Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve client_spec.rb SSL test #3

Open
junaruga opened this issue Apr 18, 2021 · 0 comments
Open

Improve client_spec.rb SSL test #3

junaruga opened this issue Apr 18, 2021 · 0 comments

Comments

@junaruga
Copy link
Owner

junaruga commented Apr 18, 2021

I find we need some improvements in the client_spec.rb.

spec/mysql2/client_spec.rb

  it "should be able to connect via SSL options" do
    ssl = @client.query "SHOW VARIABLES LIKE 'have_ssl'"
    ssl_uncompiled = ssl.any? { |x| x['Value'] == 'OFF' }
    pending("DON'T WORRY, THIS TEST PASSES - but SSL is not compiled into your MySQL daemon.") if ssl_uncompiled
    ssl_disabled = ssl.any? { |x| x['Value'] == 'DISABLED' }
    pending("DON'T WORRY, THIS TEST PASSES - but SSL is not enabled in your MySQL daemon.") if ssl_disabled

    # You may need to adjust the lines below to match your SSL certificate paths
    ssl_client = nil
    option_overrides = {
      'host'     => 'mysql2gem.example.com', # must match the certificates
      :sslkey    => '/etc/mysql/client-key.pem',
      :sslcert   => '/etc/mysql/client-cert.pem',
      :sslca     => '/etc/mysql/ca-cert.pem',
      :sslcipher => 'DHE-RSA-AES256-SHA',
      :sslverify => true,
    }    
    %i[sslkey sslcert sslca].each do |item|
      unless File.exist?(option_overrides[item])
        pending("DON'T WORRY, THIS TEST PASSES - but #{option_overrides[item]} does not exist.")
        break
      end  
    end  
    ...
  end

Add a test for client ssl_mode option

client ssl_mode option is not tested right now. Add the test case. See a branch's commit on my forked repository. https://github.com/junaruga/mysql2/commits/wip/v-can-not-enable-ssl-with-mariadb-client-lib

Cover the test cases where the database server is running on a remote server or in the container on local.

The file check for SSL related files in the database server does not cover the case of the database server is on remote server, or is executed in the container on the local.

Do the file check only if DatabaseCredentials['root']['database'] == 'localhost'.

The directory for pem files: '/etc/mysql/client-key.pem, the /etc/mysql is not convenient. it's hard to put the directory in my case using a MariaDB container. I also do not want to put it to the root permission's directory.

A solution is to give such as environment variable RUBY_MYSQL2_SERVER_SSL_DIR, (default: /etc/mysql).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant