go-sql-driver / mysql
83%
master: 82%

LAST BUILD BRANCH: update-internals-links
DEFAULT BRANCH: master
Repo Added
Files 19
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH tls-mysql5-docs
branch: tls-mysql5-docs
CHANGE BRANCH
x

coverage: 83.141%. Remained the same
12592841133

Pull #1657

github

evanelias 
Improve TLS documentation for older servers

Older/EOL database server versions tend to be built with ancient OpenSSL or
yaSSL, which lack support for modern cipher suites and/or lack TLS 1.2+. At
the same time, recent Golang versions have updated the default client
tls.Config in ways that are incompatible with these old server versions. This
commit improves TLS documentation to mention this incompatibility, provide
sample code for solving it, and explain how "preferred" plaintext fallback
mode is not triggered in cases of TLS incompatibilities.

Closes #1635 by providing example code for solving the handshake failure.

Additional information which may be helpful for reviewers/maintainers:

TLS version
* Go 1.18+ changes the default client TLS MinVersion to be TLS 1.2
* MySQL 5.5 and 5.6 supports TLS 1.0
* MySQL 5.7.0-5.7.27 supports TLS 1.1
* MySQL 5.7.28+ supports TLS 1.2
* MariaDB 10.1+ supports TLS 1.2
* I did not examine MySQL 5.1 or MariaDB 10.0 or anything more ancient

Cipher suites
* Go 1.22+ changes the default client TLS config to remove cipher suites which
  use RSA key exchange
* MySQL 8.0+ and MariaDB 10.2+ fully support ECDHE cipher suites and are
  compatible with Go's current default cipher suite list.
* MySQL 5.x typically needs RSA key exchange cipher suites, due to
  https://bugs.mysql.com/bug.php?id=82935. Likewise for MariaDB 10.1.
* There are some exceptions, for example Percona Server 5.7 is built with a
  newer OpenSSL, https://docs.percona.com/percona-server/5.7/security/ssl-improvement.html
* It is also possible to custom compile MySQL 5.7 with a newer OpenSSL
  version to solve the cipher suite issue, but this is not common.
Pull Request #1657: Improve TLS documentation for older servers

3250 of 3909 relevant lines covered (83.14%)

2462629.21 hits per line

Relevant lines Covered
3909 RELEVANT LINES 3250 COVERED LINES
2462629.21 HITS PER LINE
Source Files on tls-mysql5-docs

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
12592841133 tls-mysql5-docs Improve TLS documentation for older servers Older/EOL database server versions tend to be built with ancient OpenSSL or yaSSL, which lack support for modern cipher suites and/or lack TLS 1.2+. At the same time, recent Golang versions have updated... Pull #1657 evanelias github
83.14
See All Builds (1506)