From 76870bcaf4f20a75b97a131c2d9bc3bcb73f10d4 Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Tue, 10 Nov 2026 17:32:14 +0200 Subject: [PATCH 1/2] update configs to support Tls1.3 --- .github/workflows/SideBySide/config-ssl.json | 2 +- .github/workflows/SideBySide/config.json | 2 +- tests/SideBySide/SslTests.cs | 39 ++++++++++---------- 3 files changed, 21 insertions(+), 22 deletions(-) diff --git a/.github/workflows/SideBySide/config-ssl.json b/.github/workflows/SideBySide/config-ssl.json index 81650eaba..3841ee1eb 100644 --- a/.github/workflows/SideBySide/config-ssl.json +++ b/.github/workflows/SideBySide/config-ssl.json @@ -1,7 +1,7 @@ { "Data": { "ConnectionString": "server=SINGLESTORE_HOST;user id=SQL_USER_NAME;password=SQL_USER_PASSWORD;port=3306;database=singlestoretest;sslmode=Required;certificate file=../../../../.ci/server/certs/ssl-client.pfx;", - "UnsupportedFeatures": "CachingSha2Password,Ed25519,QueryAttributes,Tls11,Tls13,UuidToBin,UnixDomainSocket,Sha256Password,GlobalLog,Redirection,CancelSleepSuccessfully,TlsFingerprintValidation,ParsecAuthentication", + "UnsupportedFeatures": "CachingSha2Password,Ed25519,QueryAttributes,Tls11,UuidToBin,UnixDomainSocket,Sha256Password,GlobalLog,Redirection,CancelSleepSuccessfully,TlsFingerprintValidation,ParsecAuthentication", "CertificatesPath": "../../../../.ci/server/certs" } } diff --git a/.github/workflows/SideBySide/config.json b/.github/workflows/SideBySide/config.json index 972386fee..f487f457a 100644 --- a/.github/workflows/SideBySide/config.json +++ b/.github/workflows/SideBySide/config.json @@ -1,7 +1,7 @@ { "Data": { "ConnectionString": "server=SINGLESTORE_HOST;user id=SQL_USER_NAME;password=SQL_USER_PASSWORD;port=3306;database=singlestoretest;sslmode=disabled;", - "UnsupportedFeatures": "CachingSha2Password,Ed25519,QueryAttributes,Tls11,Tls13,UuidToBin,UnixDomainSocket,Sha256Password,GlobalLog,Redirection,CancelSleepSuccessfully,TlsFingerprintValidation,ParsecAuthentication", + "UnsupportedFeatures": "CachingSha2Password,Ed25519,QueryAttributes,Tls11,UuidToBin,UnixDomainSocket,Sha256Password,GlobalLog,Redirection,CancelSleepSuccessfully,TlsFingerprintValidation,ParsecAuthentication", "ManagedService": true } } diff --git a/tests/SideBySide/SslTests.cs b/tests/SideBySide/SslTests.cs index ac721521b..03c14ede1 100644 --- a/tests/SideBySide/SslTests.cs +++ b/tests/SideBySide/SslTests.cs @@ -280,30 +280,29 @@ public async Task ConnectSslTlsVersion() { using var connection = new SingleStoreConnection(AppConfig.ConnectionString); await connection.OpenAsync(); -#pragma warning disable SYSLIB0039 // SslProtocols.Tls11 is obsolete - var expectedProtocol = AppConfig.SupportedFeatures.HasFlag(ServerFeatures.Tls12) ? SslProtocols.Tls12 : - AppConfig.SupportedFeatures.HasFlag(ServerFeatures.Tls11) ? SslProtocols.Tls11 : - SslProtocols.Tls; - var expectedProtocolString = expectedProtocol == SslProtocols.Tls12 ? "TLSv1.2" : - expectedProtocol == SslProtocols.Tls11 ? "TLSv1.1" : "TLSv1"; -#pragma warning restore SYSLIB0039 // SslProtocols.Tls11 is obsolete - -#if !NET462 && !NET472 - // https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotnet-core-3-0#tls-13--openssl-111-on-linux - if (expectedProtocol == SslProtocols.Tls12 && AppConfig.SupportedFeatures.HasFlag(ServerFeatures.Tls13) && RuntimeInformation.IsOSPlatform(OSPlatform.Linux)) - { - expectedProtocol = SslProtocols.Tls13; - expectedProtocolString = "TLSv1.3"; - } -#endif + + using var cmd = new SingleStoreCommand("SHOW SESSION STATUS LIKE 'Ssl_version';", connection); + using var reader = await cmd.ExecuteReaderAsync(); + + Assert.True(await reader.ReadAsync()); + var serverProtocol = reader.GetString(1); #if !BASELINE +#pragma warning disable SYSLIB0039 // Older TLS protocols are obsolete + var expectedProtocol = serverProtocol switch + { + "TLSv1.3" => SslProtocols.Tls13, + "TLSv1.2" => SslProtocols.Tls12, + "TLSv1.1" => SslProtocols.Tls11, + "TLSv1" => SslProtocols.Tls, + _ => throw new NotSupportedException($"Unexpected TLS protocol: {serverProtocol}"), + }; +#pragma warning restore SYSLIB0039 + Assert.Equal(expectedProtocol, connection.SslProtocol); +#else + Assert.False(string.IsNullOrWhiteSpace(serverProtocol)); #endif - using var cmd = new SingleStoreCommand("show status like 'Ssl_version';", connection); - using var reader = await cmd.ExecuteReaderAsync(); - Assert.True(reader.Read()); - Assert.Equal(expectedProtocolString, reader.GetString(1)); } #if !NET5_0_OR_GREATER From 3e7293622f9fb01cee72e65cc079552613ab23b9 Mon Sep 17 00:00:00 2001 From: Olha Kramarenko Date: Tue, 10 Nov 2026 17:43:36 +0200 Subject: [PATCH 2/2] add condition on TLS 1.3 --- tests/SideBySide/SslTests.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/SideBySide/SslTests.cs b/tests/SideBySide/SslTests.cs index 03c14ede1..6e2c86e1f 100644 --- a/tests/SideBySide/SslTests.cs +++ b/tests/SideBySide/SslTests.cs @@ -291,7 +291,9 @@ public async Task ConnectSslTlsVersion() #pragma warning disable SYSLIB0039 // Older TLS protocols are obsolete var expectedProtocol = serverProtocol switch { +#if !NET462 && !NET472 "TLSv1.3" => SslProtocols.Tls13, +#endif "TLSv1.2" => SslProtocols.Tls12, "TLSv1.1" => SslProtocols.Tls11, "TLSv1" => SslProtocols.Tls,