You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
213 lines
7.8 KiB
213 lines
7.8 KiB
call mtr.add_suppression("Failed to set up SSL because of the following SSL library error");
|
|
# Check if ssl is on
|
|
SELECT LENGTH(VARIABLE_VALUE) > 0 FROM performance_schema.session_status
|
|
WHERE VARIABLE_NAME='Ssl_cipher';
|
|
LENGTH(VARIABLE_VALUE) > 0
|
|
1
|
|
################## FR1.1 and FR 1.4: ALTER INSTANCE RELOAD TLS
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# Check if ssl is still turned on after reload
|
|
SELECT LENGTH(VARIABLE_VALUE) > 0 FROM performance_schema.session_status
|
|
WHERE VARIABLE_NAME='Ssl_cipher';
|
|
LENGTH(VARIABLE_VALUE) > 0
|
|
1
|
|
# FR1.1: check if old sessions continue
|
|
SET @must_be_present= 'present';
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# Success criteria: value must be present
|
|
SELECT @must_be_present;
|
|
@must_be_present
|
|
present
|
|
# cleanup
|
|
################## FR 1.2: check if new sessions get the new vals
|
|
# Save the defaults
|
|
SET @orig_ssl_cipher = @@global.ssl_cipher;
|
|
SET @orig_tls_version = @@global.tls_version;
|
|
# in ssl_con
|
|
# check if the session has the original values
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
Variable_name Value
|
|
Ssl_cipher orig_cipher
|
|
# in default connection
|
|
# setting new values for ssl_cipher
|
|
SET GLOBAL ssl_cipher = "DHE-RSA-AES256-SHA256";
|
|
SET GLOBAL tls_version = "TLSv1.2";
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# in ssl_new_con
|
|
# Save the new defaults
|
|
# Check if the old and the new not afters differ
|
|
# in ssl_con
|
|
# the con session must have the original values
|
|
SHOW STATUS LIKE 'Ssl_cipher';
|
|
Variable_name Value
|
|
Ssl_cipher orig_cipher;
|
|
# cleanup
|
|
# in default connection
|
|
SET GLOBAL ssl_cipher = @orig_ssl_cipher;
|
|
SET GLOBAL tls_version = @orig_tls_version;
|
|
ALTER INSTANCE RELOAD TLS;
|
|
################## FR 1.5: new values effective only after RELOAD TLS
|
|
# Save the defaults
|
|
SET @orig_ssl_cipher = @@global.ssl_cipher;
|
|
# setting new values for ssl_cipher
|
|
SET GLOBAL ssl_cipher = "DHE-RSA-AES256-SHA256";
|
|
# in ssl_con
|
|
# Check if the old and the new not afters differ
|
|
# cleanup
|
|
# in default connection
|
|
SET GLOBAL ssl_cipher = @orig_ssl_cipher;
|
|
################## FR 1.7: CONNECTION_ADMIN will be required to execute
|
|
# ALTER INSTANCE RELOAD TLS
|
|
CREATE USER test_connection_admin@localhost;
|
|
# in ssl_con
|
|
# Must fail
|
|
ALTER INSTANCE RELOAD TLS;
|
|
ERROR 42000: Access denied; you need (at least one of) the CONNECTION_ADMIN privilege(s) for this operation
|
|
# in default connection
|
|
GRANT SUPER ON *.* TO test_connection_admin@localhost;
|
|
Warnings:
|
|
Warning 1287 The SUPER privilege identifier is deprecated
|
|
# in ssl_con
|
|
# Must fail
|
|
ALTER INSTANCE RELOAD TLS;
|
|
ERROR 42000: Access denied; you need (at least one of) the CONNECTION_ADMIN privilege(s) for this operation
|
|
# in default connection
|
|
REVOKE SUPER ON *.* FROM test_connection_admin@localhost;
|
|
Warnings:
|
|
Warning 1287 The SUPER privilege identifier is deprecated
|
|
GRANT CONNECTION_ADMIN ON *.* TO test_connection_admin@localhost;
|
|
# in ssl_con
|
|
# Must pass
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# cleanup
|
|
# in default connection
|
|
DROP USER test_connection_admin@localhost;
|
|
################## FR 1.8 and 1.9: disable SSL on wrong values
|
|
# Save the defaults
|
|
SET @orig_ssl_ca= @@global.ssl_ca;
|
|
# Seet CA to invalid value
|
|
SET GLOBAL ssl_ca = 'gizmo';
|
|
# Must fail and not change the SSL params
|
|
ALTER INSTANCE RELOAD TLS;
|
|
ERROR HY000: Failed to set up SSL because of the following SSL library error: SSL_CTX_set_default_verify_paths failed
|
|
# Must be 1
|
|
SELECT COUNT(*) FROM performance_schema.session_status
|
|
WHERE VARIABLE_NAME = 'Current_tls_ca' AND VARIABLE_VALUE = @orig_ssl_ca;
|
|
COUNT(*)
|
|
1
|
|
# Must return gizmo
|
|
SELECT @@global.ssl_ca;
|
|
@@global.ssl_ca
|
|
gizmo
|
|
# Must connect successfully
|
|
1
|
|
1
|
|
# Must pass with a warning and disable SSL
|
|
ALTER INSTANCE RELOAD TLS NO ROLLBACK ON ERROR;
|
|
Warnings:
|
|
Warning 3888 Failed to set up SSL because of the following SSL library error: SSL_CTX_set_default_verify_paths failed
|
|
# Must be 1
|
|
SELECT COUNT(*) FROM performance_schema.session_status
|
|
WHERE VARIABLE_NAME = 'Current_tls_ca' AND VARIABLE_VALUE = 'gizmo';
|
|
COUNT(*)
|
|
1
|
|
# Must fail to connect
|
|
# cleanup
|
|
SET GLOBAL ssl_ca = @orig_ssl_ca;
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# FR 1.9: Must connect successfully
|
|
1
|
|
1
|
|
################## FR2 and FR6: --ssl-* variables settable at runtime.
|
|
SET @orig_ssl_ca= @@global.ssl_ca;
|
|
SET @orig_ssl_cert= @@global.ssl_cert;
|
|
SET @orig_ssl_key= @@global.ssl_key;
|
|
SET @orig_ssl_capath= @@global.ssl_capath;
|
|
SET @orig_ssl_crl= @@global.ssl_crl;
|
|
SET @orig_ssl_crlpath= @@global.ssl_crlpath;
|
|
SET @orig_ssl_cipher= @@global.ssl_cipher;
|
|
SET @orig_tls_cipher= @@global.tls_ciphersuites;
|
|
SET @orig_tls_version= @@global.tls_version;
|
|
# Must pass
|
|
SET GLOBAL ssl_ca = 'gizmo';
|
|
SET GLOBAL ssl_cert = 'gizmo';
|
|
SET GLOBAL ssl_key = 'gizmo';
|
|
SET GLOBAL ssl_capath = 'gizmo';
|
|
SET GLOBAL ssl_crl = 'gizmo';
|
|
SET GLOBAL ssl_crlpath = 'gizmo';
|
|
SET GLOBAL ssl_cipher = 'gizmo';
|
|
SET GLOBAL tls_ciphersuites = 'gizmo';
|
|
SET GLOBAL tls_version = 'gizmo';
|
|
# Must fail
|
|
SET SESSION ssl_ca = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_ca' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_cert = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_cert' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_key = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_key' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_capath = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_capath' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_crl = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_crl' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_crlpath = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_crlpath' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION ssl_cipher = 'gizmo';
|
|
ERROR HY000: Variable 'ssl_cipher' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION tls_ciphersuites = 'gizmo';
|
|
ERROR HY000: Variable 'tls_ciphersuites' is a GLOBAL variable and should be set with SET GLOBAL
|
|
SET SESSION tls_version = 'gizmo';
|
|
ERROR HY000: Variable 'tls_version' is a GLOBAL variable and should be set with SET GLOBAL
|
|
# FR6: Must return 9
|
|
SELECT VARIABLE_NAME FROM performance_schema.session_status WHERE
|
|
VARIABLE_NAME IN
|
|
('Current_tls_ca', 'Current_tls_capath', 'Current_tls_cert',
|
|
'Current_tls_key', 'Current_tls_version', 'Current_tls_cipher',
|
|
'Current_tls_ciphersuites', 'Current_tls_crl', 'Current_tls_crlpath') AND
|
|
VARIABLE_VALUE != 'gizmo'
|
|
ORDER BY VARIABLE_NAME;
|
|
VARIABLE_NAME
|
|
Current_tls_ca
|
|
Current_tls_capath
|
|
Current_tls_cert
|
|
Current_tls_cipher
|
|
Current_tls_ciphersuites
|
|
Current_tls_crl
|
|
Current_tls_crlpath
|
|
Current_tls_key
|
|
Current_tls_version
|
|
# cleanup
|
|
SET GLOBAL ssl_ca = @orig_ssl_ca;
|
|
SET GLOBAL ssl_cert = @orig_ssl_cert;
|
|
SET GLOBAL ssl_key = @orig_ssl_key;
|
|
SET GLOBAL ssl_capath = @orig_ssl_capath;
|
|
SET GLOBAL ssl_crl = @orig_ssl_crl;
|
|
SET GLOBAL ssl_crlpath = @orig_ssl_crlpath;
|
|
SET GLOBAL ssl_cipher = @orig_ssl_cipher;
|
|
SET GLOBAL tls_ciphersuites = @orig_tls_ciphersuites;
|
|
SET GLOBAL tls_version = @orig_tls_version;
|
|
################## FR8: X plugin do not follow
|
|
# Save the defaults
|
|
SET @orig_ssl_ca= @@global.ssl_ca;
|
|
SET @orig_ssl_cert= @@global.ssl_cert;
|
|
SET @orig_ssl_key= @@global.ssl_key;
|
|
SET @orig_mysqlx_ssl_ca= @@global.mysqlx_ssl_ca;
|
|
SET @orig_mysqlx_ssl_cert= @@global.mysqlx_ssl_cert;
|
|
SET @orig_mysqlx_ssl_key= @@global.mysqlx_ssl_key;
|
|
# setting new values for ssl_cert, ssl_key and ssl_ca
|
|
SET GLOBAL ssl_cert = "MYSQL_TEST_DIR/std_data/server-cert-sha512.pem";
|
|
SET GLOBAL ssl_key = "MYSQL_TEST_DIR/std_data/server-key-sha512.pem";
|
|
SET GLOBAL ssl_ca = "MYSQL_TEST_DIR/std_data/ca-sha512.pem";
|
|
ALTER INSTANCE RELOAD TLS;
|
|
# Check that X variables match the initial ones
|
|
SELECT @@global.mysqlx_ssl_ca = @orig_mysqlx_ssl_ca,
|
|
@@global.mysqlx_ssl_cert = @orig_mysqlx_ssl_cert,
|
|
@@global.mysqlx_ssl_key = @orig_mysqlx_ssl_key;
|
|
@@global.mysqlx_ssl_ca = @orig_mysqlx_ssl_ca 1
|
|
@@global.mysqlx_ssl_cert = @orig_mysqlx_ssl_cert 1
|
|
@@global.mysqlx_ssl_key = @orig_mysqlx_ssl_key 1
|
|
# cleanup
|
|
SET GLOBAL ssl_cert = @orig_ssl_cert;
|
|
SET GLOBAL ssl_key = @orig_ssl_key;
|
|
SET GLOBAL ssl_ca = @orig_ssl_ca;
|
|
ALTER INSTANCE RELOAD TLS;
|
|
################## End of dynamic SSL tests
|
|
|