MDEV-40382 Support --ssl-crl on server builds with WolfSSL - #5647
Open
vaintroub wants to merge 1 commit into
Open
MDEV-40382 Support --ssl-crl on server builds with WolfSSL#5647vaintroub wants to merge 1 commit into
vaintroub wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The CRL load call still uses a success/failure check that can miss non-0/1 failure codes, undermining the intended WolfSSL compatibility fix.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR fixes CRL enforcement when MariaDB is built against WolfSSL by ensuring --ssl-crl is no longer silently ignored and by broadening SSL/CRL test coverage across supported TLS libraries.
Changes:
- Enable CRL loading/enforcement in
new_VioSSLFd()for WolfSSL builds (remove the prior WolfSSL restriction). - Fix CRL flag-setting return-value handling to accommodate WolfSSL/OpenSSL-compat behavior.
- Update/enable CRL-related mysql-test cases to run with any SSL-capable build and normalize library-specific error text.
File summaries
| File | Description |
|---|---|
| vio/viosslfactories.c | Enables CRL loading/verification setup and adjusts return-value checks in SSL context initialization. |
| mysql-test/main/ssl_crl.test | Runs CRL test under generic SSL communication support and normalizes error outputs across TLS libs. |
| mysql-test/main/ssl_crl.result | Updates expected output to match normalized CRL rejection error. |
| mysql-test/main/ssl_crl_clients.test | Skips CRL-path client tests specifically for GnuTLS, enabling them elsewhere. |
| include/sslopt-case.h | Stops silently nulling --ssl-crl / --ssl-crlpath under WolfSSL-related conditions. |
Review details
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
vaintroub
force-pushed
the
10.11-MDEV-40382
branch
2 times, most recently
from
September 8, 2026 20:08
5af92cc to
e5d6a6c
Compare
--ssl-crl was silently discarded on WolfSSL: sslopt-case.h nulled opt_ssl_crl after option parsing, and new_VioSSLFd() skipped CRL loading for HAVE_WOLFSSL. A revoked certificate could still authenticate a REQUIRE X509 / REQUIRE SUBJECT account. WolfSSL's OpenSSL-compat layer already implements X509_STORE_load_locations/X509_STORE_set_flags with real CRL enforcement, so remove both restrictions. Also fix X509_STORE_set_flags()'s success check: unlike OpenSSL, WolfSSL can return negative error codes on failure, which == 0 missed. Existing CRL tests were fixed to run with WolfSSL as well. Note: on Windows, a revoked cert sometimes surfaces as ECONNRESET instead of a TLS alert; the test's regex handles this too.
vaintroub
force-pushed
the
10.11-MDEV-40382
branch
from
September 8, 2026 20:09
e5d6a6c to
77c272c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--ssl-crl was silently discarded on WolfSSL builds (nulled in sslopt-case.h, skipped in new_VioSSLFd()), so a revoked cert could still authenticate a REQUIRE X509 account.
WolfSSL's OpenSSL-compat layer already supports real CRL enforcement, so this removes both restrictions and fixes a related return-value check bug (WolfSSL can return negative codes on failure, unlike OpenSSL's 0/1).
Enabled CRL tests. main.ssl_crl_clients remains disabled on GNUTLS builds (it relies on ssl-crlpath, ignored in GNUTLS builds)