database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

[MDEV-30178] Explicit errors on required secured transport

Browse Source 
The error message for user connections using insecure transport when secured transport is required is very uninformative and doesn't mention the requirement of secure
transport at all.

To make the error message more relevant, introduce a new error
'ER_SECURE_TRANSPORT_REQUIRED', copy of MySQL error message with the
error code 08004 (SQL-server rejected establishment SQL-connection).

Move the code of 'require_secure_transport' to be executed before
authentication verification, as it's not part of authentication but
rather verifying if connection should be allowed in the first place.

All new code of the whole pull request, including one or several files that
are either new files or modified ones, are contributed under the BSD-new license.
I am contributing on behalf of my employer Amazon Web Services, Inc.
This commit is contained in:
Vincent Dufrasnes
2023-03-09 20:05:17 +00:00
committed by Andrew Hutchings
parent 038d29258d
commit 742f960eeb
5 changed files with 329 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
sql/sql_connect.cc
View File

@ -829,6 +829,21 @@ bool init_new_connection_handler_thread()
return 0;
}
static bool check_require_secured_transport(THD *thd)
{
Vio *vio= thd->net.vio;
if (opt_require_secure_transport)
{
enum enum_vio_type type= vio_type(vio);
return
(type != VIO_TYPE_SSL) &&
(type != VIO_TYPE_NAMEDPIPE) &&
(type != VIO_TYPE_SOCKET);
}
return 0;
}
/**
Set client address during authentication.
@ -1081,6 +1096,17 @@ static int check_connection(THD *thd)
return 1; /* The error is set by alloc(). */
}
if(check_require_secured_transport(thd))
{
Host_errors errors;
errors.m_ssl= 1;
inc_host_errors(thd->main_security_ctx.ip, &errors);
status_var_increment(thd->status_var.access_denied_errors);
my_error(ER_SECURE_TRANSPORT_REQUIRED, MYF(0));
return 1;
}
auth_rc= acl_authenticate(thd, 0);
if (auth_rc == 0 && connect_errors != 0)
{