Tony Chen be164fc401 ssl_cipher parameter cannot configure TLSv1.3 and TLSv1.2 ciphers at the same time ... SSL_CTX_set_ciphersuites() sets the TLSv1.3 cipher suites. SSL_CTX_set_cipher_list() sets the ciphers for TLSv1.2 and below. The current TLS configuration logic will not perform SSL_CTX_set_cipher_list() to configure TLSv1.2 ciphers if the call to SSL_CTX_set_ciphersuites() was successful. The call to SSL_CTX_set_ciphersuites() is successful if any TLSv1.3 cipher suite is passed into `--ssl-cipher`. This is a potential security vulnerability because users trying to restrict specific secure ciphers for TLSv1.3 and TLSv1.2, would unknowingly still have the database support insecure TLSv1.2 ciphers. For example: If setting `--ssl_cipher=TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256`, the database would still support all possible TLSv1.2 ciphers rather than only ECDHE-RSA-AES128-GCM-SHA256. The solution is to execute both SSL_CTX_set_ciphersuites() and SSL_CTX_set_cipher_list() even if the first call succeeds. This allows the configuration of exactly which TLSv1.3 and TLSv1.2 ciphers to support. Note that there is 1 behavior change with this. When specifying only TLSv1.3 ciphers to `--ssl-cipher`, the database will not support any TLSv1.2 cipher. However, this does not impose a security risk and considering TLSv1.3 is the modern protocol, this behavior should be fine. All TLSv1.3 ciphers are still supported if only TLSv1.2 ciphers are specified through `--ssl-cipher`. All new code of the whole pull request, including one or several files that are either new files or modified ones, are contributed under the BSD-new license. I am contributing on behalf of my employer Amazon Web Services, Inc.		2024-09-26 11:50:20 +02:00
..
add_anonymous_users.inc
alter_table_mdev539.inc
analyze-format.inc	MDEV-34041 Display additional information for materialized subqueries in EXPLAIN/ANALYZE FORMAT=JSON	2024-07-11 17:40:39 +07:00
analyze-sync_with_master.test
analyze-timeout.test
assert.inc
assert_grep.inc
autoinc_mdev15353.inc
begin_include_file.inc
big_test.inc
big_test.require
binlog_inject_error.inc
binlog_parallel_replication_marks.test
binlog_start_pos.inc
bug38347.inc
bytes.inc
bytes2.inc
case_insensitive_file_system.require
case_insensitive_fs.require
case_sensitive_file_system.require
check-testcase.test
check-warnings.test
check_concurrent_insert.inc
check_events_off.inc
check_ftwrl_compatible.inc
check_ftwrl_incompatible.inc
check_ipv6.inc
check_key_reads.inc
check_key_req.inc
check_no_concurrent_insert.inc
check_no_row_lock.inc
check_shared_row_lock.inc
check_slave_is_running.inc
check_slave_no_error.inc
check_slave_param.inc
check_var_limit.inc
check_var_limit.require
cleanup_fake_relay_log.inc
column_compression_rpl.inc
column_compression_syntax_varbinary.inc
column_compression_syntax_varchar.inc
commit.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
common-tests.inc
concurrent.inc
connect2.inc
count_sessions.inc
crash_mysqld.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
ctype_8bit.inc
ctype_ascii_order.inc
ctype_casefolding.inc
ctype_common.inc
ctype_czech.inc
ctype_datetime.inc
ctype_E05C.inc
ctype_filesort.inc
ctype_filesort2.inc
ctype_german.inc
ctype_heap.inc
ctype_ident_sys.inc
ctype_innodb_like.inc
ctype_like.inc
ctype_like_cond_propagation.inc
ctype_like_cond_propagation_utf8_german.inc
ctype_like_escape.inc
ctype_like_ignorable.inc
ctype_like_range_f1f2.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
ctype_like_range_mdev14350.inc
ctype_mdev13118.inc
ctype_myanmar.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
ctype_nopad_prefix_unique.inc	MDEV-30048 Prefix keys for CHAR work differently for MyISAM vs InnoDB	2023-10-24 03:35:48 +04:00
ctype_numconv.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
ctype_pad.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
ctype_pad_all_engines.inc
ctype_pad_space.inc
ctype_regex.inc
ctype_regex_utf8.inc
ctype_str_to_date.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
ctype_strtoll10.inc
ctype_thai.inc
ctype_uca_w2.inc
ctype_unescape.inc
ctype_unicode520.inc
ctype_unicode_latin.inc
ctype_utf8_ilseq.inc
ctype_utf8_table.inc
ctype_utf8mb3_uca_char.inc	MDEV-30048 Prefix keys for CHAR work differently for MyISAM vs InnoDB	2023-10-24 03:35:48 +04:00
ctype_utf8mb4.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
daemon_example_bad_format.ini
daemon_example_bad_soname.ini
dbt3_s001.inc
ddl_i18n.check_events.inc
ddl_i18n.check_sp.inc
ddl_i18n.check_triggers.inc
ddl_i18n.check_views.inc
deadlock.inc
default_charset.inc
default_client.cnf
default_group_order.cnf
default_my.cnf
default_mysqld.cnf	sporadic failure of perfschema.func_file_io	2024-05-05 21:37:07 +02:00
default_optimizer_switch.inc
delete_anonymous_users.inc	MDEV-26875: Wrong user in SET DEFAULT ROLE error	2023-10-30 18:39:56 +01:00
diff_servers.inc
diff_tables.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
empty_string_literal.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
end_include_file.inc
endspace.inc
ensure_binlog_row_event_columns.inc
equal_fields_propagation_datetime.inc
expect_crash.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
explain_non_select.inc
explain_utils.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
file_does_not_exist.inc
filter_file.inc
force_restart.inc
func_hybrid_type.inc
func_str_ascii_checksum.inc
function_defaults.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
function_defaults_notembedded.inc
galera_clear_sync_point.inc
galera_cluster.inc
galera_connect.inc
galera_diff.inc
galera_end.inc
galera_have_debug_sync.inc
galera_init.inc
galera_no_debug_sync.inc
galera_set_sync_point.inc
galera_signal_sync_point.inc
galera_sst_method.combinations	MDEV-31905 GTID inconsistency	2023-12-22 00:10:23 +01:00
galera_sst_method.inc	MDEV-31905 GTID inconsistency	2023-12-22 00:10:23 +01:00
galera_suspend.inc
galera_variables_ok.inc
galera_variables_ok_debug.inc
galera_wait_ready.inc
galera_wait_sync_point.inc
gap_lock_error_all.inc
gap_lock_error_cleanup.inc
gap_lock_error_init.inc
gap_lock_error_select.inc
gap_lock_error_update.inc
get_relay_log_pos.inc
gis_debug.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
gis_generic.inc	MDEV-32456: incorrect result of gis function in view protocol	2024-07-17 22:37:32 +05:30
gis_keys.inc
grant_cache.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
grep.inc
have_32bit.inc
have_64bit.inc
have_archive.inc
have_archive.opt
have_aria.inc
have_aria_used_for_temp_tables.inc
have_auth_named_pipe.inc
have_big5.inc
have_binlog_checksum_off.inc
have_binlog_format_mixed.inc
have_binlog_format_mixed.opt
have_binlog_format_mixed_or_row.inc
have_binlog_format_mixed_or_statement.inc
have_binlog_format_row.inc
have_binlog_format_row.opt
have_binlog_format_row_or_statement.inc
have_binlog_format_statement.inc
have_binlog_format_statement.opt
have_blackhole.inc
have_blackhole.opt
have_case_insensitive_file_system.inc
have_case_insensitive_fs.inc
have_case_sensitive_file_system.inc
have_collation.inc
have_compress.inc
have_compress.require
have_cp866.inc
have_cp932.inc
have_cp1250_ch.inc
have_cp1251.inc
have_crypt.inc
have_csv.inc
have_dbi_dbd-mariadb.inc
have_debug.inc
have_debug_sync.inc
have_des.inc
have_eucjpms.inc
have_euckr.inc
have_example_plugin.inc
have_file_key_management.inc
have_gb2312.inc
have_gbk.inc
have_geometry.inc
have_geometry.require
have_gzip.inc
have_hostname_cache.inc
have_innodb.inc	MDEV-23974 fixup: Cover all debug builds	2024-04-25 07:48:57 +03:00
have_innodb.opt	mtr: remove innodb combinations	2024-05-05 21:37:08 +02:00
have_innodb_4k.inc
have_innodb_4k.opt
have_innodb_8k.inc
have_innodb_8k.opt
have_innodb_16k.inc
have_innodb_16k.opt
have_innodb_32k.inc
have_innodb_32k.opt
have_innodb_64k.inc
have_innodb_64k.opt
have_innodb_max_16k.inc
have_ipv4_mapped.inc
have_koi8r.inc
have_latin2_ch.inc
have_local_infile.inc
have_local_infile.require
have_log_bin-master.opt
have_log_bin-slave.opt
have_log_bin.inc
have_lowercase0.inc
have_lowercase1.inc
have_lowercase2.inc
have_maria.inc
have_mariabackup.inc
have_max_indexes_64.inc
have_max_indexes_128.inc
have_met_timezone.require
have_metadata_lock_info.inc
have_metadata_lock_info.opt
have_moscow_leap_timezone.require
have_mutex_deadlock_detector.inc
have_normal_zlib.inc	Fix test failures on s390x in test following main.column_compression_rpl	2024-01-12 17:22:08 +01:00
have_numa.inc
have_openssl.inc
have_outfile.inc
have_outfile.require
have_partition.inc
have_partition.opt
have_perfschema.inc
have_perror.require
have_plugin_auth.inc
have_plugin_auth.opt
have_plugin_interface.inc
have_plugin_server.inc
have_pool_of_threads.inc
have_pool_of_threads.require
have_profiling.inc
have_profiling.require
have_query_cache.inc
have_query_cache.require
have_query_cache_disabled.inc
have_s3.inc
have_sequence.inc
have_sequence.opt
have_simple_parser.inc
have_sjis.inc
have_ssl_communication.inc
have_ssl_crypto_functs.inc
have_stat_tables.inc
have_stat_tables.opt
have_static_innodb.inc
have_symlink.inc
have_symlink.require
have_tis620.inc
have_tlsv13.inc	ssl_cipher parameter cannot configure TLSv1.3 and TLSv1.2 ciphers at the same time	2024-09-26 11:50:20 +02:00
have_type_mysql_json.inc
have_type_mysql_json.opt
have_ucs2.inc
have_udf.inc
have_ujis.inc
have_unix_socket.inc
have_unix_socket.opt
have_utf8.inc
have_utf8mb4.inc
have_utf8mb4.require
have_utf16.inc
have_utf16.require
have_utf32.inc
have_utf32.require
have_view_protocol.inc
have_working_dns.inc
have_working_dns.require
have_wsrep.inc
have_wsrep_enabled.inc
have_wsrep_provider.inc
have_xtrabackup.inc
icp_debug_kill.inc
icp_tests.inc	Merge branch '10.4' into 10.5	2023-11-08 12:59:00 +01:00
implicit_commit_helper.inc
index_merge1.inc	Removing MDEV-27871 from tastcases because it is not a bug	2024-06-28 16:45:50 +07:00
index_merge2.inc
index_merge_2sweeps.inc
index_merge_ror.inc
index_merge_ror_cpk.inc
innodb-index.inc
innodb_checksum_algorithm.combinations
innodb_checksum_algorithm.inc
innodb_encrypt_log.combinations
innodb_encrypt_log.inc
innodb_encrypt_tables.combinations
innodb_encrypt_tables.inc
innodb_page_size.combinations
innodb_page_size.inc
innodb_page_size_small.combinations
innodb_page_size_small.inc
innodb_prefix_index_cluster_optimization.combinations
innodb_prefix_index_cluster_optimization.inc
innodb_rollback_on_timeout.inc	fix tests after 349ca2be74	2024-05-08 20:01:17 +02:00
innodb_row_format.combinations
innodb_row_format.inc
innodb_stable_estimates.inc	MDEV-32901: innodb.mdev-14846 fails in 11.0	2023-12-05 19:26:30 +03:00
innodb_stable_estimates.opt	MDEV-32901: innodb.mdev-14846 fails in 11.0	2023-12-05 19:26:30 +03:00
innodb_trx_weight.inc
innodb_undo_tablespaces.combinations
innodb_undo_tablespaces.inc
install_plugin_if_exists.inc
io_thd_fault_injection.inc
ipv6.inc
ipv6_clients.inc
is_embedded.inc
is_embedded_no_privileges.inc
kill_and_restart_mysqld.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
kill_binlog_dump_threads.inc
kill_galera.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
kill_mysqld.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
kill_query.inc
kill_query_and_diff_master_slave.inc
libdaemon_example.ini
linux.inc
linux_sys_vars.inc
load_dump_and_upgrade.inc
load_sysvars.inc
loaddata_autocom.inc
log_bin.combinations	MDEV-34269 : 10.11.8 cluster becomes inconsistent when using composite primary key and partitioning	2024-06-07 18:26:08 +02:00
log_bin.inc	MDEV-34269 : 10.11.8 cluster becomes inconsistent when using composite primary key and partitioning	2024-06-07 18:26:08 +02:00
log_slow_debug_common.inc
long_test.inc
lowercase0.require
lowercase1.require
lowercase2.require
maria_empty_logs.inc	MDEV-31349 test maria.maria-purge failed on 'aria_log.00000002 not found'	2023-10-08 18:16:20 +03:00
maria_make_snapshot.inc
maria_make_snapshot_for_comparison.inc
maria_make_snapshot_for_feeding_recovery.inc
maria_verify_recovery.inc
master-slave.inc
max_indexes.inc
maybe_debug.combinations
maybe_debug.inc
maybe_pool_of_threads.combinations
maybe_pool_of_threads.inc
maybe_versioning.combinations
maybe_versioning.inc
min_null_cond.inc
mix1.inc
mix2.inc
mix2_ucs2.inc
mrr_tests.inc
mtr_check.sql
mtr_warnings.sql
mysql_upgrade_preparation.inc
mysqladmin_shutdown.inc
mysqlbinlog_have_debug.inc
mysqldump.inc
mysqlhotcopy.inc
mysqltest-x.inc
no_protocol.inc
no_running_event_scheduler.inc
no_running_events.inc
no_valgrind_without_big.inc
no_view_protocol.inc
not_aix.inc
not_as_root.inc
not_asan.inc
not_binlog_format_row.inc
not_blackhole.inc
not_crashrep.inc
not_debug.inc
not_embedded.inc
not_encrypted.inc
not_msan.inc
not_parallel.inc
not_ssl.inc
not_staging.inc
not_staging.require
not_threadpool.inc
not_ubsan.inc
not_valgrind.inc
not_valgrind.require
not_valgrind_build.inc	Revert "mtr: remove not_valgrind_build"	2024-08-19 10:59:57 +03:00
not_var_link.inc
not_windows.inc
not_windows_embedded.inc
one_thread_per_connection.inc
one_thread_per_connection.require
parser_bug21114.inc
partition_date_range.inc
partition_mrr.inc
percona_nonflushing_analyze_debug.inc
platform.combinations
platform.inc
plugin.defs
ps_conv.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
ps_create.inc
ps_ddl_1.inc
ps_modify.inc
ps_modify1.inc
ps_query.inc
ps_renew.inc
query_cache.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
query_cache_partitions.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
query_cache_sql_prepare.inc
read_many_rows.inc
relocate_binlogs.inc
require_openssl_client.inc
reset_master_slave.inc
restart_mysqld.inc
restart_slave_sql.inc
restore_charset.inc
rowid_filter_debug_kill.inc	MDEV-30651: Assertion `sel->quick' in make_range_rowid_filters	2024-06-17 14:08:32 +03:00
rowid_order.inc
rpl_assert.inc
rpl_change_topology.inc	sporadic failures of rpl.rpl_semi_sync_master_shutdown	2024-04-10 19:38:39 +02:00
rpl_clone_slave_using_mariadb-backup.inc	MDEV-33355 Add a Galera-2-node-to-MariaDB replication MTR test cloning the slave with mariadb-backup	2024-02-01 18:28:32 +04:00
rpl_connect.inc
rpl_connection.inc
rpl_diff.inc
rpl_end.inc
rpl_for_each_slave.inc
rpl_generate_sync_chain.inc
rpl_init.combinations
rpl_init.inc	Merge branch '10.4' into 10.5	2023-09-15 12:04:44 +10:00
rpl_ip_mix.inc
rpl_ip_mix2.inc
rpl_ipv6.inc
rpl_loaddata_charset.inc
rpl_multi_engine.inc
rpl_multi_engine2.inc
rpl_multi_engine3.inc
rpl_reconnect.inc
rpl_reset.inc
rpl_restart_server.inc
rpl_row_img_general_loop.inc
rpl_row_img_set.inc
rpl_start_server.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
rpl_start_slaves.inc
rpl_stmt_seq.inc
rpl_stop_server.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
rpl_stop_slaves.inc
rpl_sync.inc
rpl_udf.inc
running_event_scheduler.inc
save_master_gtid.inc
save_master_pos.inc
search_pattern_in_file.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
set_binlog_format_mixed.sql
set_binlog_format_row.sql
set_binlog_format_statement.sql
setup_fake_relay_log.inc
show_all_slaves_status.inc
show_binary_logs.inc
show_binlog_events.inc
show_binlog_events2.inc
show_binlog_using_logname.inc
show_delayed_slave_state.inc
show_events.inc
show_gtid_list.inc
show_master_logs.inc
show_master_status.inc
show_msg.inc
show_msg80.inc
show_relaylog_events.inc
show_rpl_debug_info.inc
show_slave_hosts.inc
show_slave_status.inc
shutdown_mysqld.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
slow_environ.inc	mtr: increase timeouts under ASAN/UBSAN/MSAN	2024-04-05 12:40:49 +02:00
sp-vars.inc
sql_mode_pad_char_to_full_length.inc
start_mysqld.inc	MDEV-16944 Fix file sharing issues on Windows in mysqltest	2024-04-17 16:52:37 +02:00
start_slave.inc
stop_dump_threads.inc
stop_slave.inc
stop_slave_io.inc	rpl.rpl_domain_id_filter_master_crash failed on msan builder	2024-04-05 12:40:49 +02:00
stop_slave_sql.inc
strict_autoinc.inc
subselect_mat_cost.inc
support_long_file_names.inc
switch_to_mysql_global_priv.inc
switch_to_mysql_user.inc
sync_io_with_master.inc
sync_slave_io_with_master.inc
sync_slave_sql_with_io.inc	mtr: increase timeouts under ASAN/UBSAN/MSAN	2024-04-05 12:40:49 +02:00
sync_slave_sql_with_master.inc
sync_with_master.inc
sync_with_master_gtid.inc	mtr: increase timeouts under ASAN/UBSAN/MSAN	2024-04-05 12:40:49 +02:00
system_db_struct.inc
test_fieldsize.inc
test_outfile.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
testdb_only.inc
tpcb.inc
tpcb_disk_data.inc
true.require
truncate_file.inc
type_hrtime.inc
type_temporal_zero_default.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
unsafe_binlog.inc
update_use_source.inc
uses_vardir.inc
varchar.inc
view_alias.inc
wait_condition.inc
wait_condition_sp.inc
wait_condition_with_debug.inc
wait_for_binlog_checkpoint.inc
wait_for_binlog_event.inc
wait_for_line_count_in_file.inc
wait_for_purge.inc
wait_for_query_to_fail.inc
wait_for_query_to_succeed.inc
wait_for_slave_io_error.inc	MDEV-32168: slave_error_param condition is never checked from the wait_for_slave_param.inc	2023-11-16 10:41:11 +01:00
wait_for_slave_io_to_start.inc
wait_for_slave_io_to_stop.inc	MDEV-32168: slave_error_param condition is never checked from the wait_for_slave_param.inc	2023-11-28 19:10:42 +01:00
wait_for_slave_param.inc	mtr: increase timeouts under ASAN/UBSAN/MSAN	2024-04-05 12:40:49 +02:00
wait_for_slave_sql_error.inc
wait_for_slave_sql_error_and_skip.inc
wait_for_slave_sql_to_start.inc
wait_for_slave_sql_to_stop.inc	MDEV-32168: slave_error_param condition is never checked from the wait_for_slave_param.inc	2023-11-17 19:44:11 +01:00
wait_for_slave_to_start.inc
wait_for_slave_to_stop.inc
wait_for_sql_thread_read_all.inc
wait_for_status_var.inc
wait_show_condition.inc
wait_until_connected_again.inc
wait_until_count_sessions.inc
wait_until_disconnected.inc
wait_until_no_pidfile.inc	MDEV-31349 test maria.maria-purge failed on 'aria_log.00000002 not found'	2023-10-08 18:16:20 +03:00
wait_until_ready.inc
wait_until_rows_count.inc
wait_wsrep_ready.inc
weight_string.inc
weight_string_8EA1.inc
weight_string_8FA2C3.inc
weight_string_8140.inc
weight_string_A1A1.inc
weight_string_chde.inc
weight_string_euro.inc
weight_string_l1.inc
weight_string_l2.inc
weight_string_l3.inc
weight_string_l4.inc
weight_string_l12.inc
weight_string_l14.inc
windows.inc
windows_sys_vars.inc
word_size.combinations
word_size.inc
world.inc
world_schema.inc
world_schema1.inc
world_schema_utf8.inc
write_result_to_file.inc
write_var_to_file.inc	MDEV-31005: Make working cursor-protocol	2024-09-18 18:39:26 +07:00
wsrep_wait_condition.inc
wsrep_wait_disconnect.inc
wsrep_wait_membership.inc