skeema / skeema / 12517593774

92%

push

github

TLS: very old MySQL 5.7 point releases can't use TLS 1.2

Recent commit 6d2daf0 permits TLS 1.0 when communicating with MySQL 5.5-5.6,
overriding the modern Golang default minimum of TLS 1.2 only for those server
versions. However, older point releases of MySQL 5.7 don't support TLS 1.2
either, requiring a slight adjustment in the conditional logic.

Prior to MySQL 5.7.28 (Oct 2019), MySQL 5.7 CE was built with yaSSL, which
only supports TLS 1.1. MySQL 5.7.28+ was built with OpenSSL, which supports
TLS 1.2. https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-28.html

Real-world usage of such old 5.7 point releases is uncommon, so in terms of
minimum TLS version, this commit simply buckets pre-5.7.28 alongside 5.5-5.6
and technically permits TLS 1.0. However, TLS 1.1 will be chosen in the
handshake when communicating with a pre-5.7.28 release of 5.7.

This commit also improves integration test coverage relating to older-version
TLS configuration fallback logic. In addition to the usual flavors handled
by automated testing, this has been manually run against 5.7.27 and 5.7.28 to
ensure the behavior appears correct, both for `skeema init` (which is always
permissive with TLS configuration since the server flavor hasn't been
introspected yet) and subsequent commands (which tailor the TLS config to the
specific flavor).

2 of 2 new or added lines in 1 file covered. (100.0%)

10233 of 10983 relevant lines covered (93.17%)

1.11 hits per line