Add API to express like a --ssl-mode=PREFERRED MySQL client
#1370
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -46,13 +46,14 @@ type Config struct { | |
| ServerPubKey string // Server public key name | ||
| pubKey *rsa.PublicKey // Server public key | ||
| TLSConfig string // TLS configuration name | ||
| TLS *tls.Config // TLS configuration, its priority is higher than TLSConfig | ||
| Timeout time.Duration // Dial timeout | ||
| ReadTimeout time.Duration // I/O read timeout | ||
| WriteTimeout time.Duration // I/O write timeout | ||
|
|
||
| AllowAllFiles bool // Allow all files to be used with LOAD DATA LOCAL INFILE | ||
| AllowCleartextPasswords bool // Allows the cleartext client side plugin | ||
| AllowFallbackToNoTLS bool // Allows fallback to unencrypted connection if server does not support TLS | ||
| AllowNativePasswords bool // Allows the native password authentication method | ||
| AllowOldPasswords bool // Allows the old insecure password method | ||
| CheckConnLiveness bool // Check connections for liveness before using them | ||
|
|
@@ -77,8 +78,8 @@ func NewConfig() *Config { | |
|
|
||
| func (cfg *Config) Clone() *Config { | ||
| cp := *cfg | ||
| if cp.TLS != nil { | ||
| cp.TLS = cfg.TLS.Clone() | ||
| } | ||
| if len(cp.Params) > 0 { | ||
| cp.Params = make(map[string]string, len(cfg.Params)) | ||
|
|
@@ -119,24 +120,29 @@ func (cfg *Config) normalize() error { | |
| cfg.Addr = ensureHavePort(cfg.Addr) | ||
| } | ||
|
|
||
| if cfg.TLS == nil { | ||
| switch cfg.TLSConfig { | ||
| case "false", "": | ||
| // don't set anything | ||
| case "true": | ||
| cfg.TLS = &tls.Config{} | ||
| case "skip-verify": | ||
| cfg.TLS = &tls.Config{InsecureSkipVerify: true} | ||
|
Check failure Code scanning / CodeQL Disabled TLS certificate check |
||
| case "preferred": | ||
| cfg.TLS = &tls.Config{InsecureSkipVerify: true} | ||
|
||
| cfg.AllowFallbackToNoTLS = true | ||
| default: | ||
| cfg.TLS = getTLSConfigClone(cfg.TLSConfig) | ||
| if cfg.TLS == nil { | ||
| return errors.New("invalid value / unknown config name: " + cfg.TLSConfig) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if cfg.TLS != nil && cfg.TLS.ServerName == "" && !cfg.TLS.InsecureSkipVerify { | ||
| host, _, err := net.SplitHostPort(cfg.Addr) | ||
| if err == nil { | ||
| cfg.TLS.ServerName = host | ||
| } | ||
| } | ||
|
|
||
|
|
@@ -204,6 +210,10 @@ func (cfg *Config) FormatDSN() string { | |
| writeDSNParam(&buf, &hasParam, "allowCleartextPasswords", "true") | ||
| } | ||
|
|
||
| if cfg.AllowFallbackToNoTLS { | ||
| writeDSNParam(&buf, &hasParam, "allowFallbackToNoTLS", "true") | ||
| } | ||
|
|
||
| if !cfg.AllowNativePasswords { | ||
| writeDSNParam(&buf, &hasParam, "allowNativePasswords", "false") | ||
| } | ||
|
|
@@ -391,6 +401,14 @@ func parseDSNParams(cfg *Config, params string) (err error) { | |
| return errors.New("invalid bool value: " + value) | ||
| } | ||
|
|
||
| // Allow fallback to unencrypted connection if server does not support TLS | ||
| case "allowFallbackToNoTLS": | ||
|
There was a problem hiding this comment. What if setting There was a problem hiding this comment. OK, I should give more detailed description on "when will the driver fallback to no TLS", does it happen on TLS identity verify error, not supported TLS version or server not enable TLS? I want a fallback for the last cases, and maybe the name should contain "TLSHandshake" or something. Will learn the TLS concepts to find a good name later. Welcome to give me some advice also cc @dveeden |
||
| var isBool bool | ||
| cfg.AllowFallbackToNoTLS, isBool = readBool(value) | ||
| if !isBool { | ||
| return errors.New("invalid bool value: " + value) | ||
| } | ||
|
|
||
| // Use native password authentication | ||
| case "allowNativePasswords": | ||
| var isBool bool | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In this version, does it still need to be public?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes it does not need to be public, we can still use the old way to register a TLS config and use key name to find it.
Let the maintainer to decide if we can add a short path 😄