MDEV-39218: Master_ssl_verify_server_cert value is not set correctly

mysql-test/suite/rpl/r/rpl_ssl_verify_server_cert.result

@@ -0,0 +1,52 @@
+include/master-slave.inc
+[connection master]
+#
+# Test 1: master_ssl_verify_server_cert=0 should PASS
+# (verification disabled, simulated cert failure should not matter)
+#
+connection slave;
+include/stop_slave.inc
+SET @saved_dbug = @@GLOBAL.debug_dbug;
+SET GLOBAL debug_dbug = '+d,simulate_ssl_unable_to_get_issuer_cert';
+CHANGE MASTER TO
+master_host='127.0.0.1',
+master_port=MASTER_PORT,
+master_user='root',
+master_ssl=1,
+master_ssl_verify_server_cert=0;
+Master_SSL_Allowed = 'Yes'
+Master_SSL_Verify_Server_Cert = 'No'
+START SLAVE IO_THREAD;
+include/wait_for_slave_param.inc [Slave_IO_Running]
+# IO thread started successfully - verification was correctly disabled
+#
+# Test 2: master_ssl_verify_server_cert=1 should FAIL
+# (verification enabled, simulated cert failure should be caught)
+#
+STOP SLAVE IO_THREAD;
+include/wait_for_slave_io_to_stop.inc
+CHANGE MASTER TO
+master_host='127.0.0.1',
+master_port=MASTER_PORT,
+master_user='root',
+master_ssl=1,
+master_ssl_verify_server_cert=1;
+Master_SSL_Allowed = 'Yes'
+Master_SSL_Verify_Server_Cert = 'Yes'
+START SLAVE IO_THREAD;
+include/wait_for_slave_param.inc [Last_IO_Errno]
+# IO thread failed as expected - verification correctly caught the failure
+#
+# Cleanup
+#
+STOP SLAVE IO_THREAD;
+include/wait_for_slave_io_to_stop.inc
+SET GLOBAL debug_dbug = @saved_dbug;
+RESET SLAVE ALL;
+CHANGE MASTER TO
+master_host='127.0.0.1',
+master_port=MASTER_PORT,
+master_user='root',
+master_ssl=1,
+master_ssl_verify_server_cert=0;
+include/rpl_end.inc

mysql-test/suite/rpl/t/rpl_ssl_verify_server_cert.test

@@ -0,0 +1,103 @@
+#
+# Test for master_ssl_verify_server_cert option
+#
+# This test verifies that master_ssl_verify_server_cert correctly controls
+# SSL certificate verification during replication.
+#
+# Test strategy:
+# - Use debug point to simulate SSL certificate verification failure
+# - Test 1: master_ssl_verify_server_cert=0 -> connection succeeds (no verification)
+# - Test 2: master_ssl_verify_server_cert=1 -> connection fails (verification enabled)
+#
+
+--source include/have_debug.inc
+--source include/have_ssl_communication.inc
+--source include/master-slave.inc
+
+--echo #
+--echo # Test 1: master_ssl_verify_server_cert=0 should PASS
+--echo # (verification disabled, simulated cert failure should not matter)
+--echo #
+
+--connection slave
+--source include/stop_slave.inc
+
+# Enable debug point to simulate SSL certificate verification failure
+SET @saved_dbug = @@GLOBAL.debug_dbug;
+SET GLOBAL debug_dbug = '+d,simulate_ssl_unable_to_get_issuer_cert';
+
+# Use SSL with verification disabled - simulated cert failure should not matter
+--replace_result $MASTER_MYPORT MASTER_PORT
+eval CHANGE MASTER TO
+  master_host='127.0.0.1',
+  master_port=$MASTER_MYPORT,
+  master_user='root',
+  master_ssl=1,
+  master_ssl_verify_server_cert=0;
+
+--let $status_items= Master_SSL_Allowed, Master_SSL_Verify_Server_Cert
+--source include/show_slave_status.inc
+
+START SLAVE IO_THREAD;
+
+# Wait for the connection to establish
+--let $slave_param= Slave_IO_Running
+--let $slave_param_value= Yes
+--let $slave_timeout= 30
+--source include/wait_for_slave_param.inc
+
+--echo # IO thread started successfully - verification was correctly disabled
+
+--echo #
+--echo # Test 2: master_ssl_verify_server_cert=1 should FAIL
+--echo # (verification enabled, simulated cert failure should be caught)
+--echo #
+
+STOP SLAVE IO_THREAD;
+--source include/wait_for_slave_io_to_stop.inc
+
+# Use SSL with verification enabled - connection should fail
+# because of simulated certificate verification failure
+--replace_result $MASTER_MYPORT MASTER_PORT
+eval CHANGE MASTER TO
+  master_host='127.0.0.1',
+  master_port=$MASTER_MYPORT,
+  master_user='root',
+  master_ssl=1,
+  master_ssl_verify_server_cert=1;
+
+--let $status_items= Master_SSL_Allowed, Master_SSL_Verify_Server_Cert
+--source include/show_slave_status.inc
+
+START SLAVE IO_THREAD;
+
+# Wait for SSL connection error (2026 = CR_SSL_CONNECTION_ERROR)
+# The slave will keep retrying, so we check Last_IO_Errno instead of waiting for IO thread to stop
+--let $slave_param= Last_IO_Errno
+--let $slave_param_value= 2026
+--let $slave_timeout= 30
+--source include/wait_for_slave_param.inc
+
+--echo # IO thread failed as expected - verification correctly caught the failure
+
+--echo #
+--echo # Cleanup
+--echo #
+
+STOP SLAVE IO_THREAD;
+--source include/wait_for_slave_io_to_stop.inc
+
+SET GLOBAL debug_dbug = @saved_dbug;
+
+RESET SLAVE ALL;
+
+--replace_result $MASTER_MYPORT MASTER_PORT
+eval CHANGE MASTER TO
+  master_host='127.0.0.1',
+  master_port=$MASTER_MYPORT,
+  master_user='root',
+  master_ssl=1,
+  master_ssl_verify_server_cert=0;
+
+--let $rpl_only_running_threads= 1
+--source include/rpl_end.inc

sql-common/client.c

@@ -1613,7 +1613,11 @@ static int ssl_verify_server_cert(MYSQL *mysql, const char **errptr, int is_loca
     goto error;
   }
 
-  switch (SSL_get_verify_result(ssl))
+  {
+    long verify_result= SSL_get_verify_result(ssl);
+    DBUG_EXECUTE_IF("simulate_ssl_unable_to_get_issuer_cert",
+                    verify_result= X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;);
+    switch (verify_result)
   {
   case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:     /* OpenSSL */
   case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:       /* OpenSSL */
@@ -1637,6 +1641,7 @@ static int ssl_verify_server_cert(MYSQL *mysql, const char **errptr, int is_loca
     *errptr= "Failed to verify the server certificate";
     break;
   }
+  }
 
 error:
   X509_free(server_cert);

sql/rpl_mi.cc

@@ -1602,8 +1602,20 @@ void setup_mysql_connection_for_master(MYSQL *mysql, Master_info *mi,
                   mi->master_ssl_capath, mi->master_ssl_cipher);
     mysql_options(mysql, MYSQL_OPT_SSL_CRL, mi->master_ssl_crl);
     mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, mi->master_ssl_crlpath);
+    /*
+      Fix incorrect memory access for master_ssl_verify_server_cert
+      mysql_options(MYSQL_OPT_SSL_VERIFY_SERVER_CERT) expects a pointer to
+      my_bool (1 byte). However, master_ssl_verify_server_cert is of type
+      Optional_bool_value<>, which has the following memory layout:
+
+        struct Optional_bool_value : Persistent {
+          trilean value;  // 4-byte enum (YES/NO/DEFAULT)
+        };
+      The fix is to pass &mi->master_ssl_verify_server_cert.value to access
+      the actual trilean value directly.
+    */
     mysql_options(mysql, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
-                  &mi->master_ssl_verify_server_cert);
+                  &mi->master_ssl_verify_server_cert.value);
   }
   else
 #endif