database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-31369 Disable TLS v1.0 and 1.1 for MariaDB

Browse Source 
Remove TLSv1.1 from the default tls_version system variable.

Output a warning if TLSv1.0 or TLSv1.1 are selected.

Thanks Tingyao Nian for the feature request.
This commit is contained in:
Daniel Black
2023-07-06 16:47:39 +10:00
parent 5fe8d0d559
commit 1831f8e4d7
8 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mysql-test/main/ssl_cipher.result
View File

@ -66,3 +66,5 @@ Variable_name Value
Ssl_cipher_list AES128-SHA Ssl_cipher_list AES128-SHA
disconnect ssl_con; disconnect ssl_con;
connection default; connection default;
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
FOUND 2 /TLSv1.0 and TLSv1.1 are insecure/ in mysqld.1.err

6
mysql-test/main/ssl_cipher.test
View File

@ -101,3 +101,9 @@ SHOW STATUS LIKE 'Ssl_cipher';
SHOW STATUS LIKE 'Ssl_cipher_list'; SHOW STATUS LIKE 'Ssl_cipher_list';
disconnect ssl_con; disconnect ssl_con;
connection default; connection default;
# MDEV-31369 Disable TLS v1.0 and 1.1 for MariaDB
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
--let SEARCH_FILE=$MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN= TLSv1.0 and TLSv1.1 are insecure
--source include/search_pattern_in_file.inc

2
mysql-test/main/tls_version.result
View File

@ -12,3 +12,5 @@ Variable_name Value
Ssl_version TLSv1.2 Ssl_version TLSv1.2
@@tls_version @@tls_version
TLSv1.1,TLSv1.2 TLSv1.1,TLSv1.2
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
FOUND 1 /TLSv1.0 and TLSv1.1 are insecure/ in mysqld.1.err

5
mysql-test/main/tls_version.test
View File

@ -22,3 +22,8 @@
# finally list available protocols # finally list available protocols
--exec $MYSQL --host=localhost --ssl -e "select @@tls_version;" --exec $MYSQL --host=localhost --ssl -e "select @@tls_version;"
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
--let SEARCH_FILE=$MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN= TLSv1.0 and TLSv1.1 are insecure
--source include/search_pattern_in_file.inc

2
mysql-test/main/tls_version1.result
View File

@ -4,3 +4,5 @@ Variable_name Value
Ssl_version TLSv1 Ssl_version TLSv1
@@tls_version @@tls_version
TLSv1.0 TLSv1.0
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
FOUND 1 /TLSv1.0 and TLSv1.1 are insecure/ in mysqld.1.err

5
mysql-test/main/tls_version1.test
View File

@ -10,3 +10,8 @@
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.0 -e "show status like 'ssl_version';" --exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.0 -e "show status like 'ssl_version';"
--exec $MYSQL --host=localhost --ssl -e "select @@tls_version;" --exec $MYSQL --host=localhost --ssl -e "select @@tls_version;"
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
--let SEARCH_FILE=$MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN= TLSv1.0 and TLSv1.1 are insecure
--source include/search_pattern_in_file.inc

2
sql/mysqld.cc
View File

@ -4500,6 +4500,8 @@ static int init_common_variables()
return 1; return 1;
} }
if (tls_version & (VIO_TLSv1_0 + VIO_TLSv1_1))
sql_print_warning("TLSv1.0 and TLSv1.1 are insecure and should not be used for tls_version");
#ifdef WITH_WSREP #ifdef WITH_WSREP
/* /*

2
sql/sys_vars.cc
View File

@ -3623,7 +3623,7 @@ static Sys_var_set Sys_tls_version(
"TLS protocol version for secure connections.", "TLS protocol version for secure connections.",
READ_ONLY GLOBAL_VAR(tls_version), CMD_LINE(REQUIRED_ARG), READ_ONLY GLOBAL_VAR(tls_version), CMD_LINE(REQUIRED_ARG),
tls_version_names, tls_version_names,
DEFAULT(VIO_TLSv1_1 | VIO_TLSv1_2 | VIO_TLSv1_3)); DEFAULT(VIO_TLSv1_2 | VIO_TLSv1_3));
static Sys_var_mybool Sys_standard_compliant_cte( static Sys_var_mybool Sys_standard_compliant_cte(
"standard_compliant_cte", "standard_compliant_cte",