db_mysql: enable TLS when building with mariadb-connector-c

[space88man]

Pre-Submission Checklist

• Commit message has the format required by CONTRIBUTING guide
• Commits are split per component (core, individual modules, libs, utils, ...)
• Each component has a single commit (if not, squash them into one commit)
• No commits to README files for modules (changes must be done to docbook files
  in doc/ subfolder, the README file is autogenerated)

Type Of Change

• Small bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds new functionality)
• Breaking change (fix or feature that would change existing functionality)

Checklist:

• PR should be backported to stable branches
• Tested changes locally
• Related to issue db_mysql: built with mariadb-connector-c does not use TLS #3735

Description

When db_mysql is built with mariadb-connector-c it does not use TLS and fails if the server requires TLS. It seems to be related to the fact that the MYSQL object needs to have a minimal non-NULL configuration (unlike MySQL Connector/C).

This is a minimal setting to allow TLS. A more full-featured solution would be to enable db_mysql to read from an external configuration file.

@linuxmaniac, kindly take a look

UPDATE: the flag is MYSQL_OPT_SSL_ENFORCE which uses TLS if server advertises it. It does not make TLS mandatory (i..e doesn't fail if server has no TLS)

UPDATE: reuse module param opt_ssl_mode to configure MariaDB Connector/C.

Use existing opt_ssl_mode and map as follows.:

1. 0(off), 1(SSL_MODE_DISABLED): mariadb-connector-c defaults
2. 2(SSL_MODE_PREFERRED) 3(SSL_MODE_REQUIRED) 4(SSL_MODE_VERIFY_CA): MYSQL_OPT_SSL_ENFORCE
3. 5(SSL_MODE_VERIFY_IDENTITY): MYSQL_OPT_SSL_VERIFY_SERVER_CERT

[linuxmaniac]

But then, is the connection still possible without TLS or are we forcing that the server would support TLS?

[space88man]

But then, is the connection still possible without TLS or are we forcing that the server would support TLS?

Yes connection is possible if the server doesn't enforce TLS — the connection will use plain TCP.
The client needs to set MYSQL_OPT_SSL_ENFORCE MYSQL_OPT_SSL_VERIFY_SERVER_CERT to force the server to have TLS.

MYSQL_OPT_SSL_ENFORCE is badly named - it means: use TLS if server has TLS; it doesn't actually require TLS from server.

[linuxmaniac]

Much better now @space88man . Thanks for taking care.