mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
mariadb/mysql-test/main/require_secure_transport.result

18 lines
722 B
Text
Raw Normal View History

MDEV-13362: implement --require_secure_transport option Currently, if a user wants to require TLS for every connection made over the network, then every user account on the system needs to be created with "REQUIRE SSL" or one of the other TLS options. Implementing a require_secure_transport system varuable (which, in particular, can be set using the --require_secure_transport=ON command line option) in the MariaDB Server would make it a lot easier to require TLS (or other secure transport) system-wide. This patch implements this new system variable, adds the ability to set it with SQL statements, from the command line and from the configuration file, and also contains improvements for mtr that allow the user to establish non-secure TCP/IP connections (for example, to verify the operation of the new option).
2020-03-02 23:46:07 +01:00
SET GLOBAL require_secure_transport=ON;
MDEV-32123: require_secure_transport doesn't allow TCP connections In case the option require_secure_transport is on the user can't establish a secure ssl connection over TCP protocol. Inability to set up a ssl session over TCP was caused by the fact that a type of client's connection was checked before ssl handshake performed (ssl handshake happens at the function acl_authenticate()). At that moment vio type has the value VIO_TYPE_TCPIP for client connection that uses TCP transport. In result, checking for allowable vio type for fails despite the fact that SSL session being established. To fix the issue move checking of vio type for allowable values inside the function parse_client_handshake_packet() right after client's capabilities discovered that SSL is not requested by the client.
2023-10-11 14:47:05 +07:00
connect(localhost,root,,test,MASTER_PORT,MASTER_SOCKET);
connect without_ssl,localhost,root,,,,,TCP NOSSL;
ERROR 08004: Connections using insecure transport are prohibited while --require_secure_transport=ON.
connect with_ssl,localhost,root,,,,,TCP SSL;
SELECT (VARIABLE_VALUE <> '') AS have_ssl FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_cipher';
have_ssl
1
disconnect with_ssl;
MDEV-13362: implement --require_secure_transport option Currently, if a user wants to require TLS for every connection made over the network, then every user account on the system needs to be created with "REQUIRE SSL" or one of the other TLS options. Implementing a require_secure_transport system varuable (which, in particular, can be set using the --require_secure_transport=ON command line option) in the MariaDB Server would make it a lot easier to require TLS (or other secure transport) system-wide. This patch implements this new system variable, adds the ability to set it with SQL statements, from the command line and from the configuration file, and also contains improvements for mtr that allow the user to establish non-secure TCP/IP connections (for example, to verify the operation of the new option).
2020-03-02 23:46:07 +01:00
connection default;
SET GLOBAL require_secure_transport=OFF;
MDEV-32123: require_secure_transport doesn't allow TCP connections In case the option require_secure_transport is on the user can't establish a secure ssl connection over TCP protocol. Inability to set up a ssl session over TCP was caused by the fact that a type of client's connection was checked before ssl handshake performed (ssl handshake happens at the function acl_authenticate()). At that moment vio type has the value VIO_TYPE_TCPIP for client connection that uses TCP transport. In result, checking for allowable vio type for fails despite the fact that SSL session being established. To fix the issue move checking of vio type for allowable values inside the function parse_client_handshake_packet() right after client's capabilities discovered that SSL is not requested by the client.
2023-10-11 14:47:05 +07:00
connect without_ssl,localhost,root,,,,,TCP NOSSL;
SELECT (VARIABLE_VALUE <> '') AS have_ssl FROM INFORMATION_SCHEMA.SESSION_STATUS WHERE VARIABLE_NAME='Ssl_cipher';
have_ssl
0
MDEV-13362: implement --require_secure_transport option Currently, if a user wants to require TLS for every connection made over the network, then every user account on the system needs to be created with "REQUIRE SSL" or one of the other TLS options. Implementing a require_secure_transport system varuable (which, in particular, can be set using the --require_secure_transport=ON command line option) in the MariaDB Server would make it a lot easier to require TLS (or other secure transport) system-wide. This patch implements this new system variable, adds the ability to set it with SQL statements, from the command line and from the configuration file, and also contains improvements for mtr that allow the user to establish non-secure TCP/IP connections (for example, to verify the operation of the new option).
2020-03-02 23:46:07 +01:00
disconnect without_ssl;
connection default;
Reference in a new issue Copy permalink