Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support get_server_public_key option #1377

Merged
merged 2 commits into from
Sep 6, 2024

Conversation

samitani
Copy link
Contributor

@samitani samitani commented Aug 31, 2024

What

This PR fixes below MySQL authentication error with SSL-disabled connection.

Mysql2::Error: Authentication plugin 'caching_sha2_password' reported error: 
Authentication requires secure connection.

Background

This error only happen in case of first authentication under cleartext TCP connection. caching_sha2_password authentication requires a secure connection at first authentication for each users. The first authentication means that the cache is not ready yet at server-side. The reason why secure connection is required is that MySQL server need to know user password to create cache. After the cache is created, MySQL server does not request secure connection anymore. Please refer to the MySQL manual to know details.

For each user account, the first client connection for the user after any of the following operations must use a secure connection (made using TCP using TLS credentials, a Unix socket file, or shared memory) or RSA key pair-based password exchange:
https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html

libmysqlclient provides MYSQL_OPT_GET_SERVER_PUBLIC_KEY option which enables clients to create a requested secure connection automatically during authentication. This PR carries it to mysql2.

Sample code

require 'mysql2'

port     = 3306
hostname = 'hostname'
username = 'user'
password = 'password'

# connect with SSL to issue FLUSH PRIVILEGES
client = Mysql2::Client.new(:host => hostname, :port => port, :username => username, :password => password, :ssl_mode => :required)

# force clear cache
client.query("FLUSH PRIVILEGES")

print "# without get_server_public_key\n"
# this returns Authentication requires secure connection.
begin
  client = Mysql2::Client.new(:host => hostname, :port => port, :username => username, :password => password, :ssl_mode => :disabled)
rescue => e
  printf("connect ng %s\n", e)
end

print "# with get_server_public_key\n"
begin
  client = Mysql2::Client.new(:host => hostname, :port => port, :username => username, :password => password, :ssl_mode => :disabled, :get_server_public_key => true)
  print "connect ok\n"
rescue => e
  printf("connect ng %s\n", e)
end
$ ruby ../test2.rb
# without get_server_public_key
connect ng Authentication plugin 'caching_sha2_password' reported error: Authentication requires secure connection.
# with get_server_public_key
connect ok

…y on server-side.

get_server_public_key option enables clients to create secure connection automatically even if connection is not SSL.
@@ -1596,6 +1611,7 @@ void init_mysql2_client() {
rb_define_private_method(cMysql2Client, "default_file=", set_read_default_file, 1);
rb_define_private_method(cMysql2Client, "default_group=", set_read_default_group, 1);
rb_define_private_method(cMysql2Client, "init_command=", set_init_command, 1);
rb_define_private_method(cMysql2Client, "get_server_public_key=", set_get_server_public_key, 1);
Copy link
Collaborator

@sodabrew sodabrew Sep 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The method name set_get_... seems extraneous? Can it be plain get_server_public_key? nm, this is a setter. Weird. Reading more.

@@ -159,6 +159,7 @@ def add_ssl_defines(header)
have_const('SERVER_QUERY_WAS_SLOW', mysql_h)
have_const('MYSQL_OPTION_MULTI_STATEMENTS_ON', mysql_h)
have_const('MYSQL_OPTION_MULTI_STATEMENTS_OFF', mysql_h)
have_const('MYSQL_OPT_GET_SERVER_PUBLIC_KEY', mysql_h)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not necessary to test for this constant into its own HAVE_ constant, because we can directly test for the constant at time of use (see suggested change)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sodabrew Hello, Thank you for reviewing my PR.
MYSQL_OPT_GET_SERVER_PUBLIC_KEY is defined as enum. If my understand correctly, ifdef does not work with enum.
https://github.com/mysql/mysql-server/blob/8.0/include/mysql.h.pp#L411-L448

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re absolutely right!

ext/mysql2/client.c Show resolved Hide resolved
@@ -996,6 +996,13 @@ static VALUE _mysql_client_options(VALUE self, int opt, VALUE value) {
retval = charval;
break;

#ifdef HAVE_CONST_MYSQL_OPT_GET_SERVER_PUBLIC_KEY
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#ifdef HAVE_CONST_MYSQL_OPT_GET_SERVER_PUBLIC_KEY
#ifdef MYSQL_OPT_GET_SERVER_PUBLIC_KEY

@sodabrew sodabrew dismissed their stale review September 6, 2024 00:19

Code is correct as is

@sodabrew sodabrew merged commit 4e18d79 into brianmario:master Sep 6, 2024
@sodabrew
Copy link
Collaborator

sodabrew commented Sep 6, 2024

Thank you for the PR!

@samitani samitani deleted the support-get-server-public-key branch September 6, 2024 10:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants