1 |
commit: c82b072c1bedd43a42f3eb9b0e214dff66d8faab |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Oct 30 23:49:16 2019 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Oct 30 23:49:16 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/mysql-extras.git/commit/?id=c82b072c |
7 |
|
8 |
Add 20018_all_percona-server-8.0.17-fix-libressl-support.patch |
9 |
|
10 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
11 |
|
12 |
...ercona-server-8.0.17-fix-libressl-support.patch | 230 +++++++++++++++++++++ |
13 |
1 file changed, 230 insertions(+) |
14 |
|
15 |
diff --git a/20018_all_percona-server-8.0.17-fix-libressl-support.patch b/20018_all_percona-server-8.0.17-fix-libressl-support.patch |
16 |
new file mode 100644 |
17 |
index 0000000..29f2a0e |
18 |
--- /dev/null |
19 |
+++ b/20018_all_percona-server-8.0.17-fix-libressl-support.patch |
20 |
@@ -0,0 +1,230 @@ |
21 |
+--- a/cmake/ssl.cmake |
22 |
++++ b/cmake/ssl.cmake |
23 |
+@@ -304,7 +304,8 @@ MACRO (MYSQL_CHECK_SSL) |
24 |
+ OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}" |
25 |
+ ) |
26 |
+ ENDIF() |
27 |
+- IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0") |
28 |
++ CHECK_SYMBOL_EXISTS(TLS1_3_VERSION "openssl/tls1.h" HAVE_TLS1_3_VERSION) |
29 |
++ IF(HAVE_TLS1_3_VERSION) |
30 |
+ ADD_DEFINITIONS(-DHAVE_TLSv13) |
31 |
+ ENDIF() |
32 |
+ IF(OPENSSL_INCLUDE_DIR AND |
33 |
+--- a/extra/libevent/openssl-compat.h |
34 |
++++ b/extra/libevent/openssl-compat.h |
35 |
+@@ -24,7 +24,6 @@ static inline BIO_METHOD *BIO_meth_new(int type, const char *name) |
36 |
+ #define BIO_set_init(b, val) (b)->init = (val) |
37 |
+ #define BIO_set_data(b, val) (b)->ptr = (val) |
38 |
+ #define BIO_set_shutdown(b, val) (b)->shutdown = (val) |
39 |
+-#define BIO_get_init(b) (b)->init |
40 |
+ #define BIO_get_data(b) (b)->ptr |
41 |
+ #define BIO_get_shutdown(b) (b)->shutdown |
42 |
+ |
43 |
+@@ -32,4 +31,8 @@ static inline BIO_METHOD *BIO_meth_new(int type, const char *name) |
44 |
+ |
45 |
+ #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ |
46 |
+ |
47 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
48 |
++#define BIO_get_init(b) (b)->init |
49 |
++#endif |
50 |
++ |
51 |
+ #endif /* OPENSSL_COMPAT_H */ |
52 |
+--- a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c |
53 |
++++ b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c |
54 |
+@@ -297,7 +297,7 @@ error: |
55 |
+ return 1; |
56 |
+ } |
57 |
+ |
58 |
+-#ifndef HAVE_WOLFSSL |
59 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
60 |
+ #define OPENSSL_ERROR_LENGTH 512 |
61 |
+ static int configure_ssl_fips_mode(const uint fips_mode) { |
62 |
+ int rc = -1; |
63 |
+@@ -521,7 +521,7 @@ int xcom_init_ssl(const char *server_key_file, const char *server_cert_file, |
64 |
+ int verify_server = SSL_VERIFY_NONE; |
65 |
+ int verify_client = SSL_VERIFY_NONE; |
66 |
+ |
67 |
+-#ifndef HAVE_WOLFSSL |
68 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
69 |
+ if (configure_ssl_fips_mode(ssl_fips_mode) != 1) { |
70 |
+ G_ERROR("Error setting the ssl fips mode"); |
71 |
+ goto error; |
72 |
+--- a/plugin/x/client/xconnection_impl.cc |
73 |
++++ b/plugin/x/client/xconnection_impl.cc |
74 |
+@@ -523,7 +523,7 @@ XError Connection_impl::get_ssl_error(const int error_id) { |
75 |
+ return XError(CR_SSL_CONNECTION_ERROR, buffer); |
76 |
+ } |
77 |
+ |
78 |
+-#ifndef HAVE_WOLFSSL |
79 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
80 |
+ /** |
81 |
+ Set fips mode in openssl library, |
82 |
+ When we set fips mode ON/STRICT, it will perform following operations: |
83 |
+@@ -573,7 +573,7 @@ XError Connection_impl::activate_tls() { |
84 |
+ if (!m_context->m_ssl_config.is_configured()) |
85 |
+ return XError{CR_SSL_CONNECTION_ERROR, ER_TEXT_TLS_NOT_CONFIGURATED}; |
86 |
+ |
87 |
+-#ifndef HAVE_WOLFSSL |
88 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
89 |
+ char err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
90 |
+ if (set_fips_mode((int)m_context->m_ssl_config.m_ssl_fips_mode, err_string) != |
91 |
+ 1) { |
92 |
+--- a/router/src/http/src/tls_client_context.cc |
93 |
++++ b/router/src/http/src/tls_client_context.cc |
94 |
+@@ -54,7 +54,7 @@ void TlsClientContext::verify(TlsVerify verify) { |
95 |
+ |
96 |
+ void TlsClientContext::cipher_suites(const std::string &ciphers) { |
97 |
+ // TLSv1.3 ciphers are controlled via SSL_CTX_set_ciphersuites() |
98 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1) |
99 |
++#ifdef TLS1_3_VERSION |
100 |
+ if (1 != SSL_CTX_set_ciphersuites(ssl_ctx_.get(), ciphers.c_str())) { |
101 |
+ throw TlsError("set-cipher-suites"); |
102 |
+ } |
103 |
+--- a/router/src/http/src/tls_context.cc |
104 |
++++ b/router/src/http/src/tls_context.cc |
105 |
+@@ -93,7 +93,7 @@ static constexpr int o11x_version(TlsVersion version) { |
106 |
+ return TLS1_1_VERSION; |
107 |
+ case TlsVersion::TLS_1_2: |
108 |
+ return TLS1_2_VERSION; |
109 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1) |
110 |
++#ifdef TLS1_3_VERSION |
111 |
+ case TlsVersion::TLS_1_3: |
112 |
+ return TLS1_3_VERSION; |
113 |
+ #endif |
114 |
+@@ -123,9 +123,11 @@ void TlsContext::version_range(TlsVersion min_version, TlsVersion max_version) { |
115 |
+ default: |
116 |
+ // unknown, leave all disabled |
117 |
+ // fallthrough |
118 |
++#ifdef TLS1_3_VERSION |
119 |
+ case TlsVersion::TLS_1_3: |
120 |
+ opts |= SSL_OP_NO_TLSv1_2; |
121 |
+ // fallthrough |
122 |
++#endif |
123 |
+ case TlsVersion::TLS_1_2: |
124 |
+ opts |= SSL_OP_NO_TLSv1_1; |
125 |
+ // fallthrough |
126 |
+@@ -172,8 +174,10 @@ TlsVersion TlsContext::min_version() const { |
127 |
+ return TlsVersion::TLS_1_1; |
128 |
+ case TLS1_2_VERSION: |
129 |
+ return TlsVersion::TLS_1_2; |
130 |
++#ifdef TLS1_3_VERSION |
131 |
+ case TLS1_3_VERSION: |
132 |
+ return TlsVersion::TLS_1_3; |
133 |
++#endif |
134 |
+ case 0: |
135 |
+ return TlsVersion::AUTO; |
136 |
+ default: |
137 |
+--- a/router/src/http/src/tls_server_context.cc |
138 |
++++ b/router/src/http/src/tls_server_context.cc |
139 |
+@@ -170,7 +170,8 @@ void TlsServerContext::init_tmp_dh(const std::string &dh_params) { |
140 |
+ } |
141 |
+ |
142 |
+ } else { |
143 |
+-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) |
144 |
++#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \ |
145 |
++ !defined(LIBRESSL_VERSION_NUMBER) |
146 |
+ dh2048.reset(DH_get_2048_256()); |
147 |
+ #else |
148 |
+ /* |
149 |
+--- a/sql-common/client.cc |
150 |
++++ b/sql-common/client.cc |
151 |
+@@ -7768,7 +7768,8 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option, |
152 |
+ #endif |
153 |
+ break; |
154 |
+ case MYSQL_OPT_SSL_FIPS_MODE: { |
155 |
+-#if defined(HAVE_OPENSSL) && !defined(HAVE_WOLFSSL) |
156 |
++#if defined(HAVE_OPENSSL) && \ |
157 |
++ !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
158 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
159 |
+ ENSURE_EXTENSIONS_PRESENT(&mysql->options); |
160 |
+ mysql->options.extension->ssl_fips_mode = *static_cast<const uint *>(arg); |
161 |
+--- a/sql/mysqld.cc |
162 |
++++ b/sql/mysqld.cc |
163 |
+@@ -5044,7 +5044,7 @@ static int init_thread_environment() { |
164 |
+ |
165 |
+ static PSI_memory_key key_memory_openssl = PSI_NOT_INSTRUMENTED; |
166 |
+ |
167 |
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L |
168 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
169 |
+ #define FILE_LINE_ARGS |
170 |
+ #else |
171 |
+ #define FILE_LINE_ARGS , const char *, int |
172 |
+@@ -5080,7 +5080,7 @@ static void init_ssl() { |
173 |
+ } |
174 |
+ |
175 |
+ static int init_ssl_communication() { |
176 |
+-#ifndef HAVE_WOLFSSL |
177 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
178 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
179 |
+ int ret_fips_mode = set_fips_mode(opt_ssl_fips_mode, ssl_err_string); |
180 |
+ if (ret_fips_mode != 1) { |
181 |
+--- a/sql/sys_vars.cc |
182 |
++++ b/sql/sys_vars.cc |
183 |
+@@ -4500,7 +4500,7 @@ static Sys_var_ulong Sys_max_execution_time( |
184 |
+ HINT_UPDATEABLE SESSION_VAR(max_execution_time), CMD_LINE(REQUIRED_ARG), |
185 |
+ VALID_RANGE(0, ULONG_MAX), DEFAULT(0), BLOCK_SIZE(1)); |
186 |
+ |
187 |
+-#ifndef HAVE_WOLFSSL |
188 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
189 |
+ static bool update_fips_mode(sys_var *, THD *, enum_var_type) { |
190 |
+ char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'}; |
191 |
+ if (set_fips_mode(opt_ssl_fips_mode, ssl_err_string) != 1) { |
192 |
+@@ -4513,7 +4513,7 @@ static bool update_fips_mode(sys_var *, THD *, enum_var_type) { |
193 |
+ } |
194 |
+ #endif |
195 |
+ |
196 |
+-#ifdef HAVE_WOLFSSL |
197 |
++#if defined(HAVE_WOLFSSL) || defined(LIBRESSL_VERSION_NUMBER) |
198 |
+ static const char *ssl_fips_mode_names[] = {"OFF", 0}; |
199 |
+ #else |
200 |
+ static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", 0}; |
201 |
+@@ -4521,7 +4521,7 @@ static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", 0}; |
202 |
+ static Sys_var_enum Sys_ssl_fips_mode( |
203 |
+ "ssl_fips_mode", |
204 |
+ "SSL FIPS mode (applies only for OpenSSL); " |
205 |
+-#ifndef HAVE_WOLFSSL |
206 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
207 |
+ "permitted values are: OFF, ON, STRICT", |
208 |
+ #else |
209 |
+ "permitted values are: OFF", |
210 |
+@@ -4529,7 +4529,7 @@ static Sys_var_enum Sys_ssl_fips_mode( |
211 |
+ GLOBAL_VAR(opt_ssl_fips_mode), CMD_LINE(REQUIRED_ARG, OPT_SSL_FIPS_MODE), |
212 |
+ ssl_fips_mode_names, DEFAULT(0), NO_MUTEX_GUARD, NOT_IN_BINLOG, |
213 |
+ ON_CHECK(NULL), |
214 |
+-#ifndef HAVE_WOLFSSL |
215 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
216 |
+ ON_UPDATE(update_fips_mode), |
217 |
+ #else |
218 |
+ ON_UPDATE(NULL), |
219 |
+--- a/vio/viossl.cc |
220 |
++++ b/vio/viossl.cc |
221 |
+@@ -507,7 +507,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout, |
222 |
+ #if !defined(HAVE_WOLFSSL) && !defined(DBUG_OFF) |
223 |
+ { |
224 |
+ STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; |
225 |
+- ssl_comp_methods = SSL_COMP_get_compression_methods(); |
226 |
++ ssl_comp_methods = (STACK_OF(SSL_COMP) *)SSL_COMP_get_compression_methods(); |
227 |
+ n = sk_SSL_COMP_num(ssl_comp_methods); |
228 |
+ DBUG_PRINT("info", ("Available compression methods:\n")); |
229 |
+ if (n == 0) |
230 |
+@@ -515,7 +515,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout, |
231 |
+ else |
232 |
+ for (j = 0; j < n; j++) { |
233 |
+ SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j); |
234 |
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L |
235 |
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
236 |
+ DBUG_PRINT("info", (" %d: %s\n", c->id, c->name)); |
237 |
+ #else /* OPENSSL_VERSION_NUMBER < 0x10100000L */ |
238 |
+ DBUG_PRINT("info", |
239 |
+--- a/vio/viosslfactories.cc |
240 |
++++ b/vio/viosslfactories.cc |
241 |
+@@ -429,7 +429,7 @@ void ssl_start() { |
242 |
+ } |
243 |
+ } |
244 |
+ |
245 |
+-#ifndef HAVE_WOLFSSL |
246 |
++#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER) |
247 |
+ /** |
248 |
+ Set fips mode in openssl library, |
249 |
+ When we set fips mode ON/STRICT, it will perform following operations: |
250 |
+ |