Skip to content

/ mysqlclient-python

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added to pass ssl_mode in configuration. #347

Merged
merged 11 commits into from Dec 3, 2019
Merged

Added to pass ssl_mode in configuration. #347

merged 11 commits into from Dec 3, 2019

Conversation

@migimigi
Copy link
Contributor

@migimigi migimigi commented Mar 19, 2019

SSL was enabled by default when connecting to MySQL 5.7.
See https://dev.mysql.com/worklog/task/?id=7712

Added to configuration to enable/disable SSL.
The reason for not using --ssl or --skip-ssl described in MySQL Worklog, --ssl option is deprecated as of MySQL 5.7.11.
See https://dev.mysql.com/doc/refman/5.7/en/encrypted-connection-options.html
Jun Yamasaki added 2 commits Mar 19, 2019
Jun Yamasaki
Add ssl_mode can be passed.
b28e723
Jun Yamasaki
Add a constant to specify SSL_MODE.
Loading status checks…
fd02b7d
@codecov
Copy link

@codecov codecov bot commented Mar 19, 2019

Codecov Report

Merging #347 into master will increase coverage by 0.04%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #347      +/-   ##
==========================================
+ Coverage   87.14%   87.18%   +0.04%     
==========================================
  Files          13       14       +1     
  Lines        1556     1561       +5     
==========================================
+ Hits         1356     1361       +5     
  Misses        200      200
Impacted Files Coverage Δ
MySQLdb/__init__.py 84.78% <100%> (ø) ⬆️
MySQLdb/constants/__init__.py 100% <100%> (ø) ⬆️
MySQLdb/constants/SSL_MODE.py 100% <100%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e04c597...fd02b7d. Read the comment docs.
@codecov
Copy link

@codecov codecov bot commented Mar 19, 2019 •
edited

Codecov Report

Merging #347 into master will increase coverage by 0.14%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #347      +/-   ##
==========================================
+ Coverage   86.61%   86.75%   +0.14%     
==========================================
  Files          12       12              
  Lines        1531     1533       +2     
==========================================
+ Hits         1326     1330       +4     
+ Misses        205      203       -2
Impacted Files Coverage Δ
MySQLdb/connections.py 81.81% <ø> (+1.67%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8fd628e...bd87447. Read the comment docs.
Jun Yamasaki
fix typo
Loading status checks…
35b74ce
@migimigi migimigi changed the title Added to pass sql_mode in configuration. Added to pass ssl_mode in configuration. Mar 20, 2019
@methane methane added this to the v2.0 milestone Nov 18, 2019
@methane
Copy link
Member

@methane methane commented Nov 28, 2019

I think there is no MYSQL_OPT_SSL_MODE in old MySQL Connector/C or MariaDB.
Would you test it?
@migimigi
Copy link
Contributor Author

@migimigi migimigi commented Nov 28, 2019

MYSQL_OPT_SSL_MODE exists from MySQL5.5.55.
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html#mysqld-5-5-55-security
I don't know about MariaDB.
I'm going to investigate, fix and test.
I couldn't find MySQL and MariaDB versions supported by mysqlclient-python at https://mysqlclient.readthedocs.io/
Is it there?
@methane
Copy link
Member

@methane methane commented Nov 28, 2019

MySQL 5.5+ are supported.
@methane
Copy link
Member

@methane methane commented Nov 28, 2019 •
edited

I used MYSQL_DEFAULT_AUTH which is introduced in MySQL 5.5.10. (see #396)
So MySQL 5.5.10+ are supported now.

I wll drop Python 2 support. So I am OK to drop some old MySQL support.
But 5.5.55 looks too new.
@migimigi
Copy link
Contributor Author

@migimigi migimigi commented Nov 28, 2019

I see.
Jun Yamasaki and others added 2 commits Nov 29, 2019
Jun Yamasaki
Fix to enable the ssl_mode setting only for MySQL versions where enum…
Loading status checks…
53e19a7 
… MYSQL_OPT_SSL_MODE is defined
@migimigi
Merge branch 'master' into feature/add_ssl_mode
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
73c4296
@migimigi
Copy link
Contributor Author

@migimigi migimigi commented Nov 29, 2019 •
edited

The version in which MYSQL_OPT_SSL_MODE is defined
5.5.55- https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html#mysqld-5-5-55-security
5.6.36- https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html#mysqld-5-6-36-security
5.7.11- https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-11.html#mysqld-5-7-11-security
8.0.0- https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-0.html#mysqld-8-0-0-security
Other than these versions were disabled with #if.

MYSQL_OPT_SSL_MODE was found to be not defined in MariaDB.
So it was disabled in MariaDB.
https://github.com/MariaDB/server/blob/10.5/include/mysql.h#L184
brianmario/mysql2#879 (comment)
@methane
Copy link
Member

@methane methane commented Nov 29, 2019

Options should be similar to my.cnf file. Imagine that users may load options from their config file.
So ssl_mode="VERIFY_CA", not ssl_mode=SSL_MODE.VERIFY_CA.
Jun Yamasaki
Modify ssl_mode setting from constant to string
Loading status checks…
08680b1
@migimigi
Copy link
Contributor Author

@migimigi migimigi commented Dec 2, 2019

It has modified
@methane
Copy link
Member

@methane methane commented Dec 2, 2019

I don't like this. This implementation ignores the ssl_mode option silently when it is not supported by the underlying library.

There are two options to fix this:

  • Raise an error if ssl_mode is not supported by the underlying library.
  • Support ssl_mode using legacy options.
Jun Yamasaki
Raises an error if the ssl_mode setting is not supported
Loading status checks…
e57c474
@migimigi
Copy link
Contributor Author

@migimigi migimigi commented Dec 2, 2019 •
edited

I see.
Choose to raises an error if the ssl_mode setting is not supported.
The legacy option was deprecated and was not used.
@methane
methane reviewed Dec 2, 2019
View changes
MySQLdb/_mysql.c Outdated
(PyCFunction)_mysql_get_have_enum_mysql_opt_ssl_mode,
METH_NOARGS,
_mysql_get_have_enum_mysql_opt_ssl_mode__doc__
},

This comment has been minimized.

Sign in to view
@methane

methane Dec 2, 2019
Member

Don't add new API.

This comment has been minimized.

Sign in to view
@migimigi

migimigi Dec 3, 2019
Author Contributor

I see.
MySQLdb/connections.py Outdated
@@ -102,6 +102,13 @@ class object, used to create cursors (keyword only)
:param int client_flag:
flags to use or 0 (see MySQL docs or constants/CLIENTS.py)
:param str ssl_mode

This comment has been minimized.

Sign in to view
@methane

methane Dec 2, 2019
Member

Suggested change
:param str ssl_mode
:param str ssl_mode:

This comment has been minimized.

Sign in to view
@migimigi

migimigi Dec 3, 2019
Author Contributor

thanks
MySQLdb/connections.py Outdated
if 'ssl_mode' in kwargs:
if not _mysql.get_have_enum_mysql_opt_ssl_mode():
raise NotSupportedError('Does not support ssl_mode specification: %s' % _mysql.get_client_info())
if hasattr(SSL_MODE, kwargs['ssl_mode']):
kwargs2['ssl_mode'] = getattr(SSL_MODE, kwargs['ssl_mode'])
else:
raise NotSupportedError('Unknown MySQL ssl_mode specification: %s' % kwargs['ssl_mode'])

Comment on lines 172 to 179

This comment has been minimized.

Sign in to view
@methane

methane Dec 2, 2019
Member

Implement this block in C.

This comment has been minimized.

Sign in to view
@migimigi

migimigi Dec 3, 2019
Author Contributor

Implemented error checking on the C lang side.
And removed MySQLdb.constants.SSL_MODE, which is no longer needed.
Jun Yamasaki added 4 commits Dec 3, 2019
Jun Yamasaki
Revert "Raises an error if the ssl_mode setting is not supported"
8335d70 
This reverts commit e57c474.
Jun Yamasaki
fix typo
09dc7e9
Jun Yamasaki
Remove MySQLdb.constants.SSL_MODE
67deee2
Jun Yamasaki
Check ssl_mode setting on C lang side
Loading status checks…
bd87447
@methane
Copy link
Member

@methane methane commented Dec 3, 2019

Thanks!
@methane methane merged commit 1a5ae1d into PyMySQL:master Dec 3, 2019
4 checks passed
4 checks passed
Codacy/PR Quality Review Up to standards. A positive pull request.
Details
codecov/patch Coverage not affected when comparing 8fd628e...bd87447
Details
codecov/project 86.75% (+0.14%) compared to 8fd628e
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@migimigi migimigi deleted the migimigi:feature/add_ssl_mode branch Dec 3, 2019
@migimigi migimigi restored the migimigi:feature/add_ssl_mode branch Dec 4, 2019
@parafoxx parafoxx mentioned this pull request Dec 23, 2019
Closed
2 of 3 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@methane methane

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v2.0
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
@migimigi @methane
You can’t perform that action at this time.