SSL mode seems bugged with mysql

[DorianCoding]

Rust Version

1.97.0

Diesel Version

2.3.10

Diesel Features

mysql

Database Version

mariadb from 11.8.8-MariaDB

Operating System Version

Debian 14 (Forky)

What happened?

With this script and using tcpdump, the traffic is not encrypted and if require_secure_transport is set on server, connection is rejected:

use diesel::{Connection, RunQueryDsl, backend::Backend, mysql};

fn main() {
    println!("Hello, world!");
    let mut connect = mysql::MysqlConnection::establish(
        "mysql://abou:xxxxxxx@127.0.0.1:3306/abou?ssl_mode=required",
    )
    .unwrap();
    let request = diesel::sql_query("SHOW PROCESSLIST;");
    let _ = request.execute(&mut connect).unwrap();
}

I got:

"Connections using insecure transport are prohibited while --require_secure_transport=ON."

What did you expect to happen?

SSL connection working, even with --require_secure_transport=ON

Additional details

It does not work with preferred as well.

Steps to reproduce

- Open mariadb server
- create the upper script and try to connect
- check on tcpdump unencrypted data or set require_secure_transport = ON

Compile time error

No response

Checklist

• I have already looked over the issue tracker and the discussion forum for similar possible closed issues.

• This issue can be reproduced on Rust's stable channel. (Please submit the issue in the Rust issue tracker instead if that's not the case)

• This issue can be reproduced without requiring a third party crate

[weiznich]

@DorianCoding I converted this to a discussion as this affects MariaDB which is not officially supported by diesel yet. See #1882 for adding support for MariaDB. As long as such support doesn't officially exist we don't treat missing/broken features like this a bug that should be tracked in an issue, but as a compatibility problem on MariaDB's side as their "mysql" compatibility doesn't actually work like the official MySQL. We still accept patches to fix such behaviour but the at least I won't spend time on working on fixes for such issues.

That written this particular problem occurs as libmariadb requires to specify the SSL setup in a different way using different flags that libmysqlclient. The current implementation only supports libmysqlclient in that manner. You can find the relevant code here:

diesel/diesel/src/mysql/connection/raw.rs

Lines 210 to 252 in f8645bb

	fn set_ssl_mode(&self, ssl_mode: mysqlclient_sys::mysql_ssl_mode) {
	let v = ssl_mode as u32;
	let v_ptr: *const u32 = &v;
	let n = ptr::NonNull::new(v_ptr as *mut u32).expect("NonNull::new failed");
	unsafe {
	mysqlclient_sys::mysql_options(
	self.0.as_ptr(),
	mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_MODE,
	n.as_ptr() as *const core::ffi::c_void,
	)
	};
	}
	fn set_ssl_ca(&self, ssl_ca: &CStr) {
	unsafe {
	mysqlclient_sys::mysql_options(
	self.0.as_ptr(),
	mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_CA,
	ssl_ca.as_ptr() as *const core::ffi::c_void,
	)
	};
	}
	fn set_ssl_cert(&self, ssl_cert: &CStr) {
	unsafe {
	mysqlclient_sys::mysql_options(
	self.0.as_ptr(),
	mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_CERT,
	ssl_cert.as_ptr() as *const core::ffi::c_void,
	)
	};
	}
	fn set_ssl_key(&self, ssl_key: &CStr) {
	unsafe {
	mysqlclient_sys::mysql_options(
	self.0.as_ptr(),
	mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_KEY,
	ssl_key.as_ptr() as *const core::ffi::c_void,
	)
	};
	}

In particular there is no MYSQL_OPT_SSL_MODE support in libmariadb, while there is such support in libmysqlclient

Also consider filling this bug upstream (libmariadb, and possibly also in your distribution), as they both claim that libmariadb is a drop in replacement for libmysqlclient.

[DorianCoding]

That written this particular problem occurs as libmariadb requires to specify the SSL setup in a different way using different flags that libmysqlclient. The current implementation only supports libmysqlclient in that manner. You can find the relevant code here:

Thank you @weiznich for your remark. This is indeed the cause it seems.

We still accept patches to fix such behaviour but the at least I won't spend time on working on fixes for such issues.

I will try. On a fresh program, it works like this:

fn set_ssl_mode(&self, ssl_mode: mysqlclient_sys::mysql_ssl_mode) {
        let v = ssl_mode as u32;
        let v_ptr: *const u32 = &v;
        let n = ptr::NonNull::new(v_ptr as *mut u32).expect("NonNull::new failed");
        let truec = true;
        let falsec = false;
        unsafe {
            match ssl_mode {
                mysql_ssl_mode::SSL_MODE_DISABLED => {
                    mysqlclient_sys::mysql_optionsv(
                        self.0.as_ptr(),
                        mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_ENFORCE,
                        &falsec as *const _ as *const core::ffi::c_void,
                    );
                    ()
                }
                mysql_ssl_mode::SSL_MODE_PREFERRED | mysql_ssl_mode::SSL_MODE_REQUIRED => {
                    mysqlclient_sys::mysql_optionsv(
                        self.0.as_ptr(),
                        mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_ENFORCE,
                        &truec as *const _ as *const core::ffi::c_void,
                    );
                    ()
                }
                mysql_ssl_mode::SSL_MODE_VERIFY_CA | mysql_ssl_mode::SSL_MODE_VERIFY_IDENTITY => {
                    mysqlclient_sys::mysql_optionsv(
                        self.0.as_ptr(),
                        mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_ENFORCE,
                        &truec as *const _ as *const core::ffi::c_void,
                    );
                    mysqlclient_sys::mysql_optionsv(
                        self.0.as_ptr(),
                        mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                        &truec as *const _ as *const core::ffi::c_void,
                    );
                    ()
                }
            }
            mysqlclient_sys::mysql_options(
                self.0.as_ptr(),
                mysqlclient_sys::mysql_option::MYSQL_OPT_SSL_MODE,
                n.as_ptr() as *const core::ffi::c_void,
            )
        };
    }

[weiznich]

Thanks for looking into this. The problem with that approach is that the necessary constants only exist if libmariadb is used, not when libmysqlclient is used. So we cannot easily use them. What we could do is to mirror the relevant values in diesel and theme use these. That might need to be guarded behind some runtime check if the underlying connection is based on libmariadb. I'm happy to review a PR for that.

[DorianCoding]

You are right. However I ran into some issues preventing any PR so far. While my code fixes TLS when using libmariadev, I have experienced issues with diesel migrations and select when using Vaultwarden compiled with diesel with libmariadev. It works with libmysql but does not as far as I have tested with libmariadb even without my modifications, which makes me believe there is additional compatibility issues that would lead to issues. I am still looking into it and will keep you touch. In the meantime, I hope this discussion can help people having the same issue. I'm wondering also if it is specific to the version I am using (testing versions).

[weiznich]

While my code fixes TLS when using libmariadev, I have experienced issues with diesel migrations and select when using Vaultwarden compiled with diesel with libmariadev. It works with libmysql but does not as far as I have tested with libmariadb even without my modifications, which makes me believe there is additional compatibility issues that would lead to issues. I am still looking into it and will keep you touch. In the meantime, I hope this discussion can help people having the same issue. I'm wondering also if it is specific to the version I am using (testing versions).

That's #5091. No need to spend much time on debugging it, it's an regression in libmariadb itself. Hopefully the manage to fix it sometime soon.