skeema / skeema / 12334053357

93%

main: 92%

push

github

tests: TLS coverage for flavors lacking automatic support

In MySQL 5.7+ and MariaDB 11.4+, encrypted connections are available out-of-
the-box, since these flavors create self-signed certs automatically upon
server initialization. In the previous commit, integration test coverage for
TLS connections was added into TestInitHandler for these flavors. However,
similar TLS coverage was missing for older flavors.

This commit adds the missing coverage for older flavors, by including logic
to enable TLS in any database container as needed.

This also inherently tests legacy TLS edge-cases:

* TLS 1.0 support for MySQL 5.5-5.6
* RSA kex cipher suites in MySQL 5.5-5.6 and MariaDB 10.1

This commit includes self-signed certs in a testdata subdirectory. These
should only ever be used for testing purposes, and were generated as follows:

  openssl genrsa 4096 > ca-key.pem
  openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem
  openssl req -newkey rsa:2048 -days 365000 -nodes -keyout server-key.pem -out server-req.pem
  openssl rsa -in server-key.pem -out server-key.pem
  openssl x509 -req -in server-req.pem -days 365000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

25 of 33 new or added lines in 2 files covered. (75.76%)

10219 of 10969 relevant lines covered (93.16%)

1.11 hits per line