- Added TLSv1.3 ciphers to cipher map.
- Fixed retrieval of cipher suite: Since gnutls_cipher_suite_get_name
supports only TLSv1.2 (and lower) cipher suites, we have to call
gnutls_ciphersuite_get() (requires GnuTLS 3.7.4 or newer).
This reverts 395641549ac7..536d9e2b9e5b, in particular:
8dffd56936 MDEV-31857 enable MYSQL_OPT_SSL_VERIFY_SERVER_CERT by default
a99570c118 MDEV-31855 SSL cert validation protocol extension
9aa15e72a7 TLS fingerprint
and related commits
because the default value of every option is 0
(option and option.extension are bzero-ed to reset),
tls_verify_server_cert was renamed to tls_allow_invalid_server_cert
with the default value of 0, "do not allow".
API didn't change, it's still MYSQL_OPT_SSL_VERIFY_SERVER_CERT
* extend the client auth plugin API with a new callback
* relax the plugin version check to allow load a plugin with the
same major version, even if the minor versions differ
* implement the protocol extension:
- don't abort at once if the certificate is self signed and
no CA was explicitly specified
- allow it if it passes fingerprint check
- allow it if plugin has hash_password_bin callback, password was
non-empty and the control hash matches server's
Since the server certification option is used by client
only, there is no need to have this flag in server and or
client capabilities. The server itself validates client
certificate depending on the user definition.
Since TLS errors might happen not only when connecting and SSL protocol
is not longer used, errormessage for CR_SSL_CONNECTION_ERROR was replaced
by TLS/SSL error.
Added a new option MARIADB_OPT_SKIP_READ_RESPONSE which skips automatic
reading of server response after sending a command to the server.
Server packets have to be retrieved by calling the corresponding methods,
e.g:
Send command Read method
mysql_real_query/mysql_send_query db_read_query_result
mysql_stmt_prepare db_read_prepare_response
mysql_stmt_execute,
mariadb_stmt_execute_direct db_read_execute_response
We now check the return code of gnutls_record_send() and gnutls_record_recv().
If GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED was returned we will loop and read/write
again until a timeout occurs or buffer was read or written.
Fixed crash in case certificate and key are stored in the same file.
Instead of reading key and cert separately we now call gnutls api function
gnutls_certificate_x509_keyfile2() to load certificate and key.
- don't run fingerprint and passphrase protected tests if the corresponding
files (sha1 and encrypted client key) are not found in CERT_PATH
- don't overwrite SSL errors if handshake failed
- Use gnutls read/write instead of pvio
Client part of MDEV-14101: Add support for tls-version, via
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, value)
Accepted values are "TLSv1.1", "TLSv1.2" and "TLSv1.3".
Fixed testcase openssl_1 for schannel
When calling mariadb_get_infov with option MARIADB_TLS_LIBRARY
the functioni now returns the correct version number and name
of the tls/ssl library in use.
- added new gnutls cipher mapping
- fixed ssl test case: skip hostname verification if both server and client run on localhost
- added server certificates
- don't use password in global context
- load keys and certs via callback functions
- don't use gnutls_bye since server is not able to detect dead socket
- fixed valgrind errors in gnutls
In case handshake will fail a further call to gnutls_bye function will lead in a crash.
Therefore we free the ssl handle immediately after handshake failed.
