1 |
commit: a1ff5a288f718b3b1035c5139f677a3a7371bcc5 |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Jan 20 18:19:09 2020 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Jan 20 18:19:09 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/mysql-extras.git/commit/?id=a1ff5a28 |
7 |
|
8 |
Add 20018_all_mysql-8.0.19-fix-libressl-support.patch |
9 |
|
10 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
11 |
|
12 |
20018_all_mysql-8.0.19-fix-libressl-support.patch | 297 ++++++++++++++++++++++ |
13 |
1 file changed, 297 insertions(+) |
14 |
|
15 |
diff --git a/20018_all_mysql-8.0.19-fix-libressl-support.patch b/20018_all_mysql-8.0.19-fix-libressl-support.patch |
16 |
new file mode 100644 |
17 |
index 0000000..1fc949a |
18 |
--- /dev/null |
19 |
+++ b/20018_all_mysql-8.0.19-fix-libressl-support.patch |
20 |
@@ -0,0 +1,297 @@ |
21 |
+--- a/cmake/ssl.cmake |
22 |
++++ b/cmake/ssl.cmake |
23 |
+@@ -229,13 +229,14 @@ MACRO (MYSQL_CHECK_SSL) |
24 |
+ OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}" |
25 |
+ ) |
26 |
+ ENDIF() |
27 |
+- IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0") |
28 |
++ CHECK_SYMBOL_EXISTS(TLS1_3_VERSION "openssl/tls1.h" HAVE_TLS1_3_VERSION) |
29 |
++ IF(HAVE_TLS1_3_VERSION) |
30 |
+ ADD_DEFINITIONS(-DHAVE_TLSv13) |
31 |
+ ENDIF() |
32 |
+ IF(OPENSSL_INCLUDE_DIR AND |
33 |
+ OPENSSL_LIBRARY AND |
34 |
+ CRYPTO_LIBRARY AND |
35 |
+- OPENSSL_MAJOR_VERSION STREQUAL "1" |
36 |
++ OPENSSL_MAJOR_VERSION VERSION_GREATER_EQUAL "1" |
37 |
+ ) |
38 |
+ SET(OPENSSL_FOUND TRUE) |
39 |
+ FIND_PROGRAM(OPENSSL_EXECUTABLE openssl |
40 |
+--- a/mysys/my_md5.cc |
41 |
++++ b/mysys/my_md5.cc |
42 |
+@@ -56,7 +56,9 @@ static void my_md5_hash(unsigned char *digest, unsigned const char *buf, |
43 |
+ int compute_md5_hash(char *digest, const char *buf, int len) { |
44 |
+ int retval = 0; |
45 |
+ int fips_mode = 0; |
46 |
++#ifndef LIBRESSL_VERSION_NUMBER |
47 |
+ fips_mode = FIPS_mode(); |
48 |
++#endif |
49 |
+ /* If fips mode is ON/STRICT restricted method calls will result into abort, |
50 |
+ * skipping call. */ |
51 |
+ if (fips_mode == 0) { |
52 |
+--- a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c |
53 |
++++ b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c |
54 |
+@@ -329,6 +329,7 @@ error: |
55 |
+ return 1; |
56 |
+ } |
57 |
+ |
58 |
++#ifndef LIBRESSL_VERSION_NUMBER |
59 |
+ #define OPENSSL_ERROR_LENGTH 512 |
60 |
+ static int configure_ssl_fips_mode(const uint fips_mode) { |
61 |
+ int rc = -1; |
62 |
+@@ -352,6 +353,7 @@ static int configure_ssl_fips_mode(const uint fips_mode) { |
63 |
+ EXIT: |
64 |
+ return rc; |
65 |
+ } |
66 |
++#endif |
67 |
+ |
68 |
+ static int configure_ssl_ca(SSL_CTX *ssl_ctx, const char *ca_file, |
69 |
+ const char *ca_path) { |
70 |
+@@ -555,10 +557,12 @@ int xcom_init_ssl(const char *server_key_file, const char *server_cert_file, |
71 |
+ int verify_server = SSL_VERIFY_NONE; |
72 |
+ int verify_client = SSL_VERIFY_NONE; |
73 |
+ |
74 |
++#ifndef LIBRESSL_VERSION_NUMBER |
75 |
+ if (configure_ssl_fips_mode(ssl_fips_mode) != 1) { |
76 |
+ G_ERROR("Error setting the ssl fips mode"); |
77 |
+ goto error; |
78 |
+ } |
79 |
++#endif |
80 |
+ |
81 |
+ SSL_library_init(); |
82 |
+ SSL_load_error_strings(); |
83 |
+@@ -622,7 +626,7 @@ error: |
84 |
+ void xcom_cleanup_ssl() { |
85 |
+ if (!xcom_use_ssl()) return; |
86 |
+ |
87 |
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L |
88 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
89 |
+ ERR_remove_thread_state(0); |
90 |
+ #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ |
91 |
+ } |
92 |
+--- a/plugin/x/client/xconnection_impl.cc |
93 |
++++ b/plugin/x/client/xconnection_impl.cc |
94 |
+@@ -520,6 +520,7 @@ XError Connection_impl::get_ssl_error(const int error_id) { |
95 |
+ return XError(CR_SSL_CONNECTION_ERROR, buffer); |
96 |
+ } |
97 |
+ |
98 |
++#ifndef LIBRESSL_VERSION_NUMBER |
99 |
+ /** |
100 |
+ Set fips mode in openssl library, |
101 |
+ When we set fips mode ON/STRICT, it will perform following operations: |
102 |
+@@ -559,6 +560,7 @@ int set_fips_mode(const uint32_t fips_mode, |
103 |
+ EXIT: |
104 |
+ return rc; |
105 |
+ } |
106 |
++#endif |
107 |
+ |
108 |
+ XError Connection_impl::activate_tls() { |
109 |
+ if (nullptr == m_vio) return get_socket_error(SOCKET_ECONNRESET); |
110 |
+@@ -569,12 +571,14 @@ XError Connection_impl::activate_tls() { |
111 |
+ if (!m_context->m_ssl_config.is_configured()) |
112 |
+ return XError{CR_SSL_CONNECTION_ERROR, ER_TEXT_TLS_NOT_CONFIGURATED, true}; |
113 |
+ |
114 |
++#ifndef LIBRESSL_VERSION_NUMBER |
115 |
+ char err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
116 |
+ if (set_fips_mode( |
117 |
+ static_cast<uint32_t>(m_context->m_ssl_config.m_ssl_fips_mode), |
118 |
+ err_string) != 1) { |
119 |
+ return XError{CR_SSL_CONNECTION_ERROR, err_string, true}; |
120 |
+ } |
121 |
++#endif |
122 |
+ auto ssl_ctx_flags = process_tls_version( |
123 |
+ details::null_when_empty(m_context->m_ssl_config.m_tls_version)); |
124 |
+ |
125 |
+--- a/router/src/http/src/tls_client_context.cc |
126 |
++++ b/router/src/http/src/tls_client_context.cc |
127 |
+@@ -54,7 +54,7 @@ void TlsClientContext::verify(TlsVerify verify) { |
128 |
+ |
129 |
+ void TlsClientContext::cipher_suites(const std::string &ciphers) { |
130 |
+ // TLSv1.3 ciphers are controlled via SSL_CTX_set_ciphersuites() |
131 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1) |
132 |
++#ifdef TLS1_3_VERSION |
133 |
+ if (1 != SSL_CTX_set_ciphersuites(ssl_ctx_.get(), ciphers.c_str())) { |
134 |
+ throw TlsError("set-cipher-suites"); |
135 |
+ } |
136 |
+--- a/router/src/http/src/tls_context.cc |
137 |
++++ b/router/src/http/src/tls_context.cc |
138 |
+@@ -91,7 +91,7 @@ static int o11x_version(TlsVersion version) { |
139 |
+ return TLS1_1_VERSION; |
140 |
+ case TlsVersion::TLS_1_2: |
141 |
+ return TLS1_2_VERSION; |
142 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1) |
143 |
++#ifdef TLS1_3_VERSION |
144 |
+ case TlsVersion::TLS_1_3: |
145 |
+ return TLS1_3_VERSION; |
146 |
+ #endif |
147 |
+@@ -120,9 +120,11 @@ void TlsContext::version_range(TlsVersion min_version, TlsVersion max_version) { |
148 |
+ switch (min_version) { |
149 |
+ default: |
150 |
+ // unknown, leave all disabled |
151 |
++#ifdef TLS1_3_VERSION |
152 |
+ // fallthrough |
153 |
+ case TlsVersion::TLS_1_3: |
154 |
+ opts |= SSL_OP_NO_TLSv1_2; |
155 |
++#endif |
156 |
+ // fallthrough |
157 |
+ case TlsVersion::TLS_1_2: |
158 |
+ opts |= SSL_OP_NO_TLSv1_1; |
159 |
+@@ -170,8 +172,10 @@ TlsVersion TlsContext::min_version() const { |
160 |
+ return TlsVersion::TLS_1_1; |
161 |
+ case TLS1_2_VERSION: |
162 |
+ return TlsVersion::TLS_1_2; |
163 |
++#ifdef TLS1_3_VERSION |
164 |
+ case TLS1_3_VERSION: |
165 |
+ return TlsVersion::TLS_1_3; |
166 |
++#endif |
167 |
+ case 0: |
168 |
+ return TlsVersion::AUTO; |
169 |
+ default: |
170 |
+@@ -230,7 +234,8 @@ TlsContext::InfoCallback TlsContext::info_callback() const { |
171 |
+ } |
172 |
+ |
173 |
+ int TlsContext::security_level() const { |
174 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) |
175 |
++#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \ |
176 |
++ !defined(LIBRESSL_VERSION_NUMBER) |
177 |
+ return SSL_CTX_get_security_level(ssl_ctx_.get()); |
178 |
+ #else |
179 |
+ return 0; |
180 |
+--- a/router/src/http/src/tls_server_context.cc |
181 |
++++ b/router/src/http/src/tls_server_context.cc |
182 |
+@@ -166,7 +166,8 @@ void TlsServerContext::init_tmp_dh(const std::string &dh_params) { |
183 |
+ } |
184 |
+ |
185 |
+ } else { |
186 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) |
187 |
++#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \ |
188 |
++ !defined(LIBRESSL_VERSION_NUMBER) |
189 |
+ dh2048.reset(DH_get_2048_256()); |
190 |
+ #else |
191 |
+ /* |
192 |
+--- a/sql-common/client.cc |
193 |
++++ b/sql-common/client.cc |
194 |
+@@ -7730,7 +7730,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option, |
195 |
+ #endif |
196 |
+ break; |
197 |
+ case MYSQL_OPT_SSL_FIPS_MODE: { |
198 |
+-#if defined(HAVE_OPENSSL) |
199 |
++#if defined(HAVE_OPENSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
200 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
201 |
+ ENSURE_EXTENSIONS_PRESENT(&mysql->options); |
202 |
+ mysql->options.extension->ssl_fips_mode = *static_cast<const uint *>(arg); |
203 |
+--- a/sql/mysqld.cc |
204 |
++++ b/sql/mysqld.cc |
205 |
+@@ -4818,7 +4818,7 @@ static int init_thread_environment() { |
206 |
+ |
207 |
+ static PSI_memory_key key_memory_openssl = PSI_NOT_INSTRUMENTED; |
208 |
+ |
209 |
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L |
210 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
211 |
+ #define FILE_LINE_ARGS |
212 |
+ #else |
213 |
+ #define FILE_LINE_ARGS , const char *, int |
214 |
+@@ -4854,12 +4854,14 @@ static void init_ssl() { |
215 |
+ } |
216 |
+ |
217 |
+ static int init_ssl_communication() { |
218 |
++#ifndef LIBRESSL_VERSION_NUMBER |
219 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
220 |
+ int ret_fips_mode = set_fips_mode(opt_ssl_fips_mode, ssl_err_string); |
221 |
+ if (ret_fips_mode != 1) { |
222 |
+ LogErr(ERROR_LEVEL, ER_SSL_FIPS_MODE_ERROR, ssl_err_string); |
223 |
+ return 1; |
224 |
+ } |
225 |
++#endif |
226 |
+ if (SslAcceptorContext::singleton_init(opt_use_ssl)) return 1; |
227 |
+ |
228 |
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L |
229 |
+--- a/sql/sys_vars.cc |
230 |
++++ b/sql/sys_vars.cc |
231 |
+@@ -4417,6 +4417,7 @@ static Sys_var_ulong Sys_max_execution_time( |
232 |
+ HINT_UPDATEABLE SESSION_VAR(max_execution_time), CMD_LINE(REQUIRED_ARG), |
233 |
+ VALID_RANGE(0, ULONG_MAX), DEFAULT(0), BLOCK_SIZE(1)); |
234 |
+ |
235 |
++#ifndef LIBRESSL_VERSION_NUMBER |
236 |
+ static bool update_fips_mode(sys_var *, THD *, enum_var_type) { |
237 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
238 |
+ if (set_fips_mode(opt_ssl_fips_mode, ssl_err_string) != 1) { |
239 |
+@@ -4427,15 +4428,30 @@ static bool update_fips_mode(sys_var *, THD *, enum_var_type) { |
240 |
+ return false; |
241 |
+ } |
242 |
+ } |
243 |
++#endif |
244 |
+ |
245 |
++#if defined(LIBRESSL_VERSION_NUMBER) |
246 |
++static const char *ssl_fips_mode_names[] = {"OFF", 0}; |
247 |
++#else |
248 |
+ static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", 0}; |
249 |
++#endif |
250 |
+ static Sys_var_enum Sys_ssl_fips_mode( |
251 |
+ "ssl_fips_mode", |
252 |
+ "SSL FIPS mode (applies only for OpenSSL); " |
253 |
++#ifndef LIBRESSL_VERSION_NUMBER |
254 |
+ "permitted values are: OFF, ON, STRICT", |
255 |
++#else |
256 |
++ "permitted values are: OFF", |
257 |
++#endif |
258 |
+ GLOBAL_VAR(opt_ssl_fips_mode), CMD_LINE(REQUIRED_ARG, OPT_SSL_FIPS_MODE), |
259 |
+ ssl_fips_mode_names, DEFAULT(0), NO_MUTEX_GUARD, NOT_IN_BINLOG, |
260 |
+- ON_CHECK(NULL), ON_UPDATE(update_fips_mode), NULL); |
261 |
++ ON_CHECK(NULL), |
262 |
++#ifndef LIBRESSL_VERSION_NUMBER |
263 |
++ ON_UPDATE(update_fips_mode), |
264 |
++#else |
265 |
++ ON_UPDATE(NULL), |
266 |
++#endif |
267 |
++ NULL); |
268 |
+ |
269 |
+ #if defined(HAVE_OPENSSL) |
270 |
+ static Sys_var_bool Sys_auto_generate_certs( |
271 |
+--- a/vio/viossl.cc |
272 |
++++ b/vio/viossl.cc |
273 |
+@@ -45,7 +45,7 @@ |
274 |
+ BIO_set_callback_ex was added in openSSL 1.1.1 |
275 |
+ For older openSSL, use the deprecated BIO_set_callback. |
276 |
+ */ |
277 |
+-#if OPENSSL_VERSION_NUMBER >= 0x10101000L |
278 |
++#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) |
279 |
+ #define HAVE_BIO_SET_CALLBACK_EX |
280 |
+ #endif |
281 |
+ |
282 |
+@@ -637,7 +637,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout, |
283 |
+ #if !defined(DBUG_OFF) |
284 |
+ { |
285 |
+ STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; |
286 |
+- ssl_comp_methods = SSL_COMP_get_compression_methods(); |
287 |
++ ssl_comp_methods = (STACK_OF(SSL_COMP) *)SSL_COMP_get_compression_methods(); |
288 |
+ n = sk_SSL_COMP_num(ssl_comp_methods); |
289 |
+ DBUG_PRINT("info", ("Available compression methods:\n")); |
290 |
+ if (n == 0) |
291 |
+@@ -645,7 +645,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout, |
292 |
+ else |
293 |
+ for (j = 0; j < n; j++) { |
294 |
+ SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j); |
295 |
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L |
296 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
297 |
+ DBUG_PRINT("info", (" %d: %s\n", c->id, c->name)); |
298 |
+ #else /* OPENSSL_VERSION_NUMBER < 0x10100000L */ |
299 |
+ DBUG_PRINT("info", |
300 |
+--- a/vio/viosslfactories.cc |
301 |
++++ b/vio/viosslfactories.cc |
302 |
+@@ -420,6 +420,7 @@ void ssl_start() { |
303 |
+ } |
304 |
+ } |
305 |
+ |
306 |
++#ifndef LIBRESSL_VERSION_NUMBER |
307 |
+ /** |
308 |
+ Set fips mode in openssl library, |
309 |
+ When we set fips mode ON/STRICT, it will perform following operations: |
310 |
+@@ -473,6 +474,7 @@ EXIT: |
311 |
+ @returns openssl current fips mode |
312 |
+ */ |
313 |
+ uint get_fips_mode() { return FIPS_mode(); } |
314 |
++#endif |
315 |
+ |
316 |
+ long process_tls_version(const char *tls_version) { |
317 |
+ const char *separator = ","; |