MariaDB connector update forces SSL

Can you confirm it forces ssl or forces ssl verification?

these are the changes

Comparing v3.3.10...v3.4.0 · mariadb-corporation/mariadb-connector-c

MariaDB Connector/C is used to connect applications developed in C/C++ to MariaDB and MySQL databases.The client library is LGPL licensed. - Comparing…

github.com

and this one is the force ssl verification.

make DEFAULT_SSL_VERIFY_SERVER_CERT a cmake option · mariadb-corporation/mariadb-connector-c@82983a3

github.com

Here are the ssl stuff from mariadb and there seems to be some require per user. Without seeing the logs I could not comment further. But is your connection running ssl (and just without the verify?) and it fails with the connector 3.4 (due to the verify) - the comments should be pretty useful in isolating this.

Looks like this works:

diff --git a/packages/databases/mariadb-connector-c/package.mk b/packages/databases/mariadb-connector-c/package.mk
index f77ec39aa7..0a213c77fb 100644
--- a/packages/databases/mariadb-connector-c/package.mk
+++ b/packages/databases/mariadb-connector-c/package.mk
@@ -16,6 +16,7 @@ PKG_CMAKE_OPTS_TARGET="-DWITH_EXTERNAL_ZLIB=ON
                        -DCLIENT_PLUGIN_MYSQL_CLEAR_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_MYSQL_OLD_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_REMOTE_IO=OFF
+                       -DDEFAULT_SSL_VERIFY_SERVER_CERT=OFF
                       "
 
 post_makeinstall_target() {

It looks like the client has changed the “failure logic”

[MDEV-28634] Client's --ssl-* options (without --ssl-verify-server-cert) are silently ignored if TLS is not possible - Jira
>> The client will only see an error if they also provide the --ssl-verify-server-cert option:<<

I believe the correct fix would be to set sslMode=disabled in the connection from Kodi - as in https://mariadb.com/kb/en/using-tl…java-connector/ (will be the same with c connector I believe)
By default when sslMode is set (not disabled), connector will use "serverSslCert" is set or the default truststore if not. Using default truststore can be disable setting option "fallbackToSystemTrustStore" to false.

Quote from vpeter

Looks like this works:

Diff

diff --git a/packages/databases/mariadb-connector-c/package.mk b/packages/databases/mariadb-connector-c/package.mk
index f77ec39aa7..0a213c77fb 100644
--- a/packages/databases/mariadb-connector-c/package.mk
+++ b/packages/databases/mariadb-connector-c/package.mk
@@ -16,6 +16,7 @@ PKG_CMAKE_OPTS_TARGET="-DWITH_EXTERNAL_ZLIB=ON
                        -DCLIENT_PLUGIN_MYSQL_CLEAR_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_MYSQL_OLD_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_REMOTE_IO=OFF
+                       -DDEFAULT_SSL_VERIFY_SERVER_CERT=OFF
                       "
 
 post_makeinstall_target() {

Display More

Thanks for testing vpeter - for the time being (as this needs a Kodi change) this will need to be the workaround.

The required variable in Kodi would be MYSQL_OPT_SSL_MODE=DISABLED as the current default is PREFERRED https://dev.mysql.com/doc/c-api/5.7/en/mysql-options.html that needs to be called before https://dev.mysql.com/doc/c-api/5.7/…al-connect.html

update to the PR https://github.com/xbmc/xbmc/pull/2566 would be needed in xbmc/dbwrappers/mysqldataset.cpp

Looks like this variable is for server only? Because I don't see reference in mariadb-connector-c.

NB: Without the workaround in https://github.com/LibreELEC/LibreELEC.tv/pull/8970 Kodi makes a large number of connections to the MariaDB server (making repeated connections trying to connect) and this may cause MariaDB to stop responding. Even if you update to an LE image with the workaround included, MariaDB may need to be restarted before it will accept connections again.

confirm the issue

even with self singed certs it then complains about using self signed

so cant use any version since the update

So, to confirm, the issue is resolved for you with the LE12 nightly? - the Android issue needs to be posted in the Kodi forum.

I can confirm working again with generic nightly-20240613-18becd8

and raspi 5 nightly-20240614