Skip to content

MDEV-40382 Support --ssl-crl on server builds with WolfSSL - #5647

Open
vaintroub wants to merge 1 commit into
10.11from
10.11-MDEV-40382
Open

MDEV-40382 Support --ssl-crl on server builds with WolfSSL#5647
vaintroub wants to merge 1 commit into
10.11from
10.11-MDEV-40382

Conversation

@vaintroub

@vaintroub vaintroub commented Sep 8, 2026

Copy link
Copy Markdown
Member

--ssl-crl was silently discarded on WolfSSL builds (nulled in sslopt-case.h, skipped in new_VioSSLFd()), so a revoked cert could still authenticate a REQUIRE X509 account.

WolfSSL's OpenSSL-compat layer already supports real CRL enforcement, so this removes both restrictions and fixes a related return-value check bug (WolfSSL can return negative codes on failure, unlike OpenSSL's 0/1).

Enabled CRL tests. main.ssl_crl_clients remains disabled on GNUTLS builds (it relies on ssl-crlpath, ignored in GNUTLS builds)

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The CRL load call still uses a success/failure check that can miss non-0/1 failure codes, undermining the intended WolfSSL compatibility fix.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR fixes CRL enforcement when MariaDB is built against WolfSSL by ensuring --ssl-crl is no longer silently ignored and by broadening SSL/CRL test coverage across supported TLS libraries.

Changes:

  • Enable CRL loading/enforcement in new_VioSSLFd() for WolfSSL builds (remove the prior WolfSSL restriction).
  • Fix CRL flag-setting return-value handling to accommodate WolfSSL/OpenSSL-compat behavior.
  • Update/enable CRL-related mysql-test cases to run with any SSL-capable build and normalize library-specific error text.
File summaries
File Description
vio/viosslfactories.c Enables CRL loading/verification setup and adjusts return-value checks in SSL context initialization.
mysql-test/main/ssl_crl.test Runs CRL test under generic SSL communication support and normalizes error outputs across TLS libs.
mysql-test/main/ssl_crl.result Updates expected output to match normalized CRL rejection error.
mysql-test/main/ssl_crl_clients.test Skips CRL-path client tests specifically for GnuTLS, enabling them elsewhere.
include/sslopt-case.h Stops silently nulling --ssl-crl / --ssl-crlpath under WolfSSL-related conditions.
Review details
  • Files reviewed: 4/5 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread vio/viosslfactories.c
@vaintroub
vaintroub force-pushed the 10.11-MDEV-40382 branch 2 times, most recently from 5af92cc to e5d6a6c Compare September 8, 2026 20:08
--ssl-crl was silently discarded on WolfSSL: sslopt-case.h nulled
opt_ssl_crl after option parsing, and new_VioSSLFd() skipped CRL
loading for HAVE_WOLFSSL. A revoked certificate could still
authenticate a REQUIRE X509 / REQUIRE SUBJECT account.

WolfSSL's OpenSSL-compat layer already implements
X509_STORE_load_locations/X509_STORE_set_flags with real CRL
enforcement, so remove both restrictions.

Also fix X509_STORE_set_flags()'s success check: unlike OpenSSL,
WolfSSL can return negative error codes on failure, which == 0
missed.

Existing CRL tests were fixed to run with WolfSSL as well.

Note: on Windows, a revoked cert sometimes surfaces as ECONNRESET
instead of a TLS alert; the test's regex handles this too.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

3 participants