Skip to content

Commit fb18962

Browse files
harinvadodariaharinvadodaria
committed
WL#15800: Deprecate usage of weak ciphers in server
Description: - Added deprecated cipher checks in server. - Removed deprecated ciphers from server default - Added test cases - Fixed test cases: Removed usage of deprecated ciphers Change-Id: I68d21d2cb2f27c4d38c6b955bc1ac02e13104c4f
1 parent 24748b0 commit fb18962

File tree

71 files changed

+6787
-1007
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

71 files changed

+6787
-1007
lines changed

‎include/tls_ciphers.h

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
/*
2+
Copyright (c) 2018, 2023, Oracle and/or its affiliates.
3+
4+
This program is free software; you can redistribute it and/or modify
5+
it under the terms of the GNU General Public License, version 2.0,
6+
as published by the Free Software Foundation.
7+
8+
This program is also distributed with certain software (including
9+
but not limited to OpenSSL) that is licensed under separate terms,
10+
as designated in a particular file or component or in included license
11+
documentation. The authors of MySQL hereby grant you an additional
12+
permission to link the program and your derivative works with the
13+
separately licensed software that they have included with MySQL.
14+
15+
This program is distributed in the hope that it will be useful,
16+
but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
GNU General Public License for more details.
19+
20+
You should have received a copy of the GNU General Public License
21+
along with this program; if not, write to the Free Software
22+
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
*/
24+
25+
#ifndef TLS_CIPHERS_INCLUDED
26+
#define TLS_CIPHERS_INCLUDED
27+
28+
namespace {
29+
30+
/**
31+
Configuring list of ciphers
32+
33+
TLSv1.2
34+
=======
35+
Server: Specify in folllowing order:
36+
1. Blocked ciphers
37+
2. Approved ciphers
38+
39+
Client: Specify in following order:
40+
1. Blocked ciphers
41+
2. Approved ciphers
42+
3. Client specific ciphers
43+
44+
TLSv1.3
45+
=======
46+
Server: Specify in folllowing order:
47+
1. Blocked ciphers (None atm)
48+
2. Approved ciphers
49+
50+
Client: Specify in following order:
51+
1. Blocked ciphers (None atm)
52+
2. Approved ciphers
53+
3. Client specific ciphers (None atm)
54+
55+
*/
56+
57+
/*
58+
List of TLSv1.3 ciphers in order to their priority.
59+
Addition to the list must be done keeping priority of the
60+
new cipher in mind.
61+
The last entry must not contain a trailing ":".
62+
63+
Current criteria for inclusion is:
64+
1. Must provide Perfect Forward Secrecy
65+
2. Uses SHA2 in cipher/certificate
66+
3. Uses AES in GCM or any other AEAD algorithms/modes
67+
*/
68+
const char default_tls13_ciphers[] = {
69+
"TLS_AES_128_GCM_SHA256:"
70+
"TLS_AES_256_GCM_SHA384:"
71+
"TLS_CHACHA20_POLY1305_SHA256:"
72+
"TLS_AES_128_CCM_SHA256"};
73+
74+
/*
75+
List of TLSv1.2 ciphers in order to their priority.
76+
Addition to the list must be done keeping priority of the
77+
new cipher in mind.
78+
The last entry must not contain a trailing ":".
79+
80+
Current criteria for inclusion is:
81+
1. Must provide Perfect Forward Secrecy
82+
2. Uses SHA2 in cipher/certificate
83+
3. Uses AES in GCM or any other AEAD algorithms/modes
84+
*/
85+
const char default_tls12_ciphers[] = {
86+
"ECDHE-ECDSA-AES128-GCM-SHA256:"
87+
"ECDHE-ECDSA-AES256-GCM-SHA384:"
88+
"ECDHE-RSA-AES128-GCM-SHA256:"
89+
"ECDHE-RSA-AES256-GCM-SHA384:"
90+
"ECDHE-ECDSA-CHACHA20-POLY1305:"
91+
"ECDHE-RSA-CHACHA20-POLY1305:"
92+
"ECDHE-ECDSA-AES256-CCM:"
93+
"ECDHE-ECDSA-AES128-CCM:"
94+
"DHE-RSA-AES128-GCM-SHA256:"
95+
"DHE-RSA-AES256-GCM-SHA384:"
96+
"DHE-RSA-AES256-CCM:"
97+
"DHE-RSA-AES128-CCM:"
98+
"DHE-RSA-CHACHA20-POLY1305"};
99+
100+
/*
101+
Following ciphers (or categories of ciphers) are not permitted
102+
because they are too weak to provide required security.
103+
104+
New cipher/category can be added at any position.
105+
106+
Care must be taken to prefix cipher/category with "!"
107+
*/
108+
const char blocked_tls12_ciphers[] = {
109+
"!aNULL:"
110+
"!eNULL:"
111+
"!EXPORT:"
112+
"!LOW:"
113+
"!MD5:"
114+
"!DES:"
115+
"!3DES:"
116+
"!RC2:"
117+
"!RC4:"
118+
"!PSK:"
119+
"!DH-RSA-AES128-SHA256:"
120+
"!DH-RSA-AES256-SHA256:"
121+
"!DH-DSS-AES128-SHA256:"
122+
"!DH-DSS-AES128-SHA:"
123+
"!DH-DSS-AES256-SHA:"
124+
"!DH-DSS-AES256-SHA256:"
125+
"!DH-RSA-AES128-SHA:"
126+
"!DH-RSA-AES256-SHA:"
127+
"!DH-DSS-AES128-GCM-SHA256:"
128+
"!DH-DSS-AES256-GCM-SHA384:"
129+
"!DH-RSA-AES128-GCM-SHA256:"
130+
"!DH-RSA-AES256-GCM-SHA384"};
131+
132+
/*
133+
Following ciphers are added to the list of permissible ciphers
134+
while configuring the ciphers on client side.
135+
136+
This is done to provide backward compatbility.
137+
*/
138+
const char additional_client_ciphers[] = {
139+
"ECDHE-ECDSA-AES256-CCM8:"
140+
"ECDHE-ECDSA-AES128-CCM8:"
141+
"DHE-RSA-AES256-CCM8:"
142+
"DHE-RSA-AES128-CCM8:"
143+
"ECDHE-ECDSA-AES128-SHA256:"
144+
"ECDHE-RSA-AES128-SHA256:"
145+
"ECDHE-ECDSA-AES256-SHA384:"
146+
"ECDHE-RSA-AES256-SHA384:"
147+
"DHE-DSS-AES256-GCM-SHA384:"
148+
"DHE-DSS-AES128-GCM-SHA256:"
149+
"DHE-DSS-AES128-SHA256:"
150+
"DHE-DSS-AES256-SHA256:"
151+
"DHE-RSA-AES256-SHA256:"
152+
"DHE-RSA-AES128-SHA256:"
153+
"DHE-RSA-CAMELLIA256-SHA256:"
154+
"DHE-RSA-CAMELLIA128-SHA256:"
155+
"ECDHE-RSA-AES128-SHA:"
156+
"ECDHE-ECDSA-AES128-SHA:"
157+
"ECDHE-RSA-AES256-SHA:"
158+
"ECDHE-ECDSA-AES256-SHA:"
159+
"DHE-DSS-AES128-SHA:"
160+
"DHE-RSA-AES128-SHA:"
161+
"DHE-RSA-AES256-SHA:"
162+
"DHE-DSS-AES256-SHA:"
163+
"DHE-RSA-CAMELLIA256-SHA:"
164+
"DHE-RSA-CAMELLIA128-SHA:"
165+
"ECDH-ECDSA-AES128-SHA256:"
166+
"ECDH-RSA-AES128-SHA256:"
167+
"ECDH-RSA-AES256-SHA384:"
168+
"ECDH-ECDSA-AES256-SHA384:"
169+
"ECDH-ECDSA-AES128-SHA:"
170+
"ECDH-ECDSA-AES256-SHA:"
171+
"ECDH-RSA-AES128-SHA:"
172+
"ECDH-RSA-AES256-SHA:"
173+
"AES128-GCM-SHA256:"
174+
"AES128-CCM:"
175+
"AES128-CCM8:"
176+
"AES256-GCM-SHA384:"
177+
"AES256-CCM:"
178+
"AES256-CCM8:"
179+
"AES128-SHA256:"
180+
"AES256-SHA256:"
181+
"AES128-SHA:"
182+
"AES256-SHA:"
183+
"CAMELLIA256-SHA:"
184+
"CAMELLIA128-SHA:"
185+
"ECDH-ECDSA-AES128-GCM-SHA256:"
186+
"ECDH-ECDSA-AES256-GCM-SHA384:"
187+
"ECDH-RSA-AES128-GCM-SHA256:"
188+
"ECDH-RSA-AES256-GCM-SHA384"};
189+
190+
} // namespace
191+
192+
#endif /* TLS_CIPHERS_INCLUDED */

‎mysql-test/include/excludenoskip.list

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ check_openssl_version.inc
105105
check_openssl.inc
106106
have_tlsv13.inc
107107
not_have_tlsv13.inc
108+
not_tlsv13.inc
108109
not_min_protocol_tlsv12.inc
109110

110111
# 4.5 Reason for inclusion: Tests should run only with supported innodb page

‎mysql-test/r/grant_alter_user_qa.result

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ ssl_cipher
173173
x509_issuer
174174
x509_subject sub
175175
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string#y'
176-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
176+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
177177
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
178178
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
179179
PASSWORD EXPIRE DEFAULT;
@@ -182,7 +182,7 @@ x509_subject,password_expired,password_lifetime FROM mysql.user WHERE USER='u10'
182182
User u10
183183
plugin sha256_password
184184
ssl_type SPECIFIED
185-
ssl_cipher DHE-RSA-AES256-SHA
185+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
186186
x509_issuer /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA
187187
x509_subject /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client
188188
password_expired N
@@ -191,7 +191,7 @@ SELECT USER();
191191
USER()
192192
u10@localhost
193193
CREATE USER tu6@localhost IDENTIFIED WITH 'test_plugin_server' AS '#hGrt0O6'
194-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
194+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
195195
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
196196
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
197197
WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2;
@@ -200,7 +200,7 @@ x509_subject,max_questions,max_user_connections FROM mysql.user WHERE USER='tu6'
200200
User tu6
201201
plugin test_plugin_server
202202
ssl_type SPECIFIED
203-
ssl_cipher DHE-RSA-AES256-SHA
203+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
204204
x509_issuer /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA
205205
x509_subject /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client
206206
max_questions 2
@@ -568,13 +568,13 @@ password_expired N
568568
password_last_changed #
569569
password_lifetime NULL
570570
CREATE USER u7@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string'
571-
REQUIRE CIPHER 'DHE-RSA-AES256-SHA';
571+
REQUIRE CIPHER 'ECDHE-RSA-AES128-GCM-SHA256';
572572
SELECT User,ssl_type,ssl_cipher,x509_issuer,x509_subject,
573573
plugin,password_expired,
574574
password_last_changed,password_lifetime FROM mysql.user WHERE USER='u7';
575575
User u7
576576
ssl_type SPECIFIED
577-
ssl_cipher DHE-RSA-AES256-SHA
577+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
578578
x509_issuer
579579
x509_subject
580580
plugin sha256_password
@@ -613,13 +613,13 @@ password_expired N
613613
password_last_changed #
614614
password_lifetime NULL
615615
ALTER USER u8@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string'
616-
REQUIRE CIPHER "DHE-RSA-AES256-SHA";
616+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256";
617617
SELECT User,ssl_type,ssl_cipher,x509_issuer,x509_subject,
618618
plugin,password_expired,
619619
password_last_changed,password_lifetime FROM mysql.user WHERE USER='u8';
620620
User u8
621621
ssl_type SPECIFIED
622-
ssl_cipher DHE-RSA-AES256-SHA
622+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
623623
x509_issuer
624624
x509_subject
625625
plugin sha256_password
@@ -644,13 +644,13 @@ password_expired N
644644
password_last_changed #
645645
password_lifetime NULL
646646
ALTER USER tu1@localhost IDENTIFIED WITH 'sha256_password'
647-
REQUIRE CIPHER "DHE-RSA-AES256-SHA";
647+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256";
648648
SELECT User,ssl_type,ssl_cipher,x509_issuer,x509_subject,
649649
plugin,password_expired,
650650
password_last_changed,password_lifetime FROM mysql.user WHERE USER='tu1';
651651
User tu1
652652
ssl_type SPECIFIED
653-
ssl_cipher DHE-RSA-AES256-SHA
653+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
654654
x509_issuer
655655
x509_subject
656656
plugin sha256_password
@@ -699,15 +699,15 @@ password_expired N
699699
password_last_changed #
700700
password_lifetime NULL
701701
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string'
702-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
702+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
703703
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
704704
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";
705705
SELECT User,ssl_type,ssl_cipher,x509_issuer,x509_subject,
706706
plugin,password_expired,
707707
password_last_changed,password_lifetime FROM mysql.user WHERE USER='u10';
708708
User u10
709709
ssl_type SPECIFIED
710-
ssl_cipher DHE-RSA-AES256-SHA
710+
ssl_cipher ECDHE-RSA-AES128-GCM-SHA256
711711
x509_issuer /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA
712712
x509_subject /C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client
713713
plugin sha256_password
@@ -1243,14 +1243,14 @@ SHOW CREATE USER u9@localhost;
12431243
CREATE USER for u9@localhost
12441244
CREATE USER `u9`@`localhost` IDENTIFIED WITH 'caching_sha2_password' REQUIRE SUBJECT 'sub' PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
12451245
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string'
1246-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1246+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
12471247
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
12481248
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";
12491249
SHOW CREATE USER u10@localhost;
12501250
CREATE USER for u10@localhost
1251-
CREATE USER `u10`@`localhost` IDENTIFIED WITH 'sha256_password' AS '<non-deterministic-password-hash>' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'DHE-RSA-AES256-SHA' PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
1251+
CREATE USER `u10`@`localhost` IDENTIFIED WITH 'sha256_password' AS '<non-deterministic-password-hash>' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'ECDHE-RSA-AES128-GCM-SHA256' PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
12521252
ALTER USER u10@localhost IDENTIFIED WITH 'sha256_password' BY 'auth_string'
1253-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1253+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
12541254
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
12551255
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
12561256
WITH MAX_CONNECTIONS_PER_HOUR 1000
@@ -1259,7 +1259,7 @@ MAX_UPDATES_PER_HOUR 100;
12591259
# SHOW CREATE USER after ALTER user attributes
12601260
SHOW CREATE USER u10@localhost;
12611261
CREATE USER for u10@localhost
1262-
CREATE USER `u10`@`localhost` IDENTIFIED WITH 'sha256_password' AS '<non-deterministic-password-hash>' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'DHE-RSA-AES256-SHA' WITH MAX_QUERIES_PER_HOUR 60 MAX_UPDATES_PER_HOUR 100 MAX_CONNECTIONS_PER_HOUR 1000 MAX_USER_CONNECTIONS 20 PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
1262+
CREATE USER `u10`@`localhost` IDENTIFIED WITH 'sha256_password' AS '<non-deterministic-password-hash>' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'ECDHE-RSA-AES128-GCM-SHA256' WITH MAX_QUERIES_PER_HOUR 60 MAX_UPDATES_PER_HOUR 100 MAX_CONNECTIONS_PER_HOUR 1000 MAX_USER_CONNECTIONS 20 PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT
12631263
CREATE USER u11@localhost WITH MAX_QUERIES_PER_HOUR 2;
12641264
SHOW CREATE USER u11@localhost;
12651265
CREATE USER for u11@localhost
@@ -1447,14 +1447,14 @@ CREATE USER user12@localhost IDENTIFIED WITH 'sha256_password'
14471447
PASSWORD EXPIRE NEVER;
14481448
CREATE USER u2@localhost IDENTIFIED BY 'meow';
14491449
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password'
1450-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1450+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
14511451
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
14521452
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
14531453
WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2;
14541454
ALTER USER u10@localhost IDENTIFIED WITH 'mysql_native_password' BY 'auth_string'
14551455
REQUIRE SSL;
14561456
ALTER USER user11@localhost IDENTIFIED WITH 'sha256_password'
1457-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1457+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
14581458
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
14591459
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
14601460
PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
@@ -1487,9 +1487,9 @@ binlog.000001 # Query # # use `test`; CREATE USER 'user1'@'localhost' IDENTIFIED
14871487
binlog.000001 # Query # # use `test`; CREATE USER 'user11'@'localhost' IDENTIFIED WITH 'mysql_native_password' PASSWORD EXPIRE NEVER ACCOUNT LOCK
14881488
binlog.000001 # Query # # use `test`; CREATE USER 'user12'@'localhost' IDENTIFIED WITH 'sha256_password' PASSWORD EXPIRE NEVER
14891489
binlog.000001 # Query # # use `test`; CREATE USER 'u2'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS '<non-deterministic-password-hash>'
1490-
binlog.000001 # Query # # use `test`; CREATE USER 'u10'@'localhost' IDENTIFIED WITH 'sha256_password' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'DHE-RSA-AES256-SHA' WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2
1490+
binlog.000001 # Query # # use `test`; CREATE USER 'u10'@'localhost' IDENTIFIED WITH 'sha256_password' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'ECDHE-RSA-AES128-GCM-SHA256' WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2
14911491
binlog.000001 # Query # # use `test`; ALTER USER 'u10'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*67092806AE91BFB6BE72DE6C7BE2B7CCA8CFA9DF' REQUIRE SSL
1492-
binlog.000001 # Query # # use `test`; ALTER USER 'user11'@'localhost' IDENTIFIED WITH 'sha256_password' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'DHE-RSA-AES256-SHA' PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK
1492+
binlog.000001 # Query # # use `test`; ALTER USER 'user11'@'localhost' IDENTIFIED WITH 'sha256_password' REQUIRE SUBJECT '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client' ISSUER '/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA' CIPHER 'ECDHE-RSA-AES128-GCM-SHA256' PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK
14931493
binlog.000001 # Query # # use `test`; ALTER USER 'user12'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*67092806AE91BFB6BE72DE6C7BE2B7CCA8CFA9DF' PASSWORD EXPIRE INTERVAL 90 DAY ACCOUNT UNLOCK
14941494
binlog.000001 # Query # # use `test`; CREATE USER 'user13'@'localhost' IDENTIFIED WITH 'caching_sha2_password' AS '<non-deterministic-password-hash>' ACCOUNT UNLOCK
14951495
binlog.000001 # Query # # use `test`; ALTER USER 'user13'@'localhost' WITH MAX_QUERIES_PER_HOUR 22 MAX_USER_CONNECTIONS 4 PASSWORD EXPIRE NEVER ACCOUNT LOCK
@@ -1521,14 +1521,14 @@ CREATE USER user12@localhost IDENTIFIED WITH 'sha256_password'
15211521
PASSWORD EXPIRE NEVER;
15221522
CREATE USER u2@localhost IDENTIFIED BY 'meow';
15231523
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password'
1524-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1524+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
15251525
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
15261526
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
15271527
WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2;
15281528
ALTER USER u10@localhost IDENTIFIED WITH 'mysql_native_password' BY 'auth_string'
15291529
REQUIRE SSL;
15301530
ALTER USER user11@localhost IDENTIFIED WITH 'sha256_password'
1531-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1531+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
15321532
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
15331533
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
15341534
PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
@@ -1566,7 +1566,7 @@ CREATE USER user12@localhost IDENTIFIED WITH 'sha256_password'
15661566
PASSWORD EXPIRE NEVER
15671567
CREATE USER 'u2'@'localhost' IDENTIFIED BY <secret>
15681568
CREATE USER u10@localhost IDENTIFIED WITH 'sha256_password'
1569-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1569+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
15701570
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
15711571
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
15721572
WITH MAX_QUERIES_PER_HOUR 2 MAX_USER_CONNECTIONS 2
@@ -1582,7 +1582,7 @@ command_type NOT LIKE 'Prepare';
15821582
argument
15831583
ALTER USER 'u10'@'localhost' IDENTIFIED WITH 'mysql_native_password' BY <secret> REQUIRE SSL
15841584
ALTER USER user11@localhost IDENTIFIED WITH 'sha256_password'
1585-
REQUIRE CIPHER "DHE-RSA-AES256-SHA" AND
1585+
REQUIRE CIPHER "ECDHE-RSA-AES128-GCM-SHA256" AND
15861586
SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client"
15871587
ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA"
15881588
PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK

0 commit comments

Comments
 (0)