From 77c272c88e37afccfa09f9c2482c579fc89b810d Mon Sep 17 00:00:00 2001 From: Vladislav Vaintroub Date: Tue, 8 Sep 2026 22:07:59 +0200 Subject: [PATCH] MDEV-40382 Support --ssl-crl on server builds with WolfSSL --ssl-crl was silently discarded on WolfSSL: sslopt-case.h nulled opt_ssl_crl after option parsing, and new_VioSSLFd() skipped CRL loading for HAVE_WOLFSSL. A revoked certificate could still authenticate a REQUIRE X509 / REQUIRE SUBJECT account. WolfSSL's OpenSSL-compat layer already implements X509_STORE_load_locations/X509_STORE_set_flags with real CRL enforcement, so remove both restrictions. Also fix X509_STORE_set_flags()'s success check: unlike OpenSSL, WolfSSL can return negative error codes on failure, which == 0 missed. Existing CRL tests were fixed to run with WolfSSL as well. Note: on Windows, a revoked cert sometimes surfaces as ECONNRESET instead of a TLS alert; the test's regex handles this too. --- include/sslopt-case.h | 10 ---------- mysql-test/main/ssl_crl.test | 7 ++++--- mysql-test/main/ssl_crl_clients.test | 8 ++++---- vio/viosslfactories.c | 10 ++-------- 4 files changed, 10 insertions(+), 25 deletions(-) diff --git a/include/sslopt-case.h b/include/sslopt-case.h index 11351247cd7e2..635ff2da944d0 100644 --- a/include/sslopt-case.h +++ b/include/sslopt-case.h @@ -29,16 +29,6 @@ One can disable SSL later by using --skip-ssl or --ssl=0 */ opt_use_ssl= 1; -#if defined (HAVE_WOLFSSL) -#if defined(MYSQL_SERVER) - /* CRL does not work with WolfSSL (server) */ - opt_ssl_crl= NULL; -#endif -#if !defined(_WIN32) || !defined(LIBMARIADB) - /* CRL_PATH does not work with WolfSSL (server) and GnuTLS (client) */ - opt_ssl_crlpath= NULL; -#endif -#endif break; #endif #endif /* SSLOPT_CASE_INCLUDED */ diff --git a/mysql-test/main/ssl_crl.test b/mysql-test/main/ssl_crl.test index 6da116f4ebe66..0e5109de97b0e 100644 --- a/mysql-test/main/ssl_crl.test +++ b/mysql-test/main/ssl_crl.test @@ -1,6 +1,6 @@ # This test should work in embedded server after we fix mysqltest --source include/not_embedded.inc ---source include/have_openssl.inc +--source include/have_ssl_communication.inc --source include/not_ssl.inc --echo # try logging in with a certificate not in the server's --ssl-crl : should succeed @@ -8,7 +8,8 @@ --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/server-new-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/server-new-cert.pem test -e "SHOW STATUS LIKE 'Ssl_version'" --echo # try logging in with a certificate in the server's --ssl-crl : should fail -# OpenSSL 1.1.1a and later releases correctly rejects the certificate, but the error message is different ---replace_regex /(ERROR 2013 \(HY000\): Lost connection to server at '.*', system error: [0-9]+|ERROR 2026 \(HY000\): TLS\/SSL error: sslv3 alert certificate revoked)/ERROR 2026 (HY000): TLS\/SSL error: ssl\/tls alert certificate revoked/ +# The exact wording of the rejection differs by SSL library (OpenSSL, WolfSSL, +# GnuTLS) and some drop the connection outright instead of naming the alert. +--replace_regex /ERROR 2013 \(HY000\): Lost connection to server at '.*', system error: [0-9]+/ERROR 2026 (HY000): TLS\/SSL error: ssl\/tls alert certificate revoked/ /ERROR 2026 \(HY000\): TLS\/SSL error:[^\r\n]*(?:revoked|10054)[^\r\n]*/ERROR 2026 (HY000): TLS\/SSL error: ssl\/tls alert certificate revoked/i --error 1 --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_version'" 2>&1 diff --git a/mysql-test/main/ssl_crl_clients.test b/mysql-test/main/ssl_crl_clients.test index 95b4ac3c0d530..eca9382ee7dd3 100644 --- a/mysql-test/main/ssl_crl_clients.test +++ b/mysql-test/main/ssl_crl_clients.test @@ -1,11 +1,11 @@ # This test should work in embedded server after we fix mysqltest -- source include/not_embedded.inc +-- source include/have_ssl_communication.inc -if (`SELECT COUNT(*) = 0 FROM information_schema.GLOBAL_VARIABLES - WHERE (VARIABLE_NAME ='version_compile_os' AND VARIABLE_VALUE LIKE 'Win%' OR - VARIABLE_NAME='have_openssl' AND VARIABLE_VALUE='YES')`) +# GnuTLS does not support --ssl-crlpath +if ($CLIENT_TLS_LIBRARY == "GnuTLS") { - skip Need openssl or Windows; + skip Not supported with the GnuTLS client library; } --echo # Test clients with and without CRL lists diff --git a/vio/viosslfactories.c b/vio/viosslfactories.c index 89a0661d9b149..e0b11494cafe0 100644 --- a/vio/viosslfactories.c +++ b/vio/viosslfactories.c @@ -339,24 +339,18 @@ new_VioSSLFd(const char *key_file, const char *cert_file, if (crl_file || crl_path) { -#ifdef HAVE_WOLFSSL - /* CRL does not work with WolfSSL. */ - DBUG_ASSERT(0); - goto err2; -#else X509_STORE *store= SSL_CTX_get_cert_store(ssl_fd->ssl_context); /* Load crls from the trusted ca */ if (X509_STORE_load_locations(store, crl_file, crl_path) == 0 || X509_STORE_set_flags(store, - X509_V_FLAG_CRL_CHECK | - X509_V_FLAG_CRL_CHECK_ALL) == 0) + X509_V_FLAG_CRL_CHECK | + X509_V_FLAG_CRL_CHECK_ALL) != 1) { DBUG_PRINT("warning", ("X509_STORE_load_locations for CRL failed")); *error= SSL_INITERR_BAD_PATHS; DBUG_PRINT("error", ("%s", sslGetErrString(*error))); goto err2; } -#endif } if (vio_set_cert_stuff(ssl_fd->ssl_context, cert_file, key_file,