The GitHub Actions job "Backend CI" on hertzbeat.git/fix/002-r2dbc-mysql-ssl-downgrade has succeeded. Run started by GitHub user Aias00 (triggered by Aias00).
Head commit for run: cebb7c150272ac7167037248372ff74a7a0d5ccf / liuhy <[email protected]> [fix] stop silent SSL-to-plaintext downgrade in R2DBC MySQL route The R2DBC MySQL query route retried a failed connection with SslMode.DISABLED whenever the first (PREFERRED) attempt errored with a handshake-style failure (handshake_failure, ssl/tls handshake, ClosedChannelException, connection unexpectedly closed). A TLS handshake failure is ambiguous: it can be induced by a MitM that disrupts the handshake specifically to trigger this fallback. Retrying with SSL disabled then authenticates the monitoring user to the (possibly tampered) endpoint over plaintext, exposing the credentials. SslMode.PREFERRED already handles the legitimate plaintext case: when the server advertises no SSL capability in the initial handshake, the driver falls back to plaintext through protocol negotiation, without error. So the explicit DISABLED retry only ever fires on errors, which is exactly the unsafe path. Drop it and surface the failure instead; the caching_sha2_password / must-require-ssl diagnostic is preserved. Co-Authored-By: Claude <[email protected]> Report URL: https://github.com/apache/hertzbeat/actions/runs/30368160187 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
