Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve SSL settings, reflect changes for BACKRONYM and Riddle vulnerabilities, enforce SSL encryption when mysql_ssl=1 is set #114

Merged
merged 4 commits into from Apr 17, 2017
Merged

Improve SSL settings, reflect changes for BACKRONYM and Riddle vulnerabilities, enforce SSL encryption when mysql_ssl=1 is set #114

merged 4 commits into from Apr 17, 2017

Commits on Apr 15, 2017

  1. Describe all SSL related attributes in POD documentation

    @pali
    pali committed Apr 15, 2017
    Copy the full SHA
    95b7838 View commit details
    Browse the repository at this point in the history

  2. Enforce SSL encryption when mysql_ssl=1 is set 

    This reflect changes between different versions of libmysqlclient.so and
finally fix library usage to handle BACKRONYM and Riddle vulnerabilities.

Due to fixing vulnerabilities, it changes also behavior of mysql_ssl=1
attribute from opportunistic mode to enforced mode of SSL. Now DBD::mysql
with mysql_ssl=1 fails to connect to non-SSL server.
    @pali
    pali committed Apr 15, 2017
    Copy the full SHA
    a681e2c View commit details
    Browse the repository at this point in the history

  3. Add new connection attribute mysql_ssl_optional 

    When set, SSL encryption is not enforced and allow DBD::mysql to fallback
to plain text protocol if server does not support SSL. Older MySQL and
MariaDB client versions does not support enforced SSL mode due to BACKRONYM
and Riddle vulnerabilities.
    @pali
    pali committed Apr 15, 2017
    Copy the full SHA
    b6be72f View commit details
    Browse the repository at this point in the history

  4. Add new database handle attribute mysql_ssl_cipher 

    It returns SSL encryption cipher or undef if SSL is not used. It can be
used by application to check if SSL was established or not.
    @pali
    pali committed Apr 15, 2017
    Copy the full SHA
    d36a5a6 View commit details
    Browse the repository at this point in the history