Details
-
Bug
-
Status: Open (View Workflow)
-
Blocker
-
Resolution: Unresolved
-
3.4
-
None
Description
An error that doesn't match any error from the list gets MARIADB_TLS_VERIFY_UNKNOWN:
|
openssl.c |
static int ma_verification_callback(int preverify_ok __attribute__((unused)), X509_STORE_CTX *ctx) |
{
|
SSL *ssl;
|
|
|
if ((ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()))) |
{
|
MYSQL *mysql= (MYSQL *)SSL_get_app_data(ssl);
|
int x509_err= X509_STORE_CTX_get_error(ctx); |
my_bool verify_status= MARIADB_TLS_VERIFY_OK;
|
|
|
if ((x509_err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT || |
x509_err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN))
|
verify_status= MARIADB_TLS_VERIFY_TRUST;
|
else if (x509_err == X509_V_ERR_CERT_REVOKED) |
verify_status= MARIADB_TLS_VERIFY_REVOKED;
|
else if (x509_err == X509_V_ERR_CERT_NOT_YET_VALID || |
x509_err == X509_V_ERR_CERT_HAS_EXPIRED)
|
verify_status= MARIADB_TLS_VERIFY_PERIOD;
|
else if (x509_err != X509_V_OK) |
verify_status= MARIADB_TLS_VERIFY_UNKNOWN;
|
For example, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY is not listed above, so it's MARIADB_TLS_VERIFY_UNKNOWN. And later
int ma_tls_verify_server_cert(MARIADB_TLS *ctls, unsigned int verify_flags) |
{
|
...
|
if ((mysql->net.tls_verify_status > MARIADB_TLS_VERIFY_FINGERPRINT) || |
(mysql->net.tls_verify_status & verify_flags))
|
{
|
return MARIADB_TLS_VERIFY_ERROR; |
}
|
which is used as
|
ma_tls.c |
int ma_pvio_tls_verify_server_cert(MARIADB_TLS *ctls, unsigned int flags) |
{
|
...
|
rc= ma_tls_verify_server_cert(ctls, flags);
|
...
|
mysql->extension->tls_validation= mysql->net.tls_verify_status;
|
mysql->net.tls_verify_status&= flags;
|
return rc; |
}
|
flags is something real, e.g. MARIADB_TLS_VERIFY_PERIOD|MARIADB_TLS_VERIFY_HOST|MARIADB_TLS_VERIFY_TRUST (=11). While tls_verify_status == MARIADB_TLS_VERIFY_UNKNOWN (=32). After &= the status becomes 0, which is MARIADB_TLS_VERIFY_OK, oops.
Reported by: Timo Sirainen