9d8b442
Some test items assume the default SSL cipher is DHE-RSA-AES256-SHA,
7a5573f
which is no longer the case as of openssl 1.0.1.
9d8b442
This patch enhances connect command by an option to specify a cipher
7a5573f
and tests are adjusted to specify the expected cipher explicitly.
7a5573f
Upstream bug report: http://bugs.mysql.com/bug.php?id=64461
7a5573f
9d8b442
diff --git a/client/mysqltest.cc b/client/mysqltest.cc
Bjorn Munch fbe934c
index 2def9bd..128dc00 100644
9d8b442
--- a/client/mysqltest.cc
9d8b442
+++ b/client/mysqltest.cc
Bjorn Munch fbe934c
@@ -5503,6 +5503,7 @@ void do_connect(struct st_command *command)
7a5573f
   my_bool con_pipe= 0, con_shm= 0, con_cleartext_enable= 0;
9d8b442
   my_bool con_secure_auth= 1;
7a5573f
   struct st_connection* con_slot;
7a5573f
+  char *con_cipher=NULL;
7a5573f
 
7a5573f
   static DYNAMIC_STRING ds_connection_name;
7a5573f
   static DYNAMIC_STRING ds_host;
Bjorn Munch fbe934c
@@ -5595,6 +5596,8 @@ void do_connect(struct st_command *command)
7a5573f
       con_cleartext_enable= 1;
9d8b442
     else if (!strncmp(con_options, "SKIPSECUREAUTH",14))
9d8b442
       con_secure_auth= 0;
7a5573f
+    else if (!strncmp(con_options, "CIPHER:", 7))
7a5573f
+      con_cipher = con_options + 7;
7a5573f
     else
7a5573f
       die("Illegal option to connect: %.*s", 
7a5573f
           (int) (end - con_options), con_options);
Bjorn Munch fbe934c
@@ -5642,8 +5645,11 @@ void do_connect(struct st_command *command)
7a5573f
   if (con_ssl)
7a5573f
   {
7a5573f
 #if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
9d8b442
+    /* default cipher */
7a5573f
+    if (con_cipher == NULL && opt_ssl_cipher != NULL)
7a5573f
+      con_cipher = opt_ssl_cipher;
7a5573f
     mysql_ssl_set(&con_slot->mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,
7a5573f
-		  opt_ssl_capath, opt_ssl_cipher);
7a5573f
+		  opt_ssl_capath, con_cipher);
9d8b442
     mysql_options(&con_slot->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
9d8b442
     mysql_options(&con_slot->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
7a5573f
 #if MYSQL_VERSION_ID >= 50000
Bjorn Munch fbe934c
diff --git a/mysql-test/r/openssl_1.result b/mysql-test/r/openssl_1.result
Bjorn Munch fbe934c
index a767a71..3c1ee27 100644
Bjorn Munch fbe934c
--- a/mysql-test/r/openssl_1.result
Bjorn Munch fbe934c
+++ b/mysql-test/r/openssl_1.result
Bjorn Munch fbe934c
@@ -197,8 +197,6 @@ Variable_name	Value
Bjorn Munch fbe934c
 Ssl_cipher	EDH-RSA-DES-CBC3-SHA
Bjorn Munch fbe934c
 Variable_name	Value
Bjorn Munch fbe934c
 Ssl_cipher	AES256-SHA
Bjorn Munch fbe934c
-Variable_name	Value
Bjorn Munch fbe934c
-Ssl_cipher	RC4-SHA
Bjorn Munch fbe934c
 select 'is still running; no cipher request crashed the server' as result from dual;
Bjorn Munch fbe934c
 result
Bjorn Munch fbe934c
 is still running; no cipher request crashed the server
9d8b442
diff --git a/mysql-test/t/openssl_1.test b/mysql-test/t/openssl_1.test
Bjorn Munch fbe934c
index 426de1e..f8c6203 100644
9d8b442
--- a/mysql-test/t/openssl_1.test
9d8b442
+++ b/mysql-test/t/openssl_1.test
9d8b442
@@ -20,13 +20,13 @@ grant select on test.* to ssl_user4@localhost require cipher "DHE-RSA-AES256-SHA
7a5573f
 grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx";
7a5573f
 flush privileges;
7a5573f
 
7a5573f
-connect (con1,localhost,ssl_user1,,,,,SSL);
7a5573f
-connect (con2,localhost,ssl_user2,,,,,SSL);
7a5573f
-connect (con3,localhost,ssl_user3,,,,,SSL);
7a5573f
-connect (con4,localhost,ssl_user4,,,,,SSL);
7a5573f
+connect (con1,localhost,ssl_user1,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
+connect (con2,localhost,ssl_user2,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
+connect (con3,localhost,ssl_user3,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
+connect (con4,localhost,ssl_user4,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
 --replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
7a5573f
 --error ER_ACCESS_DENIED_ERROR
7a5573f
-connect (con5,localhost,ssl_user5,,,,,SSL);
7a5573f
+connect (con5,localhost,ssl_user5,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
 
7a5573f
 connection con1;
7a5573f
 # Check ssl turned on
7a5573f
@@ -125,7 +125,7 @@ drop table t1;
7a5573f
 # verification of servers certificate by setting both ca certificate
7a5573f
 # and ca path to NULL
7a5573f
 #
7a5573f
---exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
7a5573f
+--exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
7a5573f
 --echo End of 5.0 tests
7a5573f
 
7a5573f
 #
Bjorn Munch fbe934c
@@ -215,7 +215,6 @@ DROP TABLE t1;
Bjorn Munch fbe934c
 --exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=DHE-RSA-AES256-SHA
Bjorn Munch fbe934c
 --exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=EDH-RSA-DES-CBC3-SHA
Bjorn Munch fbe934c
 --exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=AES256-SHA
Bjorn Munch fbe934c
---exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=RC4-SHA
Bjorn Munch fbe934c
 --disable_query_log
Bjorn Munch fbe934c
 --disable_result_log
Bjorn Munch fbe934c
 
Bjorn Munch fbe934c
@@ -250,7 +249,7 @@ select 'is still running; no cipher request crashed the server' as result from d
7a5573f
 
7a5573f
 GRANT SELECT ON test.* TO bug42158@localhost REQUIRE X509;
7a5573f
 FLUSH PRIVILEGES;
7a5573f
-connect(con1,localhost,bug42158,,,,,SSL);
7a5573f
+connect(con1,localhost,bug42158,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
7a5573f
 SHOW STATUS LIKE 'Ssl_cipher';
7a5573f
 disconnect con1;
7a5573f
 connection default;
Bjorn Munch fbe934c
diff --git a/mysql-test/t/plugin_auth_sha256_tls.test b/mysql-test/t/plugin_auth_sha256_tls.test
Bjorn Munch fbe934c
index f99df8a..1b38fda 100644
Bjorn Munch fbe934c
--- a/mysql-test/t/plugin_auth_sha256_tls.test
Bjorn Munch fbe934c
+++ b/mysql-test/t/plugin_auth_sha256_tls.test
Bjorn Munch fbe934c
@@ -1,7 +1,7 @@
Bjorn Munch fbe934c
 --source include/not_embedded.inc
Bjorn Munch fbe934c
 --source include/have_ssl.inc
Bjorn Munch fbe934c
 
Bjorn Munch fbe934c
-connect (ssl_con,localhost,root,,,,,SSL);
Bjorn Munch fbe934c
+connect (ssl_con,localhost,root,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
Bjorn Munch fbe934c
 SHOW STATUS LIKE 'Ssl_cipher';
Bjorn Munch fbe934c
 
Bjorn Munch fbe934c
 CREATE USER 'kristofer' IDENTIFIED WITH 'sha256_password';
9d8b442
diff --git a/mysql-test/t/ssl.test b/mysql-test/t/ssl.test
9d8b442
index ea8be39..c61ca8b 100644
9d8b442
--- a/mysql-test/t/ssl.test
9d8b442
+++ b/mysql-test/t/ssl.test
9d8b442
@@ -8,7 +8,7 @@
9d8b442
 # Save the initial number of concurrent sessions
9d8b442
 --source include/count_sessions.inc
9d8b442
 
9d8b442
-connect (ssl_con,localhost,root,,,,,SSL);
9d8b442
+connect (ssl_con,localhost,root,,,,,SSL CIPHER:DHE-RSA-AES256-SHA);
9d8b442
 
9d8b442
 # Check ssl turned on
9d8b442
 SHOW STATUS LIKE 'Ssl_cipher';
9d8b442
diff --git a/mysql-test/t/ssl_8k_key.test b/mysql-test/t/ssl_8k_key.test
9d8b442
index d94c2fc..c27ca58 100644
9d8b442
--- a/mysql-test/t/ssl_8k_key.test
9d8b442
+++ b/mysql-test/t/ssl_8k_key.test
9d8b442
@@ -4,7 +4,7 @@
7a5573f
 #
7a5573f
 # Bug#29784 YaSSL assertion failure when reading 8k key.
7a5573f
 #
7a5573f
---exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
7a5573f
+--exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
7a5573f
 
7a5573f
 ##  This test file is for testing encrypted communication only, not other
7a5573f
 ##  encryption routines that the SSL library happens to provide!
9d8b442
diff --git a/mysql-test/t/ssl_compress.test b/mysql-test/t/ssl_compress.test
9d8b442
index 2cb4c0d..feaa0e7 100644
9d8b442
--- a/mysql-test/t/ssl_compress.test
9d8b442
+++ b/mysql-test/t/ssl_compress.test
9d8b442
@@ -9,7 +9,7 @@
7a5573f
 # Save the initial number of concurrent sessions
7a5573f
 --source include/count_sessions.inc
7a5573f
 
7a5573f
-connect (ssl_compress_con,localhost,root,,,,,SSL COMPRESS);
7a5573f
+connect (ssl_compress_con,localhost,root,,,,,SSL COMPRESS CIPHER:DHE-RSA-AES256-SHA);
7a5573f
 
7a5573f
 # Check ssl turned on
7a5573f
 SHOW STATUS LIKE 'Ssl_cipher';
Norvald H. Ryeng d700256
--- mysql-5.6.33/mysql-test/t/ssl_ca.test~	2016-08-26 13:22:35.000000000 +0200
Norvald H. Ryeng d700256
+++ mysql-5.6.33/mysql-test/t/ssl_ca.test	2016-09-19 11:57:00.921940616 +0200
Norvald H. Ryeng d700256
@@ -7,10 +7,10 @@
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with wrong '--ssl-ca' path : should fail
Norvald H. Ryeng d700256
 --error 1
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/wrong-crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'" 2>&1
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/wrong-crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'" 2>&1
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with correct '--ssl-ca' path : should connect
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo #
Norvald H. Ryeng d700256
 --echo # Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
Norvald H. Ryeng d700256
@@ -21,12 +21,12 @@
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with '--ssl-ca' option using tilde home directoy
Norvald H. Ryeng d700256
 --echo # path substitution : should connect
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$mysql_test_dir_path/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$mysql_test_dir_path/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with '--ssl-key' option using tilde home directoy
Norvald H. Ryeng d700256
 --echo # path substitution : should connect
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$mysql_test_dir_path/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$mysql_test_dir_path/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with '--ssl-cert' option using tilde home directoy
Norvald H. Ryeng d700256
 --echo # path substitution : should connect
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$mysql_test_dir_path/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$mysql_test_dir_path/std_data/crl-client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
--- mysql-5.6.33/mysql-test/t/ssl_crl.test~	2016-08-26 13:22:35.000000000 +0200
Norvald H. Ryeng d700256
+++ mysql-5.6.33/mysql-test/t/ssl_crl.test	2016-09-19 11:53:23.177566131 +0200
Norvald H. Ryeng d700256
@@ -32,9 +32,9 @@
Norvald H. Ryeng d700256
 --echo # try to connect with '--ssl-crl' option using tilde home directoy
Norvald H. Ryeng d700256
 --echo # path substitution : should connect
Norvald H. Ryeng d700256
 --replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test --ssl-crl=$mysql_test_dir_path/std_data/crl-client-revoked.crl -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test --ssl-crl=$mysql_test_dir_path/std_data/crl-client-revoked.crl --ssl-cipher=DHE-RSA-AES256-SHA -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
 
Norvald H. Ryeng d700256
 --echo # try to connect with '--ssl-crlpath' option using tilde home directoy
Norvald H. Ryeng d700256
 --echo # path substitution : should connect
Norvald H. Ryeng d700256
 --replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
Norvald H. Ryeng d700256
---exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-crlpath=$mysql_test_dir_path/std_data/crldir test -e "SHOW STATUS LIKE 'Ssl_cipher'"
Norvald H. Ryeng d700256
+--exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem --ssl-crlpath=$mysql_test_dir_path/std_data/crldir --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW STATUS LIKE 'Ssl_cipher'"