Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36193

MariaDB client with `--socket-name` should default to SSL=False

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.4.3
    • None
    • Scripts & Clients, SSL
    • debian-linux-gnu (x86_64)

    Description

      Using a local Unix socket connection via the `--socket-name` or `-S` command line flags should not require SSL by default. (it should set --ssl=False by default)

      The MySQL command line interface currently already uses this behavior: https://dev.mysql.com/doc/refman/8.4/en/connection-options.html#option_general_ssl-mode

      > Connections over Unix socket files are not encrypted with a mode of PREFERRED. To enforce encryption for Unix socket-file connections, use a mode of REQUIRED or stricter. (However, socket-file transport is secure by default, so encrypting a socket-file connection makes it no more secure and increases CPU load.)

      I think MariaDB should also use this behavior, encrypting unix socket connections by default is wasteful and will increase CPU as mentioned above. The default for unix socket should be to not encrypt, with the ability to override and encrypt if required.

      Examples:

      mariadb -S /cloudsql/my-instance -u root -p
      ...
      ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it
      

      This should succeed without requiring SSL.

      Attachments

        Activity

          People

            Unassigned Unassigned
            jackwotherspoon Jack Wotherspoon
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.