mag/SQLWorkbench
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new tests

Browse Source
This commit is contained in:
Mark Gregory
2026-10-19 10:46:22 +01:00
parent 3307bd90e4
commit 8d33346993
4 changed files with 61 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PHASE74-1-NATIVE-MYSQL-TLS.md
+7
View File
@@ -0,0 +1,7 @@
# Phase 74.1 — Direct MySQL TLS (experimental)
MySQL protocol flow: read plaintext greeting, require server CLIENT_SSL capability, send SSLRequest, set CFStream TLS security properties with peer-name and certificate-chain validation, send handshake response only after requesting TLS upgrade. caching_sha2_password full auth sends the password over the encrypted stream. Existing SSH tunnel and loopback workflows remain available.
Security: Direct remote connections with TLS disabled are rejected. Certificate verification is mandatory. For an IP connection the certificate must be valid for that IP; prefer a DNS hostname matching the certificate. No trust-all or self-signed certificate bypass is provided.
Caveat: macOS CFStream may not support setting SSL settings on streams already opened for plaintext greeting. In that case the client fails closed before sending credentials. This implementation is syntax-checked only; macOS build and live TLS interoperability have not been verified. For production reliability, a transport implemented with Secure Transport/Network.framework supporting an explicit in-place TLS upgrade may be required.