Can't enable SSL with MariaDB driver library

It is currently not possible to enable SSL through the ssl_mode parameter when using the MariaDB driver library.

This is critical because you can't connect to a MySQL server with a user that requires SSL.

# How to reproduce?

Versions:

```
$ lsb_release -d
Description:    Ubuntu 20.04.2 LTS

$ ruby --version
ruby 2.6.6p146 (2020-03-31 revision 67876) [x86_64-linux]

$ gem --version
3.0.9

$ bundle --version
Bundler version 1.17.3

$ dpkg --list mysql-server-8.0
ii  mysql-server-8.0 8.0.23-0ubuntu0.20.04.1 amd64        MySQL database server binaries and system database setup
```

Create a MySQL database user with "REQUIRE SSL":

```
> CREATE USER IF NOT EXISTS test@127.0.0.1
IDENTIFIED WITH mysql_native_password BY 'test'
REQUIRE SSL;
```

Create a test script:

```
$ vim Gemfile
source 'https://rubygems.org'
gem 'mysql2'

$ vim test.rb
require 'mysql2'
client = Mysql2::Client.new(host: '127.0.0.1', username: 'test', password: 'test', ssl_mode: :required)
puts client.query('SHOW STATUS LIKE "Ssl_cipher"').first.inspect
```

## 🔴 Test with the MariaDB driver library

Install the driver library and the mysql2 gem:

```
$ sudo apt-get install libmariadb-dev-compat

$ dpkg --list libmariadb-dev-compat
...
ii  libmariadb-dev-compat:amd64 1:10.3.25-0ubuntu0.20.04.1 amd64        MariaDB Connector/C, compatibility symlinks

$ bundle exec gem uninstall mysql2
Successfully uninstalled mysql2-0.5.3

$ bundle
...
Installing mysql2 0.5.3 with native extensions
...

$ ldd $(bundle show mysql2)/lib/mysql2/mysql2.so
	...
	libmariadb.so.3 => /usr/lib/x86_64-linux-gnu/libmariadb.so.3 (0x00007efe06293000)
	...
```

Run the test script:

```
$ bundle exec ruby test.rb 
/home/clemens/.rvm/gems/ruby-2.6.6/gems/mysql2-0.5.3/lib/mysql2/client.rb:51: warning: Your mysql client library does not support ssl_mode as expected.
Traceback (most recent call last):
        3: from test.rb:2:in `<main>'
        2: from test.rb:2:in `new'
        1: from /home/clemens/.rvm/gems/ruby-2.6.6/gems/mysql2-0.5.3/lib/mysql2/client.rb:90:in `initialize'
/home/clemens/.rvm/gems/ruby-2.6.6/gems/mysql2-0.5.3/lib/mysql2/client.rb:90:in `connect': Access denied for user 'test'@'localhost' (using password: YES) (Mysql2::Error::ConnectionError)
```

## 🟢 Test with the MySQL driver library

Install the driver library and the mysql2 gem:

```
$ sudo apt-get install libmysqlclient-dev

$ dpkg --list libmysqlclient-dev
...
ii  libmysqlclient-dev 8.0.23-0ubuntu0.20.04.1 amd64        MySQL database development files

$ bundle exec gem uninstall mysql2
Successfully uninstalled mysql2-0.5.3

$ bundle
...
Installing mysql2 0.5.3 with native extensions
...

$ ldd $(bundle show mysql2)/lib/mysql2/mysql2.so
	...
	libmysqlclient.so.21 => /usr/lib/x86_64-linux-gnu/libmysqlclient.so.21 (0x00007f0ac5a7b000)
	...
```

Run the test script:

```
$ bundle exec ruby test.rb
{"Variable_name"=>"Ssl_cipher", "Value"=>"TLS_AES_256_GCM_SHA384"}
```

# 🟢 Solution?

With the MariaDB driver, the "mysql_get_client_version" at https://github.com/brianmario/mysql2/blob/0.5.3/ext/mysql2/client.c#L107 returns 100325 and HAVE_CONST_MYSQL_OPT_SSL_ENFORCE at https://github.com/brianmario/mysql2/blob/0.5.3/ext/mysql2/client.c#L113 is defined. The version that "mysql_get_client_version" returns is calculated at https://github.com/mariadb-corporation/mariadb-connector-c/blob/v3.1.12/CMakeLists.txt#L173.

With the MySQL driver, the "mysql_get_client_version" at https://github.com/brianmario/mysql2/blob/0.5.3/ext/mysql2/client.c#L107 returns 80023 and FULL_SSL_MODE_SUPPORT at https://github.com/brianmario/mysql2/blob/0.5.3/ext/mysql2/client.c#L131 is defined.

After adding a new version range for the MariaDB driver to https://github.com/brianmario/mysql2/blob/0.5.3/ext/mysql2/client.c#L117 the ssl_mode is correctly set and SSL is used for the database connection.

## 1. Create a patched mysql2 gem

```
$ git clone https://github.com/brianmario/mysql2.git

$ cd mysql2

$ git checkout 0.5.3

$ vim ext/mysql2/client.c
...
  if ((version >= 50703 && version < 50711) || (version >= 60103 && version < 60200) || (version >= 100200 && version < 110000)) {
...

$ git diff
diff --git a/ext/mysql2/client.c b/ext/mysql2/client.c
index 13fd2dd..e484fa0 100644
--- a/ext/mysql2/client.c
+++ b/ext/mysql2/client.c
@@ -114,7 +114,7 @@ static VALUE rb_set_ssl_mode_option(VALUE self, VALUE setting) {
   GET_CLIENT(self);
   int val = NUM2INT( setting );
   // Either MySQL 5.7.3 - 5.7.10, or Connector/C 6.1.3 - 6.1.x
-  if ((version >= 50703 && version < 50711) || (version >= 60103 && version < 60200)) {
+  if ((version >= 50703 && version < 50711) || (version >= 60103 && version < 60200) || (version >= 100200 && version < 110000)) {
     if (val == SSL_MODE_DISABLED || val == SSL_MODE_REQUIRED) {
       my_bool b = ( val == SSL_MODE_REQUIRED );
       int result = mysql_options( wrapper->client, MYSQL_OPT_SSL_ENFORCE, &b );

$ gem build mysql2

$ cp mysql2-0.5.3.gem /tmp
```

## 2. Install the MariaDB driver library and the patched mysql2 gem

```
$ sudo apt-get install libmariadb-dev-compat

$ dpkg --list libmariadb-dev-compat
...
ii  libmariadb-dev-compat:amd64 1:10.3.25-0ubuntu0.20.04.1 amd64        MariaDB Connector/C, compatibility symlinks

$ bundle exec gem uninstall mysql2
Successfully uninstalled mysql2-0.5.3

$ gem install /tmp/mysql2-0.5.3.gem
...
Successfully installed mysql2-0.5.3
...

$ ldd $(bundle show mysql2)/lib/mysql2/mysql2.so
	...
	libmariadb.so.3 => /usr/lib/x86_64-linux-gnu/libmariadb.so.3 (0x00007f4576d6e000)
	...
```

## 3. Run the test script

```
$ bundle exec ruby test.rb
{"Variable_name"=>"Ssl_cipher", "Value"=>"TLS_AES_256_GCM_SHA384"}
```

	# Allow failure due to Mysql2::Error: Unknown system variable 'session_track_system_variables'.
	- {os: ubuntu-16.04, ruby: 2.4, db: mariadb10.0, allow-failure: true}
	# Comment out due to ci/setup.sh stucking.
	# - {os: ubuntu-18.04, ruby: 2.4, db: mariadb10.1}
	# `service mysql restart` fails.
	- {os: ubuntu-20.04, ruby: 2.4, db: mariadb10.3, allow-failure: true}
	- {os: ubuntu-18.04, ruby: 2.4, db: mysql57}
	# Allow failure due to the issue #1165.
	- {os: ubuntu-20.04, ruby: 2.4, db: mysql80, allow-failure: true}
	- {os: ubuntu-18.04, ruby: 'head', db: '', allow-failure: true}

	all_modes_found = %w[SSL_MODE_DISABLED SSL_MODE_PREFERRED SSL_MODE_REQUIRED SSL_MODE_VERIFY_CA SSL_MODE_VERIFY_IDENTITY].inject(true) do \|m, ssl_mode\|
	m && have_const(ssl_mode, header)
	end
	$CFLAGS << ' -DFULL_SSL_MODE_SUPPORT' if all_modes_found
	# if we only have ssl toggle (--ssl,--disable-ssl) from 5.7.3 to 5.7.10
	has_no_support = all_modes_found ? false : !have_const('MYSQL_OPT_SSL_ENFORCE', header)
	$CFLAGS << ' -DNO_SSL_MODE_SUPPORT' if has_no_support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Can't enable SSL with MariaDB driver library #1182

How to reproduce?

🔴 Test with the MariaDB driver library

🟢 Test with the MySQL driver library

🟢 Solution?

1. Create a patched mysql2 gem

2. Install the MariaDB driver library and the patched mysql2 gem

3. Run the test script

25 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Participants

Can't enable SSL with MariaDB driver library #1182

Description

How to reproduce?

🔴 Test with the MariaDB driver library

🟢 Test with the MySQL driver library

🟢 Solution?

1. Create a patched mysql2 gem

2. Install the MariaDB driver library and the patched mysql2 gem

3. Run the test script

Activity

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 10, 2021

junaruga commented on Apr 11, 2021

vakuum commented on Apr 11, 2021

junaruga commented on Apr 11, 2021

25 remaining items

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Participants

Issue actions