Skip to content

Commit 0b15d03

Browse files
mayankfzMayank Singh
mayankfz
and
Mayank Singh
authored
Patch mariadb for CVE-2023-52971[Medium] and Bug 51837515: Fix mariadb package installation broken and import spec from Fedora (#13271)
Signed-off-by: Mayank Singh <mayansingh@microsoft.com> Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
1 parent 0396730 commit 0b15d03

34 files changed

Lines changed: 5146 additions & 536 deletions

‎LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎LICENSES-AND-NOTICES/SPECS/data/licenses.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -887,6 +887,7 @@
887887
"man-pages-ru",
888888
"man-pages-zh-CN",
889889
"mandoc",
890+
"mariadb",
890891
"mariadb-connector-c",
891892
"mariadb-connector-odbc",
892893
"marisa",
@@ -2900,7 +2901,6 @@
29002901
"make",
29012902
"man-db",
29022903
"man-pages",
2903-
"mariadb",
29042904
"maven",
29052905
"mc",
29062906
"mercurial",

‎SPECS/mariadb/CVE-2023-52971.patch‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
From a9b6bf9fa83604ac13e921c150a2806a64d23f92 Mon Sep 17 00:00:00 2001
2+
From: Mayank Singh <mayansingh@microsoft.com>
3+
Date: Mon, 5 May 2025 09:20:46 +0000
4+
Subject: [PATCH] Address CVE-2023-52971
5+
Upstream Reference Link: https://github.com/MariaDB/server/commit/3b4de4c281cb3e33e6d3ee9537e542bf0a84b83e
6+
7+
---
8+
mysql-test/main/join_nested.result | 12 +++++
9+
mysql-test/main/join_nested.test | 13 ++++++
10+
mysql-test/main/join_nested_jcl6.result | 12 +++++
11+
sql/sql_select.cc | 58 +++++++++++++++++++++++--
12+
4 files changed, 91 insertions(+), 4 deletions(-)
13+
14+
diff --git a/mysql-test/main/join_nested.result b/mysql-test/main/join_nested.result
15+
index cb9dffc8..56468518 100644
16+
--- a/mysql-test/main/join_nested.result
17+
+++ b/mysql-test/main/join_nested.result
18+
@@ -2051,3 +2051,15 @@ a b c a a b
19+
DROP TABLE t1, t2, t3;
20+
set join_cache_level= @save_join_cache_level;
21+
# end of 10.3 tests
22+
+#
23+
+# MDEV-32084: Assertion in best_extension_by_limited_search(), or crash elsewhere in release
24+
+#
25+
+CREATE TABLE t1 (i int);
26+
+INSERT INTO t1 values (1),(2);
27+
+SELECT 1 FROM t1 WHERE i IN
28+
+(SELECT 1 FROM t1 c
29+
+LEFT JOIN (t1 a LEFT JOIN t1 b ON t1.i = b.i) ON c.i = t1.i);
30+
+1
31+
+1
32+
+DROP TABLE t1;
33+
+# end of 10.11 tests
34+
diff --git a/mysql-test/main/join_nested.test b/mysql-test/main/join_nested.test
35+
index ed1fe4c9..62370b95 100644
36+
--- a/mysql-test/main/join_nested.test
37+
+++ b/mysql-test/main/join_nested.test
38+
@@ -1458,3 +1458,16 @@ DROP TABLE t1, t2, t3;
39+
set join_cache_level= @save_join_cache_level;
40+
41+
--echo # end of 10.3 tests
42+
+
43+
+--echo #
44+
+--echo # MDEV-32084: Assertion in best_extension_by_limited_search(), or crash elsewhere in release
45+
+--echo #
46+
+CREATE TABLE t1 (i int);
47+
+INSERT INTO t1 values (1),(2);
48+
+
49+
+SELECT 1 FROM t1 WHERE i IN
50+
+ (SELECT 1 FROM t1 c
51+
+ LEFT JOIN (t1 a LEFT JOIN t1 b ON t1.i = b.i) ON c.i = t1.i);
52+
+
53+
+DROP TABLE t1;
54+
+--echo # end of 10.11 tests
55+
diff --git a/mysql-test/main/join_nested_jcl6.result b/mysql-test/main/join_nested_jcl6.result
56+
index 0bda8d43..50a1e83a 100644
57+
--- a/mysql-test/main/join_nested_jcl6.result
58+
+++ b/mysql-test/main/join_nested_jcl6.result
59+
@@ -2060,6 +2060,18 @@ a b c a a b
60+
DROP TABLE t1, t2, t3;
61+
set join_cache_level= @save_join_cache_level;
62+
# end of 10.3 tests
63+
+#
64+
+# MDEV-32084: Assertion in best_extension_by_limited_search(), or crash elsewhere in release
65+
+#
66+
+CREATE TABLE t1 (i int);
67+
+INSERT INTO t1 values (1),(2);
68+
+SELECT 1 FROM t1 WHERE i IN
69+
+(SELECT 1 FROM t1 c
70+
+LEFT JOIN (t1 a LEFT JOIN t1 b ON t1.i = b.i) ON c.i = t1.i);
71+
+1
72+
+1
73+
+DROP TABLE t1;
74+
+# end of 10.11 tests
75+
CREATE TABLE t5 (a int, b int, c int, PRIMARY KEY(a), KEY b_i (b));
76+
CREATE TABLE t6 (a int, b int, c int, PRIMARY KEY(a), KEY b_i (b));
77+
CREATE TABLE t7 (a int, b int, c int, PRIMARY KEY(a), KEY b_i (b));
78+
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
79+
index b88e8b4c..b8e15264 100644
80+
--- a/sql/sql_select.cc
81+
+++ b/sql/sql_select.cc
82+
@@ -18544,6 +18544,8 @@ simplify_joins(JOIN *join, List<TABLE_LIST> *join_list, COND *conds, bool top,
83+
prev_table->dep_tables|= used_tables;
84+
if (prev_table->on_expr)
85+
{
86+
+ /* If the ON expression is still there, it's an outer join */
87+
+ DBUG_ASSERT(prev_table->outer_join);
88+
prev_table->dep_tables|= table->on_expr_dep_tables;
89+
table_map prev_used_tables= prev_table->nested_join ?
90+
prev_table->nested_join->used_tables :
91+
@@ -18558,11 +18560,59 @@ simplify_joins(JOIN *join, List<TABLE_LIST> *join_list, COND *conds, bool top,
92+
prevents update of inner table dependences.
93+
For example it might happen if RAND() function
94+
is used in JOIN ON clause.
95+
- */
96+
- if (!((prev_table->on_expr->used_tables() &
97+
- ~(OUTER_REF_TABLE_BIT | RAND_TABLE_BIT)) &
98+
- ~prev_used_tables))
99+
+ */
100+
+ table_map prev_on_expr_deps= prev_table->on_expr->used_tables() &
101+
+ ~(OUTER_REF_TABLE_BIT | RAND_TABLE_BIT);
102+
+ prev_on_expr_deps&= ~prev_used_tables;
103+
+
104+
+ if (!prev_on_expr_deps)
105+
prev_table->dep_tables|= used_tables;
106+
+ else
107+
+ {
108+
+ /*
109+
+ Another possible case is when prev_on_expr_deps!=0 but it depends
110+
+ on a table outside this join nest. SQL name resolution don't allow
111+
+ this but it is possible when LEFT JOIN is inside a subquery which
112+
+ is converted into a semi-join nest, Example:
113+
+
114+
+ t1 SEMI JOIN (
115+
+ t2
116+
+ LEFT JOIN (t3 LEFT JOIN t4 ON t4.col=t1.col) ON expr
117+
+ ) ON ...
118+
+
119+
+ here, we would have prev_table=t4, table=t3. The condition
120+
+ "ON t4.col=t1.col" depends on tables {t1, t4}. To make sure the
121+
+ optimizer puts t3 before t4 we need to make sure t4.dep_tables
122+
+ includes t3.
123+
+ */
124+
+
125+
+ DBUG_ASSERT(table->embedding == prev_table->embedding);
126+
+ if (table->embedding)
127+
+ {
128+
+ /*
129+
+ Find what are the "peers" of "table" in the join nest. Normally,
130+
+ it is table->embedding->nested_join->used_tables, but here we are
131+
+ in the process of recomputing that value.
132+
+ So, we walk the join list and collect the bitmap of peers:
133+
+ */
134+
+ table_map peers= 0;
135+
+ List_iterator_fast<TABLE_LIST> li(*join_list);
136+
+ TABLE_LIST *peer;
137+
+ while ((peer= li++))
138+
+ {
139+
+ table_map curmap= peer->nested_join
140+
+ ? peer->nested_join->used_tables
141+
+ : peer->get_map();
142+
+ peers|= curmap;
143+
+ }
144+
+ /*
145+
+ If prev_table doesn't depend on any of its peers, add a
146+
+ dependency on nearest peer, that is, on 'table'.
147+
+ */
148+
+ if (!(prev_on_expr_deps & peers))
149+
+ prev_table->dep_tables|= used_tables;
150+
+ }
151+
+ }
152+
}
153+
}
154+
prev_table= table;
155+
--
156+
2.45.3
157+

‎SPECS/mariadb/LICENSE.clustercheck‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
Copyright (c) 2012-2014, Olaf van Zandwijk
2+
All rights reserved.
3+
4+
Redistribution and use in source and binary forms, with or without modification,
5+
are permitted provided that the following conditions are met:
6+
7+
1. Redistributions of source code must retain the above copyright notice,
8+
this list of conditions and the following disclaimer.
9+
10+
2. Redistributions in binary form must reproduce the above copyright notice,
11+
this list of conditions and the following disclaimer in the documentation
12+
and/or other materials provided with the distribution.
13+
14+
3. Neither the name of the copyright holder nor the names of its contributors
15+
may be used to endorse or promote products derived from this software without
16+
specific prior written permission.
17+
18+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
22+
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23+
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24+
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25+
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27+
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎SPECS/mariadb/README.mariadb-docs‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
MariaDB haven't yet made a document package available for offline.
2+
3+
You can create your own copy with the instructions here:
4+
5+
https://mariadb.com/kb/en/meta/mirroring-the-mariadb-knowledge-base/
6+
7+
You can find view the on-line documentation at:
8+
9+
https://mariadb.com/kb/en/documentation/

‎SPECS/mariadb/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# mariadb10.11
2+
3+
The mariadb10.11 package

‎SPECS/mariadb/README.wsrep_sst_rsync_tunnel‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
socat tunnel for encrypted rsync SST
2+
====================================
3+
4+
`wsrep_sst_rsync_tunnel` is an extension of the rsync-based [SST](http://galeracluster.com/documentation-webpages/glossary.html#term-state-snapshot-transfer)
5+
implementation that ships with mariadb. Its purpose is to encrypt
6+
communication between the donor and the joiner during an SST.
7+
8+
Encryption is implemented by means of a socat tunnel, using OPENSSL
9+
addresses. It can be configured via the regular openssl flags exposed
10+
by socat.
11+
12+
13+
## How to configure the script
14+
15+
This SST script can configured by setting a few keys in your favorite
16+
mariadb option file in addition to the usual galera settings.
17+
18+
[mysqld]
19+
...
20+
bind_address=<node-name>
21+
wsrep_sst_method=rsync_tunnel
22+
...
23+
24+
[sst]
25+
tca=/path/to/your/ca-file.crt
26+
tcert=/path/to/node/certificate.crt
27+
tkey=/path/to/node/key.key
28+
sockopt=<openssl-address-options-as-per-socat-manual>
29+
30+
When a joiner node requests an SST, `wsrep_sst_rsync_tunnel` uses
31+
socat to listen to incoming SSL connections on port 4444 in lieu of
32+
the original rsync daemon. Received data will be forwarded to the
33+
rscynd daemon started locally to replicate the database.
34+
35+
When a donor node serves the SST, `wsrep_sst_rsync_tunnel` makes
36+
a series of rsync calls that target a locally started socat daemon.
37+
The daemon tunnels all rsync traffic into an encrypted SSL connection
38+
that targets the joiner's end of the socat tunnel.
39+
40+
Encryption parameters are specified under the `[sst]` group in the
41+
mariadb option file, where `tkey` and `tcert` are respectively the key
42+
and the certificate that are used by both sides of the socat tunnel.
43+
Each node typically has a different key and cert. Both key and
44+
certificate can be combined into a single PEM file and referenced by
45+
`tcert`. Option `tca` holds a list of the trusted signing
46+
certificates.
47+
48+
In case you need to tweak the creation of the SSL connection, you can
49+
pass valid socat options (as per socat manual) via the `sockopt` key.
50+
For debugging purpose, the exact socat command that is being executed
51+
shows up in the mariadb log file.
52+
53+
Note that socat verifies that the certificate's commonName matches
54+
that of the host that is being targeted. The target name comes from
55+
the value configured in `bind_address`, so it's important that it
56+
matches the certificate's commonName. An IP address can be used for
57+
`bind_address`, but you may get into trouble in case different
58+
hostnames resolve to the same IP (e.g. multiple networks per host).
59+
60+
61+
## Examples of use
62+
63+
Suppose you're running a 3-node galera cluster
64+
`node1.my.cluster`, `node2.my.cluster`, `node3.my.cluster`.
65+
66+
### Scenario: using self-signed certificates
67+
68+
On each node, create a key and a certificate, and bundle them into a
69+
single PEM file. For instance on `node1.my.cluster`:
70+
71+
openssl genrsa -out /tls/mysql-$(hostname -f).key 2048
72+
openssl req -new -key /tls/mysql-$(hostname -f).key -x509 -days 365000 -subj "/CN=$(hostname -f)" -out /tls/mysql-$(hostname -f).crt -batch
73+
cat /tls/mysql-$(hostname -f).key /tls/mysql-$(hostname -f).crt > /tls/mysql.pem
74+
75+
Then, on each node, create a cafile that will contain all the certs to
76+
trust:
77+
78+
for n in node1.my.cluster node2.my.cluster node3.my.cluster; do
79+
ssh $n 'cat /tls/mysql-$(hostname -f).crt' >> /tls/all-mysql.crt
80+
done
81+
82+
Once you have those two files on each host, you can configure the SST
83+
appropriately. For instance from `/etc/my.cnf.d/galera.cnf`:
84+
85+
[mysqld]
86+
...
87+
88+
[sst]
89+
tca=/tls/all-mysql.crt
90+
tcert=/tls/mysql.pem
91+
92+
### Scenario: using self-signed certificates, without verification
93+
94+
By default, when socat tries to establish a SSL connection to a peer,
95+
it also verifies that it can trust the peer's certificate. If for some
96+
reason you need to disable that feature, you can amend the previous
97+
configuration with a sockopt option:
98+
99+
[mysqld]
100+
...
101+
102+
[sst]
103+
tca=/tls/all-mysql.crt
104+
tcert=/tls/mysql.pem
105+
sockopt="verify=0"
106+
107+
The associated sockopt value is passed to socat when
108+
the donor or the joiner configures his part of the tunnel.
109+
110+
Note: please do not do so in production, this is inherently insecure
111+
as you will not verify the identity of the peer you're connecting to!
112+
113+
### Scenario: using certificates from a CA
114+
115+
Suppose you have a FreeIPA service which generated a key file and a
116+
certificate file for the three galera nodes, respectively located at
117+
/tls/mysql.key and /tls/mysql.crt.
118+
119+
Assuming that the certificate for the FreeIPA server is available at
120+
/etc/ipa/ca.crt, you can configure you galera servers as follows:
121+
122+
[sst]
123+
tca=/etc/ipa/ca.crt
124+
tcert=/tls/mysql.crt
125+
tkey=/tls/mysql.key
126+
127+
## License
128+
129+
Copyright © 2017 [Damien Ciabrini](https://github.com/dciabrin).
130+
This work is derived from the original `wsrep_rsync_sst`, copyright
131+
© 2010-2014 [Codership Oy](https://github.com/codership).
132+
Released under the GNU GPLv2.

0 commit comments

Comments
 (0)