Reject tls=true&tls-verify=ca

Author: pourtorabehsan

driver_test.go

@@ -1522,7 +1522,6 @@ func TestTLS(t *testing.T) {
 	runTests(t, dsn+"&tls=custom-skip-verify", tlsTestReq)
 
 	// Test tls-verify parameter with system CA
-	runTests(t, dsn+"&tls=true&tls-verify=ca", tlsTestReq)
 	runTests(t, dsn+"&tls=true&tls-verify=identity", tlsTestReq)
 
 	// Test tls-verify parameter with custom TLS config

dsn.go

@@ -205,12 +205,12 @@ func (cfg *Config) normalize() error {
 		case "false", "":
 			// don't set anything
 		case "true":
-			// System CA pool
+			// Reject tls=true with tls-verify=ca since it provides minimal security
 			if cfg.TLSVerify == "ca" {
-				cfg.TLS = createVerifyCAConfig(nil, nil)
-			} else {
-				cfg.TLS = &tls.Config{}
+				return errors.New("tls-verify=ca requires a custom TLS config with specific CA certificates (use tls=<config-name>); tls=true is not supported with tls-verify=ca")
 			}
+			// System CA pool with full verification (identity check)
+			cfg.TLS = &tls.Config{}
 		case "skip-verify":
 			cfg.TLS = &tls.Config{InsecureSkipVerify: true}
 		case "preferred":

dsn_test.go

@@ -82,9 +82,6 @@ var testDSNs = []struct {
 }, {
 	"foo:bar@tcp(192.168.1.50:3307)/baz?timeout=10s&connectionAttributes=program_name:MySQLGoDriver%2FTest,program_version:1.2.3",
 	&Config{User: "foo", Passwd: "bar", Net: "tcp", Addr: "192.168.1.50:3307", DBName: "baz", Loc: time.UTC, Timeout: 10 * time.Second, MaxAllowedPacket: defaultMaxAllowedPacket, Logger: defaultLogger, AllowNativePasswords: true, CheckConnLiveness: true, ConnectionAttributes: "program_name:MySQLGoDriver/Test,program_version:1.2.3"},
-}, {
-	"user:password@tcp(localhost:5555)/dbname?tls=true&tls-verify=ca",
-	&Config{User: "user", Passwd: "password", Net: "tcp", Addr: "localhost:5555", DBName: "dbname", Loc: time.UTC, MaxAllowedPacket: defaultMaxAllowedPacket, Logger: defaultLogger, AllowNativePasswords: true, CheckConnLiveness: true, TLSConfig: "true", TLSVerify: "ca"},
 }, {
 	"user:password@tcp(localhost:5555)/dbname?tls=true&tls-verify=identity",
 	&Config{User: "user", Passwd: "password", Net: "tcp", Addr: "localhost:5555", DBName: "dbname", Loc: time.UTC, MaxAllowedPacket: defaultMaxAllowedPacket, Logger: defaultLogger, AllowNativePasswords: true, CheckConnLiveness: true, TLSConfig: "true", TLSVerify: "identity"},
@@ -442,7 +439,6 @@ func TestTLSVerifySystemCA(t *testing.T) {
 		name string
 		dsn  string
 	}{
-		{"ca with system CA", "tcp(example.com:1234)/?tls=true&tls-verify=ca"},
 		{"identity with system CA (explicit)", "tcp(example.com:1234)/?tls=true&tls-verify=identity"},
 		{"identity with system CA (default)", "tcp(example.com:1234)/?tls=true"},
 	}
@@ -457,26 +453,12 @@ func TestTLSVerifySystemCA(t *testing.T) {
 				t.Error("cfg.TLS should not be nil")
 			}
 
-			if cfg.TLSVerify == "ca" {
-				if !cfg.TLS.InsecureSkipVerify {
-					t.Error("ca mode should have InsecureSkipVerify=true")
-				}
-				if cfg.TLS.VerifyPeerCertificate == nil {
-					t.Error("ca mode should have VerifyPeerCertificate callback set")
-				}
-				// ca mode does not auto-set ServerName (hostname verification is skipped)
-				// ServerName remains empty unless explicitly set
-				if cfg.TLS.ServerName != "" {
-					t.Errorf("ca mode with system CA should not have ServerName set, got %q", cfg.TLS.ServerName)
-				}
-			} else {
-				// identity (default) should set ServerName
-				if cfg.TLS.ServerName != "example.com" {
-					t.Errorf("identity mode should set ServerName to 'example.com', got %q", cfg.TLS.ServerName)
-				}
-				if cfg.TLS.VerifyPeerCertificate != nil {
-					t.Error("identity mode should not have VerifyPeerCertificate callback set")
-				}
+			// identity (default) should set ServerName
+			if cfg.TLS.ServerName != "example.com" {
+				t.Errorf("identity mode should set ServerName to 'example.com', got %q", cfg.TLS.ServerName)
+			}
+			if cfg.TLS.VerifyPeerCertificate != nil {
+				t.Error("identity mode should not have VerifyPeerCertificate callback set")
 			}
 		})
 	}
@@ -591,6 +573,18 @@ func TestTLSVerifyInvalidValue(t *testing.T) {
 	}
 }
 
+func TestTLSTrueWithVerifyCAIsRejected(t *testing.T) {
+	dsn := "tcp(example.com:1234)/?tls=true&tls-verify=ca"
+	_, err := ParseDSN(dsn)
+	if err == nil {
+		t.Error("expected error for tls=true with tls-verify=ca")
+	}
+	expectedMsg := "tls-verify=ca requires a custom TLS config"
+	if err != nil && !strings.Contains(err.Error(), expectedMsg) {
+		t.Errorf("error message should contain %q, got: %v", expectedMsg, err)
+	}
+}
+
 func TestTLSVerifyPreservesCustomConfig(t *testing.T) {
 	// Register a custom TLS config with various settings
 	customConfig := &tls.Config{