HammerDB 4.6 (MySQL) reports SSL is used, even when disabled?

[jsrz]

I'm a little confused with the output when I run a test against a MySQL instance. Here is my TCL for the test (schema is already build before this):

#!/bin/tclsh
dbset db mysql
dbset bm TPROC-C
diset connection mysql_host <my_ip>
diset connection mysql_port 3306
diset connection mysql_ssl false
diset tpcc mysql_count_ware 1000
diset tpcc mysql_num_vu 100
diset tpcc mysql_user dbtestuser
diset tpcc mysql_pass dbtest
diset tpcc mysql_prepared true
diset tpcc mysql_total_iterations 1000000000
diset tpcc mysql_raiseerror true
diset tpcc mysql_driver timed
diset tpcc mysql_rampup 3
diset tpcc mysql_duration 15
diset tpcc mysql_timeprofile true
diset tpcc mysql_connect_pool false
loadscript

Notice that mysql_ssl is set to false. Yet, when I run the actual test like below:

puts "Start Test(s)"
foreach z { 1 25 50 100 } {
puts "Testing with $z users"
vuset vu $z
vuset iterations 1 
vuset logtotemp 1
vuset unique 1
vucreate
vurun
vudestroy
after 5000
}
puts "Tests complete"

I see the following in the output.

Vuser 1:RUNNING                           
Vuser 1:Initializing xtprof time profiler                                                                
Vuser 1:Ssl_cipher TLS_AES_256_GCM_SHA384                                                                
Vuser 1:Beginning rampup time of 3 minutes                                                               
Vuser 2:RUNNING                                                                                          
Vuser 2:Initializing xtprof time profiler                                                                
Vuser 2:Ssl_cipher TLS_AES_256_GCM_SHA384 
Vuser 2:Processing 1000000000 transactions with output suppressed...
...

Notice it say's "Ssl_cipher TLS_AES_256_GCM_SHA384".

Why is this in the output if I set mysql_ssl to false?

I recall not seeing this when I was running the above scripts with v4.5 (I think).

Edit: Actually I still see it in 4.5. Anyway, would like to understand what output means when mysql_ssl is false.

[sm-shaw]

What is the version of MySQL?

Looking into this the C code of the MySQL API is here https://github.com/sm-shaw/mysqltcl/blob/master/generic/mysqltcl.c - so we are using the API described here: https://dev.mysql.com/doc/refman/5.7/en/encrypted-connections.html

However it looks like the API has changed and there is an additional option now called --ssl-mode.
5.7.11: MySQL client programs support an --ssl-mode option that enables you to specify the security state of the connection to the server. The --ssl-mode option comprises the capabilities of the client-side --ssl and --ssl-verify-server-cert options. Consequently, --ssl and --ssl-verify-server-cert are deprecated, and are removed in MySQL 8.0.
So it looks like --ssl-mode should be added to mysqltcl for MySQL 8.0 support:
https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html

By default this is set to preferred, so this is why you (presumably on MySQL 8.0?) see encryption enabled as we are setting -ssl instead of -ssl-mode so -ssl-mode is not set and defaulting to being enabled.

The default setting, [--ssl-mode=PREFERRED](https://dev.mysql.com/doc/refman/8.0/en/connection-options.html#option_general_ssl-mode), produces an encrypted connection if the other default settings are unchanged.

So, if you let me know the MySQL we can investigate further to see if we can add the additional option for MySQL 8.0 without breaking the current level of support for MySQL 5.7.

[jsrz]

Apologies, I should have mentioned the version of MySQL.

I am building 8.0.32 from source, so yes, 8.0.

Thanks for the insight on the changes to the APIs.

[sm-shaw]

Yes, so it is likely we need to add -ssl-mode option to the mysqltcl code here https://github.com/sm-shaw/mysqltcl and then add this option to HammerDB also. We will use this issue to track-it.

[sm-shaw]

This issue has been fixed by this commit sm-shaw/mysqltcl@5558fac in the mysqltcl package and the code in the source repository already updated to reflect the change.

Note that the mysqltcl library in v4.6 and upcoming v4.7 will show the old behaviour, so if you need to disable SSL running against MySQL 8.0 you will need to compile HammerDB from source and this will pick up the changes.

Also note that with MySQL using sockets to connect to a localhost does disable SSL by default so if SSL is desired to be enabled on a host running HammerDB on the same system as the database the socket must be set to "null" in the HammerDB options to use the host and port instead and thereby use SSL.

These were the my.cnf example SSL parameters used for testing. Note that if require_secure_transport is set to ON then it will not allow a non SSL connection as shown later so must be set to OFF to disable SSL.

ssl=on
ssl-cipher=DHE-RSA-AES256-SHA
ssl-ca=/opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/ca-cert.pem
ssl-cert=/opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/server-cert.pem
ssl-key=/opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/server-key.pem
require_secure_transport=OFF
...
[client]
ssl-mode=PREFERRED
ssl-cert=/opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/client-cert.pem
ssl-key=/opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/client-key.pem

For testing, the following script was used to make 2 connections, one with SSL on and the other with it off.

package require mysqltcl
puts "Test for MySQL 8.0 with SSL ON"
set handler [ mysqlconnect -ssl true -sslca /opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/ca-cert.pem -host 127.0.0.1 -port 3306 -user root -password mysql ]
puts "connected with $handler"
mysqluse $handler tpcc
puts [ mysql::sel $handler "show session status like 'ssl_cipher'" -list ]
set handler [ mysqlconnect -ssl false -sslca /opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/ca-cert.pem -host 127.0.0.1 -port 3306 -user root -password mysql ]
puts "Test for MySQL 8.0 with SSL OFF"
puts "connected with $handler"
mysqluse $handler tpcc
puts [ mysql::sel $handler "show session status like 'ssl_cipher'" -list ]

If we run this on v4.6 then we see the observed behaviour, SSL PREFERRED is enabled by default even though in the second connection it is set to off so SSL is enabled for both.

HammerDB-4.6$ ./hammerdbcli 
HammerDB CLI v4.6
hammerdb>source /opt/mysqlssl.tcl
Test for MySQL 8.0 with SSL ON
connected with mysql0
{Ssl_cipher TLS_AES_256_GCM_SHA384}
Test for MySQL 8.0 with SSL OFF
connected with mysql1
{Ssl_cipher TLS_AES_256_GCM_SHA384}

With the modified mysql package if ssl is set to false we now set the MYSQL_OPT_SSL_MODE option to SSL_MODE_DISABLED and now we get the correct beahviour with SSL disabled in the 2nd connection.

HammerDB-4.7$ ./hammerdbcli 
HammerDB CLI v4.7
hammerdb>source /opt/mysqlssl.tcl
Test for MySQL 8.0 with SSL ON
connected with mysql0
{Ssl_cipher TLS_AES_256_GCM_SHA384}
Test for MySQL 8.0 with SSL OFF
connected with mysql1
{Ssl_cipher {}}

As noted if require_secure_transport=ON then we will receive an error trying to connect with ssl = false. This is the correct behaviour.

hammerdb>source /opt/mysqlssl.tcl
Test for MySQL 8.0 with SSL ON
connected with mysql2
{Ssl_cipher TLS_AES_256_GCM_SHA384}
mysqlconnect/db server: Connections using insecure transport are prohibited while --require_secure_transport=ON.
    while executing
"mysqlconnect -ssl false -sslca /opt/mysql-8.0.20-linux-glibc2.12-x86_64/ssl/ca-cert.pem -host 127.0.0.1 -port 3306 -user root -password mysql "
    (file "/opt/mysqlssl.tcl" line 7)
    invoked from within
"source /opt/mysqlssl.tcl"

This update allows us to switch the SSL mode from preferred to disabled by changing the mysqltcl package without modifying the HammerDB code, whilst also allowing it to run against earlier versions.

There are more and alternative SSL options that we could set and make changes to the HammerDB code, however for now this minimal change allows SSL to be disabled against MySQL 8.0 so addresses the issue.

To reiterate to see this desired behaviour it is necessary to compile HammerDB from source , this will then pull and build the modified mysqltcl library (or clone and build mysqltcl from here https://github.com/sm-shaw/mysqltcl and replaced the library in the HammerDB lib directory with the new one.