01-176-5/+5
| | |
* | | Merge 10.3 into 10.4Marko Mäkelä2020-10-221-1/+2
|\ \ \ | |/ /
| * | Merge 10.2 into 10.3Marko Mäkelä2020-10-221-1/+2
| |\ \ | | |/
| | * MDEV-23925: Fixed warnings generated during compilation of ↵Dmitry Shulga2020-10-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mysys_ssl/openssl.c on MacOS Compiler warnings like one listed below are generated during server build on MacOS: In file included from server-10.2-MDEV-23564/mysys_ssl/openssl.c:33: In file included from /usr/local/include/openssl/evp.h:16: In file included from /usr/local/include/openssl/bio.h:20: /usr/local/include/openssl/crypto.h:206:10: warning: 'CRYPTO_cleanup_all_ex_data' macro redefined [-Wmacro-redefined] ^ /mariadb/server-10.2-MDEV-23564/include/ssl_compat.h:46:9: note: previous definition is here ^ In case MariaDB serer is build with -DCMAKE_BUILD_TYPE=Debug it results in build error. The reason of compiler warnings is that header file <ssl_compat.h> included before the openssl system header files. File ssl_compat.h contains some macros with the same names as SSL API functions declared in the openssl system header files. It resulted in duplicate symbols that produces compiler warnings. To fix the issue the header file ssl_compat.h should be included after a line where openssl system header is included.
* | | WolfSSL fixesSergei Golubchik2020-05-081-0/+2
| | | | | | | | | | | | | | | | | | remove Timeval workaround (not needed anymore). add template workaround. comments.
* | | Update WolfSSL, remove older workarounds.Vladislav Vaintroub2019-07-281-16/+0
| | |
* | | MDEV-19684 enable intel assembly (AESNI etc) and fastmath when compiling WolfSSLVladislav Vaintroub2019-06-041-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using different recommended speedup options for WolfSSL. - Enable x64 assembly code on Intel. - in my_crypt.cc, align EVP_CIPHER_CTX buffer, since some members need alignment of 16 (for AESNI instructions), when assembler is enabled. - Adjust MY_AES_CTX_SIZE - Enable fastmath in wolfssl (large integer math).
* | | Fix compilation on LinuxVladislav Vaintroub2019-05-291-1/+1
| | |
* | | MDEV-19617 Assertion `src' failed in MyCTX::updateVladislav Vaintroub2019-05-281-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | Apprently, sometimes there will be null pointers with 0 length passed to the MyCTX::update() function, and will need to return a valid buffer. So weaken the assertion, and use a valid pointer for src if it was NULL.
* | | MDEV-19604 WolfSSL breaks binlog_encryption.binlog_incidentVladislav Vaintroub2019-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Log_event_writer::encrypt_and_write() can pass NULL pointer as source buffer for the encryption. WolfSSL EVP_CipherUpdate(), rightfully rejects this as invalid parameter. Fix Log_event_writer::encrypt_and_write() and check, with assertion, that src parameterm is sane in MyCTX::update()
* | | MDEV-18531 : remove yasslVladislav Vaintroub2019-05-221-191/+0
| | |
* | | MDEV-18531 : Use WolfSSL instead of YaSSL as "bundled" SSL/encryption libraryVladislav Vaintroub2019-05-224-31/+54
|/ / | | | | | | | | | | | | | | - Add new submodule for WolfSSL - Build and use wolfssl and wolfcrypt instead of yassl/taocrypt - Use HAVE_WOLFSSL instead of HAVE_YASSL - Increase MY_AES_CTX_SIZE, to avoid compile time asserts in my_crypt.cc (sizeof(EVP_CIPHER_CTX) is larger on WolfSSL)
* | Merge 10.2 into 10.3Marko Mäkelä2019-05-1410-10/+10
|\ \ | |/
| * Merge 10.1 into 10.2Marko Mäkelä2019-05-1310-10/+10
| |\
| | * Merge branch '5.5' into 10.1Vicențiu Ciorbaru2019-05-113-3/+3
| | |
| | * Update FSF addressVicențiu Ciorbaru2019-05-117-7/+7
| | |
* | | Merge branch '10.2' into 10.3Sergei Golubchik2019-03-291-2/+3
|\ \ \ | |/ /
| * | MDEV-15587 AES test fails, segfaults in EVP_CipherInit_exMarko Mäkelä2019-03-291-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When HAVE_YASSL is defined (due to cmake -DWITH_SSL=bundled or otherwise), mysys_ssl/my_crypt.cc will #include "yassl.cc" from the same directory. When MariaDB 10.2 or later is compiled with GCC 8 and optimizations are enabled, then the check if (iv) in EVP_CipherInit_ex() can be wrongly optimized away. The reason appears to be that __attribute__((nonnull)) is attached to the variable iv, because there is a (no-op) call memcpy(oiv, iv, ivlen=0) earlier in the code path. It is possible that this started failing after the code was refactored in MDEV-10332 (MariaDB 10.2.6). In MariaDB 10.1, there is a similar memcpy() call in MyCTX_nopad::init(), but the code appears to work fine.
* | | Windows : fix broken build with OpenSSLVladislav Vaintroub2018-09-081-1/+2
| | |
* | | MDEV-15513 use EVP_MD_CTX_{new,free} instead of EVP_MD_CTX_{create, destroy}Alexander Kuleshov2018-05-211-2/+2
|/ / | | | | | | | | | | | | | | | | | | | | for consistency with EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free(). As the EVP_DIGESTINIT(3) man page says: EVP_MD_CTX_create() and EVP_MD_CTX_destroy() were renamed to EVP_MD_CTX_new() and EVP_MD_CTX_free() in OpenSSL 1.1. Closes #621
* | MDEV-14567: CRYPTO_set_mem_functions fails in FIPS modeDaniel Black2018-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | If the CRYPTO_set_mem_functions fails just return success from check_openssl_compatibility. The only case where CRYPTO_set_mem_functions fails is the allow_customize==0 (aka FIPS mode). The check_openssl_compatibility isn't able to complete unless this function returns success. ref: https://github.com/openssl/openssl/blob/OpenSSL_1_1_0g/crypto/mem.c#L34
* | Merge branch 'github/10.1' into 10.2Sergei Golubchik2018-02-062-14/+2
|\ \ | |/
| * MDEV-14343 Server crash on FIPS with openssl-1.0.2kSergei Golubchik2018-01-302-21/+3
| | | | | | | | don't use internal undocumented OpenSSL functionality
* | MDEV-13384 - misc Windows warnings fixedVladislav Vaintroub2017-09-282-5/+5
| |
* | MDEV-13844 : Fix Windows warnings. Fix DBUG_PRINT.Vladislav Vaintroub2017-09-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | - Fix win64 pointer truncation warnings (usually coming from misusing 0x%lx and long cast in DBUG) - Also fix printf-format warnings Make the above mentioned warnings fatal. - fix pthread_join on Windows to set return value.
* | MDEV-13698 stack overflow (OpenSSL on Windows)Sergei Golubchik2017-09-181-1/+1
| | | | | | | | avoid CRYPTO_free recursively calling itself on Windows
* | MDEV-12763 10.2 uses deprecated openssl 1.0 apis even with 1.1Sergei Golubchik2017-09-182-2/+2
| | | | | | | | | | Use OpenSSL 1.1 when applicable. Create compatibility macros for OpenSSL 1.0- and YaSSL.
* | fix compilation with OpenSSL 1.1Sergei Golubchik2017-07-131-1/+2
| |
* | cleanup: check_openssl_compatibility()Sergei Golubchik2017-07-051-22/+22
| | | | | | | | | | | | | | | | | | CRYPTO_set_mem_functions() works only until the first allocation is done: * remove the second CRYPTO_set_mem_functions() call * check whether the first CRYPTO_set_mem_functions() call worked * stricter memory checks (==1, not >1, etc) * as coc_malloc cannot be removed, make the counter a bit cheaper * only do the check for OpenSSL 1.1 (because of OpenSSL 1.0 bug)
* | fix crashes with openssl fips buildsSergei Golubchik2017-05-101-2/+2
| | | | | | | | | | | | Apparently openssl ignores CRYPTO_set_mem_functions() in fips mode, so we cannot detect structure sizes. Don't freak out when no mallocs were detected.
* | MDEV-10332 support for OpenSSL 1.1 and LibreSSLSergei Golubchik2017-05-095-138/+140
| | | | | | | | | | | | | | | | | | | | | | | | post-review fixes: * move all ssl implementation related ifdefs/defines to one file (ssl_compat.h) * work around OpenSSL-1.1 desire to malloc every EVP context by run-time checking that context allocated on the stack is big enough (openssl.c) * use newer version of the AWS SDK for OpenSSL 1.1 * use get_dh2048() function as generated by openssl 1.1 (viosslfactories.c)
* | MDEV-10332 support for OpenSSL 1.1 and LibreSSLGeorg Richter2017-05-093-47/+122
| | | | | | | | | | | | | | | | | | | | | | Initial support tested against OpenSSL 1.0.1, 1.0.2, 1.1.0, Yassl and LibreSSL not working on Windows with native SChannel support, due to wrong cipher mapping: Latter one requires push of CONC-241 fixes. Please note that OpenSSL 0.9.8 and OpenSSL 1.1.0 will not work: Even if the build succeeds, test cases will fail with various errors, especially when using different tls libraries or versions for client and server.
* | Merge 10.1 into 10.2Marko Mäkelä2017-05-061-0/+26
|\ \ | |/ | | | | | | | | Also, include fixes by Vladislav Vaintroub to the aws_key_management plugin. The AWS C++ SDK specifically depends on OPENSSL_LIBRARIES, not generic SSL_LIBRARIES (such as YaSSL).
| * MDEV-11663 Create services for functionality used by pluginsVladislav Vaintroub2017-04-271-0/+26
| | | | | | | | | | | | Added service for - encryption (AES) - error reporting, e.g my_printf_error()
* | Merge branch '10.1' into 10.2Sergei Golubchik2017-03-309-315/+278
|\ \ | |/
| * remove old API for SHA2Sergei Golubchik2017-03-102-69/+0
| |
| * my_sha2 serviceSergei Golubchik2017-03-106-11/+91
| |
| * cleanup: generalize my_sha1.ccSergei Golubchik2017-03-102-133/+189
| | | | | | | | | | move most of the code into my_sha.ic, making it independent from the actual SHAx variant.
| * cleanup: remove a duplicate fileSergei Golubchik2017-03-102-104/+0
| |
* | Fix many -Wconversion warnings.Marko Mäkelä2017-03-071-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define my_thread_id as an unsigned type, to avoid mismatch with ulonglong. Change some parameters to this type. Use size_t in a few more places. Declare many flag constants as unsigned to avoid sign mismatch when shifting bits or applying the unary ~ operator. When applying the unary ~ operator to enum constants, explictly cast the result to an unsigned type, because enum constants can be treated as signed. In InnoDB, change the source code line number parameters from ulint to unsigned type. Also, make some InnoDB functions return a narrower type (unsigned or uint32_t instead of ulint; bool instead of ibool).
* | Fix for MDEV-11174:Georg Richter2017-02-011-0/+3
|/ | | | A GCM encrypted ciphertext must contain an authentication tag with AES_BLOCK_SIZE length, so we need to check that the length of ciphertext is at least AES_BLOCK_SIZE.
* Merge branch '10.0' into 10.1Sergei Golubchik2015-12-211-0/+4
|\
| * after-merge: 10.0 part of MDEV-9249 (ERR_remove_state)Sergei Golubchik2015-12-211-0/+4
| |
* | New encryption API. Piece-wise encryption.Sergei Golubchik2015-09-042-275/+368
| | | | | | | | | | | | | | | | | | | | | | | | | | Instead of encrypt(src, dst, key, iv) that encrypts all data in one go, now we have encrypt_init(key,iv), encrypt_update(src,dst), and encrypt_finish(dst). This also causes collateral changes in the internal my_crypt.cc encryption functions and in the encryption service. There are wrappers to provide the old all-at-once encryption functionality. But binlog events are often written piecewise, they'll need the new api.
View Lorry Controller Status