Skip to content

Commit d130801

Browse files
9EOR9vuvova
9EOR9
authored and
vuvova
committed
MDEV-14101 Provide an option to select TLS protocol version
Server and command line tools now support option --tls_version to specify the TLS version between client and server. Valid values are TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 or a combination of them. E.g. --tls_version=TLSv1.3 --tls_version=TLSv1.2,TLSv1.3 In case there is a gap between versions, the lowest version will be used: --tls_version=TLSv1.1,TLSv1.3 -> Only TLSv1.1 will be available. If the used TLS library doesn't support the specified TLS version, it will use the default configuration. Limitations: SSLv3 is not supported. The default configuration doesn't support TLSv1.0 anymore. TLSv1.3 protocol currently is only supported by OpenSSL 1.1.0 (client and server) and GnuTLS 3.6.5 (client only). Overview of TLS implementations and protocols Server: +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | WolfSSL | TLSv1.1, TLSv1,2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ Client (MariaDB Connector/C) +-----------+-----------------------------------------+ | Library | Supported TLS versions | +-----------+-----------------------------------------+ | GnuTLS | (TLSv1.0), TLSv1.1, TLSv1.2, TLSv1.3 | +-----------+-----------------------------------------+ | Schannel | (TLSv1.0), TLSv1.1, TLSv1.2 | +-----------+-----------------------------------------+ | OpenSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+ | LibreSSL | (TLSv1.0), TLSv1.1, TLSv1,2, TLSv1.3 | +-----------+-----------------------------------------+
1 parent 379ffc6 commit d130801

25 files changed

+189
-27
lines changed

‎client/client_priv.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ enum options_client
4646
OPT_MAX_ALLOWED_PACKET, OPT_NET_BUFFER_LENGTH,
4747
OPT_SELECT_LIMIT, OPT_MAX_JOIN_SIZE, OPT_SSL_SSL,
4848
OPT_SSL_KEY, OPT_SSL_CERT, OPT_SSL_CA, OPT_SSL_CAPATH,
49-
OPT_SSL_CIPHER, OPT_SHUTDOWN_TIMEOUT, OPT_LOCAL_INFILE,
49+
OPT_SSL_CIPHER, OPT_TLS_VERSION, OPT_SHUTDOWN_TIMEOUT, OPT_LOCAL_INFILE,
5050
OPT_DELETE_MASTER_LOGS, OPT_COMPACT,
5151
OPT_PROMPT, OPT_IGN_LINES,OPT_TRANSACTION,OPT_MYSQL_PROTOCOL,
5252
OPT_FRM, OPT_SKIP_OPTIMIZATION,

‎client/mysql.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1363,6 +1363,7 @@ static bool do_connect(MYSQL *mysql, const char *host, const char *user,
13631363
opt_ssl_capath, opt_ssl_cipher);
13641364
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
13651365
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
1366+
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
13661367
}
13671368
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
13681369
(char*)&opt_ssl_verify_server_cert);

‎client/mysqladmin.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,7 @@ int main(int argc,char *argv[])
359359
opt_ssl_capath, opt_ssl_cipher);
360360
mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
361361
mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
362+
mysql_options(&mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
362363
}
363364
mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
364365
(char*)&opt_ssl_verify_server_cert);

‎client/mysqlbinlog.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2126,6 +2126,7 @@ static Exit_status safe_connect()
21262126
opt_ssl_capath, opt_ssl_cipher);
21272127
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
21282128
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
2129+
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
21292130
}
21302131
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
21312132
(char*)&opt_ssl_verify_server_cert);

‎client/mysqldump.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1709,6 +1709,7 @@ static int connect_to_db(char *host, char *user,char *passwd)
17091709
opt_ssl_capath, opt_ssl_cipher);
17101710
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
17111711
mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
1712+
mysql_options(&mysql_connection, MARIADB_OPT_TLS_VERSION, opt_tls_version);
17121713
}
17131714
mysql_options(&mysql_connection,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
17141715
(char*)&opt_ssl_verify_server_cert);

‎client/mysqlimport.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -448,6 +448,7 @@ static MYSQL *db_connect(char *host, char *database,
448448
opt_ssl_capath, opt_ssl_cipher);
449449
mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
450450
mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
451+
mysql_options(mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
451452
}
452453
mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
453454
(char*)&opt_ssl_verify_server_cert);

‎client/mysqlshow.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ int main(int argc, char **argv)
122122
opt_ssl_capath, opt_ssl_cipher);
123123
mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
124124
mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
125+
mysql_options(&mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
125126
}
126127
mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
127128
(char*)&opt_ssl_verify_server_cert);

‎client/mysqltest.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6068,6 +6068,7 @@ void do_connect(struct st_command *command)
60686068
opt_ssl_capath, ssl_cipher ? ssl_cipher : opt_ssl_cipher);
60696069
mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
60706070
mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
6071+
mysql_options(con_slot->mysql, MARIADB_OPT_TLS_VERSION, opt_tls_version);
60716072
#if MYSQL_VERSION_ID >= 50000
60726073
/* Turn on ssl_verify_server_cert only if host is "localhost" */
60736074
opt_ssl_verify_server_cert= !strcmp(ds_host.str, "localhost");

‎extra/mariabackup/xtrabackup.cc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ static char* log_ignored_opt;
199199

200200

201201
extern my_bool opt_use_ssl;
202+
extern char *opt_tls_version;
202203
my_bool opt_ssl_verify_server_cert;
203204
my_bool opt_extended_validation;
204205
my_bool opt_encrypted_backup;
@@ -830,6 +831,7 @@ enum options_xtrabackup
830831
OPT_XTRA_CHECK_PRIVILEGES
831832
};
832833

834+
833835
struct my_option xb_client_options[] =
834836
{
835837
{"verbose", 'V', "display verbose output",

‎include/sslopt-longopts.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@
4646
"Certificate revocation list path (implies --ssl).",
4747
&opt_ssl_crlpath, &opt_ssl_crlpath, 0, GET_STR, REQUIRED_ARG,
4848
0, 0, 0, 0, 0, 0},
49+
{"tls-version", OPT_TLS_VERSION,
50+
"TLS protocol version for secure connection.",
51+
&opt_tls_version, &opt_tls_version, 0, GET_STR, REQUIRED_ARG,
52+
0, 0, 0, 0, 0, 0},
53+
4954
#ifdef MYSQL_CLIENT
5055
{"ssl-verify-server-cert", OPT_SSL_VERIFY_SERVER_CERT,
5156
"Verify server's \"Common Name\" in its cert against hostname used "

0 commit comments

Comments
 (0)