| Server IP : 112.74.42.100 / Your IP : 216.73.216.142 Web Server : nginx/1.20.2 System : Linux iZwz96lx4pjqiy84w4hni7Z 5.10.134-17.3.al8.x86_64 #1 SMP Thu Oct 31 14:29:57 CST 2024 x86_64 User : www ( 1000) PHP Version : 8.0.26 Disable Function : passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /www/server/mysql/mysql-test/include/ |
Upload File : |
## Script test_ssl_verify_identity.inc # # === Purpose === # This test verifies that while verifying the server certificates # when ssl-mode=VERIFY_IDENTITY, the DNS/IPs provided in the Subject # Alternative Names (which can be provided as an extension in X509) # fields are also checked for apart from the Common Name in the subject. # Applicable for openssl versions 1.0.2 and greater. # # $param_test_exe - # defines the application which should run the test, # the application must be $MYSQL command line compatible # # # $param_cipher_variable - # defines the name of variable which values is going to be # checked for SSL cipher used be current test connection # # $param_verify_identity_error - # set expected error in case of invalid hostname # ## Usage # # --let $param_test_exe = $MYSQL|$MYSQLXTEST # --let $param_cipher_variable = Ssl_cipher # --let $param_verify_identity_error = some string... # --source include/test_ssl_verify_identity.inc # # === Related bugs and/or worklogs === # Bug #16211011 - SSL CERTIFICATE SUBJECT ALT NAMES WITH IPS NOT RESPECTED WITH ssl-mode=VERIFY_IDENTITY # Bug #29691694 - LIBMYSQLXCLIENT --SSL-MODE=VERIFY_IDENTITY DOESN'T USE SUBJECT ALT NAMES # # Note that these test cases are written keeping in mind that the openssl version used by the system will # be 1.0.2+. For older versions of openssl, the test will be skipped. --source include/have_openssl_binary.inc --source include/check_openssl_version.inc --echo ### Trying to connect with ssl-mode as DISABLED. This should establish an unencrypted connection. exec $param_test_exe --ssl-mode=DISABLED --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo ### Trying to connect with ssl-mode as REQUIRED. This should establish an encrypted connection. --replace_regex $ALLOWED_CIPHERS_REGEX exec $param_test_exe --ssl-mode=REQUIRED --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo ### Trying to connect with ssl-mode as VERIFY_CA. This should establish an encrypted connection. --replace_regex $ALLOWED_CIPHERS_REGEX exec $param_test_exe --ssl-mode=VERIFY_CA --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo ### Trying to connect with ssl-mode as VERIFY_IDENTITY. This should establish an encrypted connection. --replace_regex $ALLOWED_CIPHERS_REGEX exec $param_test_exe --ssl-mode=VERIFY_IDENTITY --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo ### Trying to connect with ssl-mode as VERIFY_IDENTITY and hostname as nonexistent. This should fail. --error 1 exec $param_test_exe --host=nonexistent --ssl-mode=VERIFY_IDENTITY --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; let SEARCH_FILE= $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo #Search for the error in the file let SEARCH_PATTERN=$param_verify_identity_error; source include/search_pattern.inc; --echo ### Trying to connect with ssl-mode as VERIFY_IDENTITY and hostname as localhost. This should establish an encrypted connection as localhost is present in Alternative Subject Name in the certificate. --replace_regex $ALLOWED_CIPHERS_REGEX exec $param_test_exe --host=localhost --ssl-mode=VERIFY_IDENTITY --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; --echo ### Trying to connect with ssl-mode as VERIFY_IDENTITY and hostname as 127.0.0.1. This should establish an encrypted connection as localhost is present in Alternative Subject Name in the certificate. --replace_regex $ALLOWED_CIPHERS_REGEX --exec $param_test_exe--host=127.0.0.1 --ssl-mode=VERIFY_IDENTITY --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify-san.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert-verify-san.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-verify-san.pem -e "SHOW STATUS LIKE '$param_cipher_variable'" test 2> $MYSQLTEST_VARDIR/tmp/bug24732452_stderr cat_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr; #Cleanup --remove_file $MYSQLTEST_VARDIR/tmp/bug24732452_stderr