fix(main): exclude MariaDB user roles and support zero-config TLS

Author: jmrenouard

Changelog

@@ -36,7 +36,7 @@
 - fix(main): calculate health score early in historical comparison to ensure scores exist for trend analysis.
 - fix(main): calculate query cache efficiency using Com_select on MariaDB (MDEV-4981)
 - fix(main): calculate query cache efficiency using Com_select on MariaDB, where Com_select includes query cache hits (MDEV-4981).
-- fix(main): exclude MariaDB user roles from remote user SSL enforcement audit
+- fix(main): exclude MariaDB user roles from SSL remote user audit
 - fix(main): format YAML null as tilde (~) and multiline values using literal block style.
 - fix(main): guard InnoDB log file size and log size percentage checks against uninitialized variables.
 - fix(main): guard version and version comment checks in MariaDB parallel replication and query cache blocks.

mysqltuner.pl

@@ -5051,12 +5051,17 @@ sub ssl_tls_recommendations {
 
     # Certificate presence and local audit
     if ( !$myvar{'ssl_cert'} && !$myvar{'ssl_key'} ) {
-        badprint "No SSL certificates configured (ssl_cert/ssl_key are empty)";
-        push_recommendation( 'Security',
+        if ( mysql_version_ge( 11, 4 ) && $myvar{'version'} =~ /MariaDB/i && ( defined($myvar{'have_ssl'}) && ($myvar{'have_ssl'} eq 'YES' || $myvar{'have_ssl'} eq 'ON') ) ) {
+            goodprint "TLS is active, but no explicit ssl_cert/ssl_key paths are configured (MariaDB zero-configuration TLS active)";
+        }
+        else {
+            badprint "No SSL certificates configured (ssl_cert/ssl_key are empty)";
+            push_recommendation( 'Security',
 "Configure SSL certificates (ssl_cert, ssl_key, ssl_ca) to enable encrypted connections."
-        );
-        push @ssl_csv_rows,
+            );
+            push @ssl_csv_rows,
 "ssl_cert/ssl_key,empty,NoCertificates,Configure SSL certificates (ssl_cert, ssl_key, ssl_ca) to enable encrypted connections.";
+        }
     }
     else {
         check_local_certificates( \@ssl_csv_rows );
@@ -5211,12 +5216,19 @@ sub check_remote_user_ssl {
     my @remote_users;
     if ( mysql_version_ge( 10, 4 ) && $myvar{'version'} =~ /MariaDB/i ) {
         @remote_users = select_array(
-"SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.global_priv WHERE host NOT IN ('localhost', '127.0.0.1', '::1') AND JSON_VALUE(Priv, '\$.ssl_type') = ''"
+"SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.global_priv WHERE host NOT IN ('localhost', '127.0.0.1', '::1') AND JSON_VALUE(Priv, '\$.ssl_type') = '' AND COALESCE(JSON_VALUE(Priv, '\$.is_role'), '') NOT IN ('true', '1')"
         );
     }
     else {
+        my $is_role_column = select_one(
+"select count(*) from information_schema.columns where TABLE_NAME='user' AND TABLE_SCHEMA='mysql' and COLUMN_NAME='IS_ROLE'"
+        );
+        my $extra_user_condition = "";
+        if ( defined($is_role_column) && $is_role_column =~ /^\d+$/ && $is_role_column > 0 ) {
+            $extra_user_condition = " AND IS_ROLE = 'N'";
+        }
         @remote_users = select_array(
-"SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE host NOT IN ('localhost', '127.0.0.1', '::1') AND (ssl_type = 'NONE' OR ssl_type = '')"
+"SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE host NOT IN ('localhost', '127.0.0.1', '::1') AND (ssl_type = 'NONE' OR ssl_type = '')$extra_user_condition"
         );
     }
 

tests/ssl_tls_validation.t

@@ -115,6 +115,31 @@ subtest 'ssl_tls_recommendations' => sub {
     main::ssl_tls_recommendations();
     ok(grep(/Insecure TLS versions enabled/, @bad_prints), "Detects TLS 1.1 as insecure");
     ok(grep(/No modern TLS versions/, @bad_prints), "Detects lack of TLS 1.2+");
+
+    # Case 5: MariaDB 11.4+ Zero-Configuration TLS (ssl_cert and ssl_key empty, but TLS active)
+    MySQLTuner::TestHelper::reset_state();
+    %main::myvar = ( %main::myvar, 
+        'version' => '11.8.8-MariaDB',
+        'have_ssl' => 'YES',
+        'require_secure_transport' => 'ON',
+        'tls_version' => 'TLSv1.2,TLSv1.3',
+        'ssl_cert' => '',
+        'ssl_key' => ''
+    );
+    local *main::select_one = sub {
+        my $query = shift;
+        if ($query =~ /Ssl_cipher/) {
+            return "Ssl_cipher\tTLS_AES_256_GCM_SHA384";
+        }
+        return "";
+    };
+    @main::generalrec = ();
+    @bad_prints = ();
+    @good_prints = ();
+    @recommendations = ();
+    main::ssl_tls_recommendations();
+    ok(grep(/TLS is active, but no explicit ssl_cert\/ssl_key paths are configured/, @good_prints), "MariaDB 11.4+ Zero-Configuration TLS prints info message");
+    is(scalar(grep(/No SSL certificates configured/, @bad_prints)), 0, "No missing certificates warning for zero-config TLS");
 };
 
 subtest 'check_local_certificates' => sub {
@@ -217,6 +242,49 @@ subtest 'check_remote_user_ssl' => sub {
     @bad_prints = ();
     main::check_remote_user_ssl();
     ok(grep(/users can connect remotely without SSL/, @bad_prints), "Detects remote user without SSL (MySQL)");
+
+    # Case 3: Exclude role (MariaDB >= 10.4)
+    MySQLTuner::TestHelper::reset_state();
+    %main::myvar = ( %main::myvar,  'version' => '10.5.0-MariaDB' );
+    local *main::select_array = sub {
+        my ($query) = @_;
+        if ($query =~ /global_priv/ && $query =~ /is_role/) {
+            return (); # Excluded!
+        }
+        return ("'should_not_happen'\@'%'");
+    };
+    local *main::mysql_version_ge = sub { 1 };
+    @bad_prints = ();
+    @good_prints = ();
+    main::check_remote_user_ssl();
+    ok(grep(/All remote users have SSL enforcement active/, @good_prints), "Excludes role (MariaDB >= 10.4)");
+
+    # Case 4: Exclude role (MariaDB < 10.4 with IS_ROLE column)
+    MySQLTuner::TestHelper::reset_state();
+    %main::myvar = ( %main::myvar,  'version' => '10.2.0-MariaDB' );
+    local *main::select_one = sub {
+        my ($query) = @_;
+        if ($query =~ /IS_ROLE/) {
+            return 1; # IS_ROLE column exists
+        }
+        return 0;
+    };
+    local *main::select_array = sub {
+        my ($query) = @_;
+        if ($query =~ /mysql.user/ && $query =~ /IS_ROLE = 'N'/) {
+            return (); # Excluded!
+        }
+        return ("'should_not_happen'\@'%'");
+    };
+    local *main::mysql_version_ge = sub {
+        my ($maj, $min) = @_;
+        if ($maj == 10 && $min == 4) { return 0; } # Not >= 10.4
+        return 1;
+    };
+    @bad_prints = ();
+    @good_prints = ();
+    main::check_remote_user_ssl();
+    ok(grep(/All remote users have SSL enforcement active/, @good_prints), "Excludes role using IS_ROLE (MariaDB < 10.4)");
 };
 
 done_testing();