Porting of "Zero config TLS" MariaDB feature support from mysql-simple - #403
Open
lawrinn wants to merge 1 commit into
Open
Porting of "Zero config TLS" MariaDB feature support from mysql-simple#403lawrinn wants to merge 1 commit into
lawrinn wants to merge 1 commit into
Conversation
It's based on auth plugins design cnahge in mysql_common 0.38.0 - considers all changes added to the mysql-simple patch. "Zero Config SSL" allows easy secure encrypted connection configuration with MariaDB server versions 11.4.1+. The only thing the application need for that is request encrypted connection and require certificate validation. The server can generate ephemeral certificate if needed. In case normal certificate validation failed the client still have chance to ensure that the certificate is valid and connection is secure. For this purpose the server send additional information - SHA256(password_hash || scramble || certificate fingerprint)). The client knows all three parts required to calculate this signature. If calculated and received hash match - the certificate is considered validated and the connection - secure. This won't work with empty user passwords and insecure authentication plugins. i.e. it only work with native password, ed25519 and parsec plugins. In such case the error returned that the certificate could not be validated. Also it's only used if server's certificate is ephemeral and no CA is provided for connection - those were the latest additions. The feature is only supported with rustls backend only.
Contributor
Author
Contributor
Author
|
I will look into test failure - did not have it locally(on Windows) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
It's based on auth plugins design change in mysql_common 0.38.0 - considers all changes added to the mysql-simple patch. In particular, it's only used if server's certificate is ephemeral and no CA is provided for connection - those were the latest additions.
I probably should have waited till you adopt this change in the async. Feel free to decline it :) I hope it still can be a good start.
"Zero Config SSL" allows easy secure encrypted connection configuration with MariaDB server versions 11.4.1+. The only thing the application need for that is request encrypted connection and require certificate validation. The server can generate ephemeral certificate if needed. In case normal certificate validation failed the client still have chance to ensure that the certificate is valid and connection is secure. For this purpose the server send additional information - SHA256(password_hash || scramble || certificate fingerprint)). The client knows all three parts required to calculate this signature. If calculated and received hash match - the certificate is considered validated and the connection - secure.
This won't work with empty user passwords and insecure authentication plugins. i.e. it only work with native password, ed25519 and parsec plugins. In such case the error returned that the certificate could not be validated.
The feature is only supported with rustls backend only.