diff --git a/include/ssl_compat.h b/include/ssl_compat.h index 6bec4f482855c..b9c62268614c4 100644 --- a/include/ssl_compat.h +++ b/include/ssl_compat.h @@ -24,12 +24,9 @@ #define HAVE_OPENSSL11 1 #define SSL_LIBRARY OpenSSL_version(OPENSSL_VERSION) #define ERR_remove_state(X) ERR_clear_error() -#define EVP_CIPHER_CTX_SIZE 200 #define EVP_MD_CTX_SIZE 80 #undef EVP_MD_CTX_init #define EVP_MD_CTX_init(X) do { memset((X), 0, EVP_MD_CTX_SIZE); EVP_MD_CTX_reset(X); } while(0) -#undef EVP_CIPHER_CTX_init -#define EVP_CIPHER_CTX_init(X) do { memset((X), 0, EVP_CIPHER_CTX_SIZE); EVP_CIPHER_CTX_reset(X); } while(0) /* Macros below are deprecated. OpenSSL 1.1 may define them or not, @@ -83,7 +80,6 @@ #endif #define EVP_CIPHER_CTX_encrypting(ctx) ((ctx)->encrypt) -#define EVP_CIPHER_CTX_SIZE sizeof(EVP_CIPHER_CTX) #ifndef HAVE_WOLFSSL #define OPENSSL_init_ssl(X,Y) SSL_library_init() @@ -97,13 +93,3 @@ #ifndef TLS1_3_VERSION #define SSL_CTX_set_ciphersuites(X,Y) 0 #endif - -#ifdef __cplusplus -extern "C" { -#endif /* __cplusplus */ - -int check_openssl_compatibility(); - -#ifdef __cplusplus -} -#endif diff --git a/mysys_ssl/CMakeLists.txt b/mysys_ssl/CMakeLists.txt index 1c3f60b5bb091..6a9c29449c655 100644 --- a/mysys_ssl/CMakeLists.txt +++ b/mysys_ssl/CMakeLists.txt @@ -28,7 +28,6 @@ SET(MYSYS_SSL_HIDDEN_SOURCES my_sha384.cc my_sha512.cc my_md5.cc - openssl.c ) SET(MYSYS_SSL_SOURCES diff --git a/mysys_ssl/my_crypt.cc b/mysys_ssl/my_crypt.cc index 0356b64ccfb7c..df63f7f94c75b 100644 --- a/mysys_ssl/my_crypt.cc +++ b/mysys_ssl/my_crypt.cc @@ -27,29 +27,18 @@ #include #include -#include - -#define CTX_ALIGN 16 class MyCTX { public: - char ctx_buf[EVP_CIPHER_CTX_SIZE + CTX_ALIGN]; EVP_CIPHER_CTX* ctx; MyCTX() { -#if CTX_ALIGN > 0 - uintptr_t p= ((uintptr_t)ctx_buf + (CTX_ALIGN - 1)) & ~(CTX_ALIGN - 1); - ctx = reinterpret_cast(p); -#else - ctx = (EVP_CIPHER_CTX*)ctx_buf; -#endif - - EVP_CIPHER_CTX_init(ctx); + ctx= EVP_CIPHER_CTX_new(); } virtual ~MyCTX() { - EVP_CIPHER_CTX_reset(ctx); + EVP_CIPHER_CTX_free(ctx); ERR_remove_state(0); } @@ -57,6 +46,8 @@ class MyCTX uint klen, const uchar *iv, uint ivlen) { compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX)); + if (unlikely(!ctx)) + return MY_AES_OPENSSL_ERROR; if (unlikely(!cipher)) return MY_AES_BAD_KEYSIZE; @@ -115,9 +106,11 @@ class MyCTX_nopad : public MyCTX DBUG_ASSERT(ivlen == 0 || ivlen == sizeof(oiv)); int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen); + if (res) + return res; EVP_CIPHER_CTX_set_padding(ctx, 0); - return res; + return MY_AES_OK; } /** Update last partial source block, stored in source_tail array. */ @@ -213,10 +206,12 @@ class MyCTX_gcm : public MyCTX { compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX_gcm)); int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen); + if (res) + return res; int real_ivlen= EVP_CIPHER_CTX_iv_length(ctx); aad= iv + real_ivlen; aadlen= ivlen - real_ivlen; - return res; + return MY_AES_OK; } int update(const uchar *src, uint slen, uchar *dst, uint *dlen) override @@ -298,8 +293,11 @@ int my_aes_crypt_init(void *ctx, enum my_aes_mode mode, int flags, new (ctx) MyCTX_nopad(); else new (ctx) MyCTX(); - return ((MyCTX*)ctx)->init(ciphers[mode](klen), flags & 1, - key, klen, iv, ivlen); + int res= ((MyCTX*)ctx)->init(ciphers[mode](klen), flags & 1, + key, klen, iv, ivlen); + if (res) + ((MyCTX*)ctx)->~MyCTX(); + return res; } int my_aes_crypt_update(void *ctx, const uchar *src, uint slen, diff --git a/mysys_ssl/openssl.c b/mysys_ssl/openssl.c deleted file mode 100644 index 3890e3524bec4..0000000000000 --- a/mysys_ssl/openssl.c +++ /dev/null @@ -1,98 +0,0 @@ -/* - Copyright (c) 2017, MariaDB Corporation. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -#include -#include -#include - -/* - The check is only done for OpenSSL 1.1.x. - It could run for OpenSSL 1.0.x but it doesn't make much sense - and it hits this bug: - https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1594748 -*/ - -#ifndef HAVE_OPENSSL11 -int check_openssl_compatibility() -{ - return 0; -} -#else -#include - -static uint testing; -static size_t alloc_size, alloc_count; - -static void *coc_malloc(size_t size -#ifndef LIBRESSL_VERSION_NUMBER - , const char *f __attribute__((unused)), - int l __attribute__((unused)) -#endif -) -{ - if (unlikely(testing)) - { - alloc_size+= size; - alloc_count++; - } - return malloc(size); -} - -static void *coc_realloc(void *addr, size_t num -#ifndef LIBRESSL_VERSION_NUMBER - , const char *file __attribute__((unused)), - int line __attribute__((unused)) -#endif -) -{ - return realloc(addr, num); -} - -static void coc_free(void *addr -#ifndef LIBRESSL_VERSION_NUMBER - , const char *file __attribute__((unused)), - int line __attribute__((unused)) -#endif -) -{ - free(addr); -} - -int check_openssl_compatibility() -{ - EVP_CIPHER_CTX *evp_ctx; - EVP_MD_CTX *md5_ctx; - - if (!CRYPTO_set_mem_functions(coc_malloc, coc_realloc, coc_free)) - return 0; - - testing= 1; - alloc_size= alloc_count= 0; - evp_ctx= EVP_CIPHER_CTX_new(); - EVP_CIPHER_CTX_free(evp_ctx); - if (alloc_count != 1 || !alloc_size || alloc_size > EVP_CIPHER_CTX_SIZE) - return 1; - - alloc_size= alloc_count= 0; - md5_ctx= EVP_MD_CTX_new(); - EVP_MD_CTX_free(md5_ctx); - if (alloc_count != 1 || !alloc_size || alloc_size > EVP_MD_CTX_SIZE) - return 1; - - testing= 0; - return 0; -} -#endif diff --git a/sql/mysqld.cc b/sql/mysqld.cc index 52938056f0b5d..d9e3cc4b6094b 100644 --- a/sql/mysqld.cc +++ b/sql/mysqld.cc @@ -4089,14 +4089,6 @@ static int init_common_variables() exit(1); } -#ifdef HAVE_OPENSSL - if (check_openssl_compatibility()) - { - sql_print_error("Incompatible OpenSSL version. Cannot continue..."); - exit(1); - } -#endif - if (init_thread_environment() || mysql_init_variables()) exit(1);