MariaDB connector update forces SSL

gregtotheizzo · June 8, 2024 at 3:12 PM New

Running my library on MariaDB 10 on a QNAP

Updated from RPI5 13 5/30 nightly to 6/7 and lost access to the library.

Logs show the updated connector is FORCING ssl/tls requirements.

Is there a way to bypass ssl to access my library?

Reverting back to 5/30 nightly works so thinking it's the recent connector update.

**heitbaum** · June 9, 2024 at 7:50 AM New

Can you confirm it forces ssl or forces ssl verification?

these are the changes

Comparing v3.3.10...v3.4.0 · mariadb-corporation/mariadb-connector-c

MariaDB Connector/C is used to connect applications developed in C/C++ to MariaDB and MySQL databases.The client library is LGPL licensed. - Comparing…

github.com

and this one is the force ssl verification.

make DEFAULT_SSL_VERIFY_SERVER_CERT a cmake option · mariadb-corporation/mariadb-connector-c@82983a3

github.com

Here are the ssl stuff from mariadb and there seems to be some require per user. Without seeing the logs I could not comment further. But is your connection running ssl (and just without the verify?) and it fails with the connector 3.4 (due to the verify) - the comments should be pretty useful in isolating this.

Securing Connections for Client and Server

Enabling TLS encryption in transit on both the client and server.

mariadb.com

**vpeter** · June 9, 2024 at 7:57 AM New

Code

2024-06-07 13:06:32.447 T:2769    error <general>: Unable to open database: MyMusic83 [2026](TLS/SSL error: SSL is required, but the server does not support it)

**vpeter** · June 9, 2024 at 8:32 AM New

Looks like this works:

Diff

diff --git a/packages/databases/mariadb-connector-c/package.mk b/packages/databases/mariadb-connector-c/package.mk
index f77ec39aa7..0a213c77fb 100644
--- a/packages/databases/mariadb-connector-c/package.mk
+++ b/packages/databases/mariadb-connector-c/package.mk
@@ -16,6 +16,7 @@ PKG_CMAKE_OPTS_TARGET="-DWITH_EXTERNAL_ZLIB=ON
                        -DCLIENT_PLUGIN_MYSQL_CLEAR_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_MYSQL_OLD_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_REMOTE_IO=OFF
+                       -DDEFAULT_SSL_VERIFY_SERVER_CERT=OFF
                       "
 
 post_makeinstall_target() {

Display More

**heitbaum** · June 9, 2024 at 8:37 AM New

It looks like the client has changed the “failure logic”

[MDEV-28634] Client's --ssl-* options (without --ssl-verify-server-cert) are silently ignored if TLS is not possible - Jira
>> The client will only see an error if they also provide the --ssl-verify-server-cert option:<<

I believe the correct fix would be to set sslMode=disabled in the connection from Kodi - as in https://mariadb.com/kb/en/using-tl…java-connector/ (will be the same with c connector I believe)
By default when sslMode is set (not disabled), connector will use "serverSslCert" is set or the default truststore if not. Using default truststore can be disable setting option "fallbackToSystemTrustStore" to false.

**heitbaum** · June 9, 2024 at 8:39 AM New

Quote from vpeter

Looks like this works:

Diff

diff --git a/packages/databases/mariadb-connector-c/package.mk b/packages/databases/mariadb-connector-c/package.mk
index f77ec39aa7..0a213c77fb 100644
--- a/packages/databases/mariadb-connector-c/package.mk
+++ b/packages/databases/mariadb-connector-c/package.mk
@@ -16,6 +16,7 @@ PKG_CMAKE_OPTS_TARGET="-DWITH_EXTERNAL_ZLIB=ON
                        -DCLIENT_PLUGIN_MYSQL_CLEAR_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_MYSQL_OLD_PASSWORD=STATIC
                        -DCLIENT_PLUGIN_REMOTE_IO=OFF
+                       -DDEFAULT_SSL_VERIFY_SERVER_CERT=OFF
                       "
 
 post_makeinstall_target() {

Display More

Thanks for testing vpeter - for the time being (as this needs a Kodi change) this will need to be the workaround.

**heitbaum** · June 9, 2024 at 9:03 AM New

The required variable in Kodi would be MYSQL_OPT_SSL_MODE=DISABLED as the current default is PREFERRED https://dev.mysql.com/doc/c-api/5.7/en/mysql-options.html that needs to be called before https://dev.mysql.com/doc/c-api/5.7/…al-connect.html

update to the PR https://github.com/xbmc/xbmc/pull/2566 would be needed in xbmc/dbwrappers/mysqldataset.cpp

**vpeter** · June 9, 2024 at 1:35 PM New

Looks like this variable is for server only? Because I don't see reference in mariadb-connector-c.

**chewitt** · June 10, 2024 at 7:57 AM New

NB: Without the workaround in https://github.com/LibreELEC/LibreELEC.tv/pull/8970 Kodi makes a large number of connections to the MariaDB server (making repeated connections trying to connect) and this may cause MariaDB to stop responding. Even if you update to an LE image with the workaround included, MariaDB may need to be restarted before it will accept connections again.

Nekromantik · June 10, 2024 at 5:45 PM New

confirm the issue

even with self singed certs it then complains about using self signed

so cant use any version since the update

gregtotheizzo · June 13, 2024 at 2:14 PM New

Sorry I had a personal issue.

when I first upgraded it didn't work. Without troubleshooting I swapped back to 5/30 but still wasn't able to connect.

Log showed too many attempts.

Restarted SQL confirmed library working. Swapped to 6/7 and then those logs referenced SSL requirements.

I updated Kodi on FireTV with apk direct from Kodi and library stopped working.

So seems the issue stems from base newer base Kodi updates.

**chewitt** · June 14, 2024 at 4:45 AM New

So, to confirm, the issue is resolved for you with the LE12 nightly? - the Android issue needs to be posted in the Kodi forum.

yamcenutzer · June 14, 2024 at 2:33 PM New

I can confirm working again with generic nightly-20240613-18becd8

and raspi 5 nightly-20240614

gregtotheizzo · June 15, 2024 at 2:25 PM New

Confirmed working on 6/14 nightly thanks again!

gregtotheizzo · June 27, 2024 at 3:59 PM New

Sorry to beat a dead horse libreelec works flawless.

I see the request made on git and have also posted Kodi forums

Building Kodi (Omega) with mariadb-connector-c 3.4 does not allow connection to non-ssl databases · Issue #25313 · xbmc/xbmc

Bug report Describe the bug Here is a clear and concise description of what the problem is: With the change in mariadb-corporation/mariadb-connector-c@82983a3…

github.com

Is there anyway to edit a conf to disable the SSL requirement in the interim? I know this might not be the best place to post the question since it's confirmed as a Kodi issue. However figured I'd ask in case it might be a simple line I could toss in or in comment.

Thanks again for fixing this originally.

**chewitt** · June 27, 2024 at 5:50 PM New

Quote from gregtotheizzo

Is there anyway to edit a conf to disable the SSL requirement in the interim?

No, it needs to be compiled with the right options. The fix is in LE12/13 nightlies for a while so just update to the current one?

**heitbaum** · June 28, 2024 at 3:49 PM New

Quote from gregtotheizzo

Sorry to beat a dead horse libreelec works flawless.

I see the request made on git and have also posted Kodi forums
https://github.com/xbmc/xbmc/issues/25313

Is there anyway to edit a conf to disable the SSL requirement in the interim? I know this might not be the best place to post the question since it's confirmed as a Kodi issue. However figured I'd ask in case it might be a simple line I could toss in or in comment.

Thanks again for fixing this originally.

Display More

In LE we have fixed/worked around …. the connector change and the fact that 3.4 can only work with a verified ssl connection.

The below patch to Kodi “should” fix Kodi to alway “not verify” ssl (thus allowing non sls too). I have not submitted it upstream as I have not “fully tested it”.

Diff

From 28b0785f4e08ea5bc102e42d7af55108256ce778 Mon Sep 17 00:00:00 2001
From: Rudi Heitbaum <[email protected]>
Date: Mon, 10 Jun 2024 06:12:49 +0000
Subject: [PATCH] mysql: force SSL off
---
xbmc/dbwrappers/mysqldataset.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xbmc/dbwrappers/mysqldataset.cpp b/xbmc/dbwrappers/mysqldataset.cpp
index e277eefd8f..99f2deb160 100644
--- a/xbmc/dbwrappers/mysqldataset.cpp
+++ b/xbmc/dbwrappers/mysqldataset.cpp
@@ -181,6 +181,11 @@ int MysqlDatabase::connect(bool create_new)
    if (!CWakeOnAccess::GetInstance().WakeUpHost(host, "MySQL : " + db))
      return DB_CONNECTION_NONE;

+    my_bool verify=0;
+    mysql_options(conn, MYSQL_OPT_SSL_ENFORCE, (void *)&verify);
+    my_bool enforce_tls=0;
+    mysql_options(conn, MYSQL_OPT_SSL_ENFORCE, (void *)&enforce_tls);
+
    // establish connection with just user credentials
    if (mysql_real_connect(conn, host.c_str(), login.c_str(), passwd.c_str(), NULL,
                           atoi(port.c_str()), NULL, compression ? CLIENT_COMPRESS : 0) != NULL)
-- 
2.43.0

Display More