mirror of
https://github.com/MariaDB/server.git
synced 2025-01-16 12:02:42 +01:00
d13080133f
Server and command line tools now support option --tls_version to specify the TLS version between client and server. Valid values are TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 or a combination of them. E.g. --tls_version=TLSv1.3 --tls_version=TLSv1.2,TLSv1.3 In case there is a gap between versions, the lowest version will be used: --tls_version=TLSv1.1,TLSv1.3 -> Only TLSv1.1 will be available. If the used TLS library doesn't support the specified TLS version, it will use the default configuration. Limitations: SSLv3 is not supported. The default configuration doesn't support TLSv1.0 anymore. TLSv1.3 protocol currently is only supported by OpenSSL 1.1.0 (client and server) and GnuTLS 3.6.5 (client only). Overview of TLS implementations and protocols Server: +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | WolfSSL | TLSv1.1, TLSv1,2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ Client (MariaDB Connector/C) +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | GnuTLS | (TLSv1.0), TLSv1.1, TLSv1.2, TLSv1.3 | +-----------+-----------------------------------------+ | Schannel | (TLSv1.0), TLSv1.1, TLSv1.2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+
24 lines
1.3 KiB
Text
24 lines
1.3 KiB
Text
# Tests for SSL connections, only run if mysqld is compiled
|
|
# with support for SSL.
|
|
|
|
-- source include/have_ssl_communication.inc
|
|
#default is highest available version: TLSv1.2
|
|
--exec $MYSQL --host=localhost --ssl -e "show status like 'ssl_version';"
|
|
# TLSv1.2
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.2 -e "show status like 'ssl_version';"
|
|
# TLSv1.1
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.1 -e "show status like 'ssl_version';"
|
|
# if a gap is between TLS versions, lowest version number should be used (TLS1.1)
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.1,TLSv1.3 -e "show status like 'ssl_version';"
|
|
# TLSv1.3 is not enabled, so TLSv1.2 should be used
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.2,TLSv1.3 -e "show status like 'ssl_version';"
|
|
# Highest TLS version number should be used (TLSv1.2)
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.1,TLSv1.2 -e "show status like 'ssl_version';"
|
|
# Errors:
|
|
# TLS v1.0 is disabled on server, so we should get an error
|
|
--replace_regex /2026 SSL connection error.*/2026 SSL connection error: xxxx/
|
|
--error 1
|
|
--exec $MYSQL --host=localhost --ssl --tls_version=TLSv1.0 -e "show status like 'ssl_version';"
|
|
# finally list available protocols
|
|
--exec $MYSQL --host=localhost --ssl -e "select @@tls_version;"
|
|
|