database/mariadb-connector-c
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2025-08-08 14:02:17 +03:00
Code Activity

CONC-747: Change behaviour of MARIADB_TLS_DISABLE_PEER_VERIFICATION

Browse Source 
Instead of skipping the verification during handshake,
tls_allow_invalid_server_certificate will be unset during
initialization of the connection handle if environment varible
MARIADB_TLS_DISABLE_PEER_VERIFICATION was set.

This will allow drivers and applications which don't have an API
option to enable/disable peer server certificate verification
to start without TLS/SSL.
This commit is contained in:
Georg Richter
2024-12-02 17:05:58 +01:00
parent f64d977210
commit 9541bd0e90
3 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libmariadb/ma_tls.c
View File

@@ -114,8 +114,7 @@ int ma_pvio_tls_verify_server_cert(MARIADB_TLS *ctls, unsigned int flags)
mysql= ctls->pvio->mysql; mysql= ctls->pvio->mysql;
/* Skip peer certificate verification */ /* Skip peer certificate verification */
if ((mysql->options.extension->tls_allow_invalid_server_cert || if (mysql->options.extension->tls_allow_invalid_server_cert &&
getenv("MARIADB_TLS_DISABLE_PEER_VERIFICATION")) &&
(!mysql->options.extension->tls_fp && !mysql->options.extension->tls_fp_list)) (!mysql->options.extension->tls_fp && !mysql->options.extension->tls_fp_list))
{ {
/* Since OpenSSL implementation sets status during TLS handshake /* Since OpenSSL implementation sets status during TLS handshake

3
libmariadb/mariadb_lib.c
View File

@@ -715,7 +715,8 @@ struct st_default_options mariadb_defaults[] =
}; };
#ifdef DEFAULT_SSL_VERIFY_SERVER_CERT #ifdef DEFAULT_SSL_VERIFY_SERVER_CERT
#define FIX_SSL_VERIFY_SERVER_CERT(OPTS) #define FIX_SSL_VERIFY_SERVER_CERT(OPTS)\
(OPTS)->extension->tls_allow_invalid_server_cert= (getenv("MARIADB_TLS_DISABLE_PEER_VERIFICATION") != NULL)
#else #else
#define FIX_SSL_VERIFY_SERVER_CERT(OPTS) (OPTS)->extension->tls_allow_invalid_server_cert=1 #define FIX_SSL_VERIFY_SERVER_CERT(OPTS) (OPTS)->extension->tls_allow_invalid_server_cert=1
#endif #endif

9
unittest/libmariadb/tls.c.in
View File

@@ -717,7 +717,6 @@ static int test_env_var(MYSQL *my __attribute__((unused)))
{ {
MYSQL *mysql= mysql_init(NULL); MYSQL *mysql= mysql_init(NULL);
int rc= FAIL; int rc= FAIL;
unsigned int status;
#ifdef _WIN32 #ifdef _WIN32
_putenv_s("MARIADB_TLS_DISABLE_PEER_VERIFICATION", "1"); _putenv_s("MARIADB_TLS_DISABLE_PEER_VERIFICATION", "1");
@@ -733,14 +732,6 @@ static int test_env_var(MYSQL *my __attribute__((unused)))
goto end; goto end;
} }
mariadb_get_infov(mysql, MARIADB_TLS_VERIFY_STATUS, &status);
if (status)
{
diag("expected status=0, since environment variable was set");
goto end;
}
rc= OK; rc= OK;
end: end: