Skip to content

Commit 9c19613

Browse files
bcardiffysbaddaden
bcardiff
and
ysbaddaden
authored
Add ssl support (#117)
* Add ssl support * Update README.md Co-authored-by: Julien Portalier <[email protected]> * Make nilable params optional * Leverage Enum.parse for SSLMode * Use Path#expand and fix specs * Bump CI to crystal >= 1.9.0 --------- Co-authored-by: Julien Portalier <[email protected]>
1 parent 00b055d commit 9c19613

File tree

7 files changed

+196
-27
lines changed

7 files changed

+196
-27
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
fail-fast: false
1414
matrix:
1515
os: [ubuntu-latest]
16-
crystal: [1.3.0, latest, nightly]
16+
crystal: [1.9.0, latest, nightly]
1717
mysql_version: ["5.7"]
1818
database_host: ["default", "/tmp/mysql.sock"]
1919
runs-on: ${{ matrix.os }}

‎README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,17 @@ Query string takes precedence because it's more explicit.
107107
- `mysql://localhost:3306?database=mydb`
108108
- `mysql:///path/to/other.sock?database=mydb`
109109

110+
#### Secure connections (SSL/TLS)
111+
112+
By default a tcp connection will establish a secure connection, whether a unix socket will not.
113+
114+
You can tweak this default behaviour and require further validation of certificates using `ssl-mode` and the following query strings.
115+
116+
- `ssl-mode`: Either `disabled`, `preferred` (default), `required`, `verify_ca`, `verify_identity`.
117+
- `ssl-key`: Path to the client key.
118+
- `ssl-cert`: Path to the client certificate.
119+
- `ssl-ca`: Path to the CA certificate.
120+
110121
#### Other query params
111122

112123
- `encoding`: The collation & charset (character set) to use during the connection.

‎spec/connection_options_spec.cr‎

Lines changed: 85 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,114 +12,181 @@ private def socket(path)
1212
URI.new("unix", nil, nil, path)
1313
end
1414

15+
private def ssl_from_params(params)
16+
Connection::SSLOptions.from_params(URI::Params.parse(params))
17+
end
18+
19+
SSL_OPTION_PREFERRED = Connection::SSLOptions.new(mode: :preferred)
20+
1521
describe Connection::Options do
1622
describe ".from_uri" do
1723
it "parses mysql://user@host/db" do
1824
from_uri("mysql://root@localhost/test").should eq(
19-
MySql::Connection::Options.new(
25+
Connection::Options.new(
2026
transport: tcp("localhost", 3306),
2127
username: "root",
2228
password: nil,
2329
initial_catalog: "test",
24-
charset: Collations.default_collation
30+
charset: Collations.default_collation,
31+
ssl_options: SSL_OPTION_PREFERRED
2532
)
2633
)
2734
end
2835

2936
it "parses mysql://host" do
3037
from_uri("mysql://localhost").should eq(
31-
MySql::Connection::Options.new(
38+
Connection::Options.new(
3239
transport: tcp("localhost", 3306),
3340
username: nil,
3441
password: nil,
3542
initial_catalog: nil,
36-
charset: Collations.default_collation
43+
charset: Collations.default_collation,
44+
ssl_options: SSL_OPTION_PREFERRED
3745
)
3846
)
3947
end
4048

4149
it "parses mysql://host:port" do
4250
from_uri("mysql://localhost:1234").should eq(
43-
MySql::Connection::Options.new(
51+
Connection::Options.new(
4452
transport: tcp("localhost", 1234),
4553
username: nil,
4654
password: nil,
4755
initial_catalog: nil,
48-
charset: Collations.default_collation
56+
charset: Collations.default_collation,
57+
ssl_options: SSL_OPTION_PREFERRED
4958
)
5059
)
5160
end
5261

5362
it "parses ?encoding=..." do
5463
from_uri("mysql://localhost:1234?encoding=utf8mb4_unicode_520_ci").should eq(
55-
MySql::Connection::Options.new(
64+
Connection::Options.new(
5665
transport: tcp("localhost", 1234),
5766
username: nil,
5867
password: nil,
5968
initial_catalog: nil,
60-
charset: "utf8mb4_unicode_520_ci"
69+
charset: "utf8mb4_unicode_520_ci",
70+
ssl_options: SSL_OPTION_PREFERRED
6171
)
6272
)
6373
end
6474

6575
it "parses mysql://user@host?database=db" do
6676
from_uri("mysql://root@localhost?database=test").should eq(
67-
MySql::Connection::Options.new(
77+
Connection::Options.new(
6878
transport: tcp("localhost", 3306),
6979
username: "root",
7080
password: nil,
7181
initial_catalog: "test",
72-
charset: Collations.default_collation
82+
charset: Collations.default_collation,
83+
ssl_options: SSL_OPTION_PREFERRED
7384
)
7485
)
7586
end
7687

7788
it "parses mysql:///path/to/socket" do
7889
from_uri("mysql:///path/to/socket").should eq(
79-
MySql::Connection::Options.new(
90+
Connection::Options.new(
8091
transport: socket("/path/to/socket"),
8192
username: nil,
8293
password: nil,
8394
initial_catalog: nil,
84-
charset: Collations.default_collation
95+
charset: Collations.default_collation,
96+
ssl_options: SSL_OPTION_PREFERRED
8597
)
8698
)
8799
end
88100

89101
it "parses mysql:///path/to/socket?database=test" do
90102
from_uri("mysql:///path/to/socket?database=test").should eq(
91-
MySql::Connection::Options.new(
103+
Connection::Options.new(
92104
transport: socket("/path/to/socket"),
93105
username: nil,
94106
password: nil,
95107
initial_catalog: "test",
96-
charset: Collations.default_collation
108+
charset: Collations.default_collation,
109+
ssl_options: SSL_OPTION_PREFERRED
97110
)
98111
)
99112
end
100113

101114
it "parses mysql:///path/to/socket?encoding=utf8mb4_unicode_520_ci" do
102115
from_uri("mysql:///path/to/socket?encoding=utf8mb4_unicode_520_ci").should eq(
103-
MySql::Connection::Options.new(
116+
Connection::Options.new(
104117
transport: socket("/path/to/socket"),
105118
username: nil,
106119
password: nil,
107120
initial_catalog: nil,
108-
charset: "utf8mb4_unicode_520_ci"
121+
charset: "utf8mb4_unicode_520_ci",
122+
ssl_options: SSL_OPTION_PREFERRED
109123
)
110124
)
111125
end
112126

113127
it "parses mysql://user:pass@/path/to/socket?database=test" do
114128
from_uri("mysql://root:password@/path/to/socket?database=test").should eq(
115-
MySql::Connection::Options.new(
129+
Connection::Options.new(
116130
transport: socket("/path/to/socket"),
117131
username: "root",
118132
password: "password",
119133
initial_catalog: "test",
120-
charset: Collations.default_collation
134+
charset: Collations.default_collation,
135+
ssl_options: SSL_OPTION_PREFERRED
121136
)
122137
)
123138
end
124139
end
125140
end
141+
142+
describe Connection::SSLOptions do
143+
describe ".from_params" do
144+
it "default is ssl-mode=preferred" do
145+
ssl_from_params("").mode.should eq(Connection::SSLMode::Preferred)
146+
end
147+
148+
it "parses ssl-mode=preferred" do
149+
ssl_from_params("ssl-mode=preferred").mode.should eq(Connection::SSLMode::Preferred)
150+
ssl_from_params("ssl-mode=Preferred").mode.should eq(Connection::SSLMode::Preferred)
151+
ssl_from_params("ssl-mode=PREFERRED").mode.should eq(Connection::SSLMode::Preferred)
152+
end
153+
154+
it "parses ssl-mode=disabled" do
155+
ssl_from_params("ssl-mode=disabled").mode.should eq(Connection::SSLMode::Disabled)
156+
ssl_from_params("ssl-mode=Disabled").mode.should eq(Connection::SSLMode::Disabled)
157+
ssl_from_params("ssl-mode=DISABLED").mode.should eq(Connection::SSLMode::Disabled)
158+
end
159+
160+
it "parses ssl-mode=verifyca" do
161+
ssl_from_params("ssl-mode=verifyca").mode.should eq(Connection::SSLMode::VerifyCA)
162+
ssl_from_params("ssl-mode=verify-ca").mode.should eq(Connection::SSLMode::VerifyCA)
163+
ssl_from_params("ssl-mode=verify_ca").mode.should eq(Connection::SSLMode::VerifyCA)
164+
ssl_from_params("ssl-mode=VERIFY_CA").mode.should eq(Connection::SSLMode::VerifyCA)
165+
end
166+
167+
it "parses ssl-mode=verifyidentity" do
168+
ssl_from_params("ssl-mode=verifyidentity").mode.should eq(Connection::SSLMode::VerifyIdentity)
169+
ssl_from_params("ssl-mode=verify-identity").mode.should eq(Connection::SSLMode::VerifyIdentity)
170+
ssl_from_params("ssl-mode=verify_identity").mode.should eq(Connection::SSLMode::VerifyIdentity)
171+
ssl_from_params("ssl-mode=VERIFY_IDENTITY").mode.should eq(Connection::SSLMode::VerifyIdentity)
172+
end
173+
174+
it "parses ssl-key, ssl-cert, ssl-ca" do
175+
ssl_from_params("ssl-key=path/to/key.pem&ssl-cert=path/to/cert.pem&ssl-ca=path/to/ca.pem").should eq(
176+
Connection::SSLOptions.new(mode: Connection::SSLMode::Preferred,
177+
key: Path["path/to/key.pem"].expand(home: true),
178+
cert: Path["path/to/cert.pem"].expand(home: true),
179+
ca: Path["path/to/ca.pem"].expand(home: true))
180+
)
181+
end
182+
183+
it "missing ssl-key, ssl-cert, ssl-ca as nil" do
184+
ssl_from_params("").should eq(
185+
Connection::SSLOptions.new(mode: Connection::SSLMode::Preferred,
186+
key: nil,
187+
cert: nil,
188+
ca: nil)
189+
)
190+
end
191+
end
192+
end

‎spec/driver_spec.cr‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,18 @@ describe Driver do
6969
end
7070
end
7171

72+
it "should be able to connect without ssl" do
73+
with_db nil, "ssl-mode=disabled" do |db|
74+
db.scalar("SELECT VARIABLE_VALUE FROM performance_schema.session_status WHERE VARIABLE_NAME = 'Ssl_cipher'").should eq("")
75+
end
76+
end
77+
78+
it "should be able to connect with ssl" do
79+
with_db nil, "ssl-mode=required" do |db|
80+
db.scalar("SELECT VARIABLE_VALUE FROM performance_schema.session_status WHERE VARIABLE_NAME = 'Ssl_cipher'").should_not eq("")
81+
end
82+
end
83+
7284
it "create and drop test database" do
7385
sql = "SELECT count(*) FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = 'crystal_mysql_test'"
7486

‎spec/spec_helper.cr‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ def db_url(initial_db = nil)
88
if initial_db
99
"mysql://root@#{database_host}?database=#{initial_db}"
1010
else
11-
"mysql://root@#{database_host}"
11+
"mysql://root@#{database_host}?"
1212
end
1313
end
1414

‎src/mysql/connection.cr‎

Lines changed: 73 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,58 @@
11
require "socket"
2+
require "openssl"
23

34
class MySql::Connection < DB::Connection
5+
enum SSLMode
6+
Disabled
7+
Preferred
8+
Required
9+
VerifyCA
10+
VerifyIdentity
11+
end
12+
record SSLOptions, mode : SSLMode, key : Path? = nil, cert : Path? = nil, ca : Path? = nil do
13+
def self.from_params(params : URI::Params)
14+
mode =
15+
if mode_param = params["ssl-mode"]?
16+
SSLMode.parse(mode_param)
17+
else
18+
SSLMode::Preferred
19+
end
20+
21+
# NOTE: Passing paths prefixed with ~/ or ./ seems to not work with OpenSSL
22+
# we we expand the provided path.
23+
key = (params["ssl-key"]?).try { |v| Path[v].expand(home: true) }
24+
cert = (params["ssl-cert"]?).try { |v| Path[v].expand(home: true) }
25+
ca = (params["ssl-ca"]?).try { |v| Path[v].expand(home: true) }
26+
27+
SSLOptions.new(mode: mode, key: key, cert: cert, ca: ca)
28+
end
29+
30+
def build_context : OpenSSL::SSL::Context::Client
31+
ctx = OpenSSL::SSL::Context::Client.new
32+
33+
ctx.verify_mode =
34+
case mode
35+
when SSLMode::VerifyCA, SSLMode::VerifyIdentity
36+
OpenSSL::SSL::VerifyMode::PEER
37+
else
38+
OpenSSL::SSL::VerifyMode::NONE
39+
end
40+
41+
ctx.certificate_chain = cert.to_s if cert = @cert
42+
ctx.private_key = key.to_s if key = @key
43+
ctx.ca_certificates = ca.to_s if ca = @ca
44+
45+
ctx
46+
end
47+
end
48+
449
record Options,
550
transport : URI,
651
username : String?,
752
password : String?,
853
initial_catalog : String?,
9-
charset : String do
54+
charset : String,
55+
ssl_options : SSLOptions do
1056
def self.from_uri(uri : URI) : Options
1157
params = uri.query_params
1258
initial_catalog = params["database"]?
@@ -32,23 +78,26 @@ class MySql::Connection < DB::Connection
3278
Options.new(
3379
transport: transport,
3480
username: username, password: password,
35-
initial_catalog: initial_catalog, charset: charset)
81+
initial_catalog: initial_catalog, charset: charset,
82+
ssl_options: SSLOptions.from_params(params)
83+
)
3684
end
3785
end
3886

3987
def initialize(options : ::DB::Connection::Options, mysql_options : ::MySql::Connection::Options)
4088
super(options)
41-
@socket = uninitialized UNIXSocket | TCPSocket
89+
@socket = uninitialized UNIXSocket | TCPSocket | OpenSSL::SSL::Socket::Client
4290

4391
begin
4492
charset_id = Collations.id_for_collation(mysql_options.charset).to_u8
4593

4694
transport = mysql_options.transport
95+
hostname = nil
4796
@socket =
4897
case transport.scheme
4998
when "tcp"
50-
host = transport.host || raise "Missing host in transport #{transport}"
51-
TCPSocket.new(host, transport.port)
99+
hostname = transport.host || raise "Missing host in transport #{transport}"
100+
TCPSocket.new(hostname, transport.port)
52101
when "unix"
53102
UNIXSocket.new(transport.path)
54103
else
@@ -57,8 +106,25 @@ class MySql::Connection < DB::Connection
57106

58107
handshake = read_packet(Protocol::HandshakeV10)
59108

60-
write_packet(1) do |packet|
61-
Protocol::HandshakeResponse41.new(mysql_options.username, mysql_options.password, mysql_options.initial_catalog, handshake.auth_plugin_data, charset_id).write(packet)
109+
handshake_response = Protocol::HandshakeResponse41.new(mysql_options.username, mysql_options.password, mysql_options.initial_catalog, handshake.auth_plugin_data, charset_id)
110+
seq = 1
111+
112+
if mysql_options.ssl_options.mode != SSLMode::Disabled &&
113+
# socket connection will not use ssl for preferred
114+
!(transport.scheme == "unix" && mysql_options.ssl_options.mode == SSLMode::Preferred)
115+
write_packet(seq) do |packet|
116+
handshake_response.write_ssl_request(packet)
117+
end
118+
seq += 1
119+
ctx = mysql_options.ssl_options.build_context
120+
@socket = OpenSSL::SSL::Socket::Client.new(@socket, context: ctx, sync_close: true, hostname: hostname)
121+
# NOTE: If ssl_options.mode is Preferred we should fallback to non-ssl socket if the ssl setup failed
122+
# if we do so, we should warn at least. Making Preferred behave as Required is a safer option
123+
# so the user would need to explicitly choose Disabled to avoid the ssl setup.
124+
end
125+
126+
write_packet(seq) do |packet|
127+
handshake_response.write(packet)
62128
end
63129

64130
read_ok_or_err do |packet, status|

0 commit comments

Comments
 (0)