Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add MTRs to further test coverage around TLS functionality #3540

Open
wants to merge 2 commits into
base: 10.11
Choose a base branch
from
+28 −0
Open

Add MTRs to further test coverage around TLS functionality #3540

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5e66843
Add MTR to ensure startup fails with invalid ssl-cipher
tonychen2001 Sep 20, 2024
3eaf625
Add MTR to verify behavior on incompatible TLS configuration
tonychen2001 Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions mysql-test/main/bad_startup_options.result
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
FOUND 1 /\[ERROR\] SSL error: Unable to get certificate/ in errorlog.err
FOUND 1 /\[ERROR\] SSL error: Failed to set ciphers to use/ in errorlog.err
# restart
7 changes: 7 additions & 0 deletions mysql-test/main/bad_startup_options.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,11 @@
--source include/search_pattern_in_file.inc
--remove_file $SEARCH_FILE

# No valid cipher suites
--error 1
--exec $MYSQLD --defaults-group-suffix=.1 --defaults-file=$MYSQLTEST_VARDIR/my.cnf --ssl-cipher=ECDHE-ECDSA-FAKE-CIPHER:ECDHE-RSA-INVALID --log-error=$errorlog
--let SEARCH_PATTERN=\[ERROR\] SSL error: Failed to set ciphers to use
--source include/search_pattern_in_file.inc
--remove_file $SEARCH_FILE

--source include/start_mysqld.inc
3 changes: 3 additions & 0 deletions mysql-test/main/ssl_cipher.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,3 +68,6 @@ disconnect ssl_con;
connection default;
call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
FOUND 2 /TLSv1.0 and TLSv1.1 are insecure/ in mysqld.1.err
# restart: --ssl-cipher=ECDHE-ECDSA-AES128-GCM-SHA256
Variable_name Value
Ssl_version
17 changes: 17 additions & 0 deletions mysql-test/main/ssl_cipher.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,3 +112,20 @@ call mtr.add_suppression("TLSv1.0 and TLSv1.1 are insecure");
--let SEARCH_FILE=$MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN= TLSv1.0 and TLSv1.1 are insecure
--source include/search_pattern_in_file.inc

#
# Server is configured with ciphers that are not compatible with the server certificate (std_data/cacert.pem is RSA)
#
let $restart_parameters=--ssl-cipher=ECDHE-ECDSA-AES128-GCM-SHA256;
source include/restart_mysqld.inc;

# Connections are rejected as client attempts tls by default
--error 1
--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'ssl_version'"

# Connections are rejected if client explicitly specifies tls
--error 1
--exec $MYSQL --host=localhost --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl-verify-server-cert -e "SHOW STATUS LIKE 'ssl_version'"

# Connections can be made with --skip-ssl
--exec $MYSQL --host=localhost --skip-ssl -e "SHOW STATUS LIKE 'ssl_version'"