Attachment 172587 Details for Bug 36026 – Bug 36026: Use only configured TLS options for database connection

[patch] Bug 36026: Use only configured TLS options for database connection

Bug-36026-Use-only-configured-TLS-options-for-data.patch (text/plain), 2.35 KB, created by Lukas Koszyk on 2024-10-10 13:41:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lukas Koszyk

Created: 2024-10-10 13:41:28 UTC

Size: 2.35 KB

patch

obsolete

>From 75b1ebbbd8b5e7e090760149d9fb5a72bf4b14b8 Mon Sep 17 00:00:00 2001
>From: Lukas Koszyk <lukasz.koszyk@kit.edu>
>Date: Thu, 10 Oct 2024 13:35:54 +0000
>Subject: [PATCH] Bug 36026: Use only configured TLS options for database
> connection
>
>Database connections with TLS require client private keys
>and certificates for authentication but MariaDB also supports
>authentication by user and password.
>This patch allows omitting the TLS options for certificate based
>client authentication.
>
>To test:
>1) Configure the database to support TLS connections.
>2) Set "<tls>yes</tls>" in the config section in koha-conf.xml.
>3) Run "koha-plack --reload <koha_instance>".
>4) Open Koha's staff interface in the browser.
>5) Observe an internal server error.
>6) Apply patch.
>7) Repeat step 3 and 4.
>8) Observe the error is gone.
>9) Sign off.
>
>Sponsored-by: Karlsruhe Institute of Technology (KIT)
>---
> Koha/Database.pm | 24 ++++++++++++++++++------
> 1 file changed, 18 insertions(+), 6 deletions(-)
>
>diff --git a/Koha/Database.pm b/Koha/Database.pm
>index 8457c18e80..52ace1304d 100644
>--- a/Koha/Database.pm
>+++ b/Koha/Database.pm
>@@ -77,12 +77,24 @@ sub dbh {
>     if ($driver eq 'mysql') {
>         my $tls = $config->get("tls");
>         if ($tls && $tls eq 'yes') {
>-            $dsn .= sprintf(
>-                ';mysql_ssl=1;mysql_ssl_client_key=%s;mysql_ssl_client_cert=%s;mysql_ssl_ca_file=%s',
>-                $config->get('key'),
>-                $config->get('cert'),
>-                $config->get('ca'),
>-            );
>+
>+            $dsn .= ';mysql_ssl=1';
>+
>+            my $mysql_ssl_client_key  = $config->get('key');
>+            my $mysql_ssl_client_cert = $config->get('cert');
>+            my $mysql_ssl_ca_file     = $config->get('ca');
>+
>+            if ( $mysql_ssl_client_key && $mysql_ssl_client_key ne '__DB_TLS_CLIENT_KEY__' ) {
>+                $dsn .= sprintf( ';mysql_ssl_client_key=%s', $mysql_ssl_client_key );
>+            }
>+
>+            if ( $mysql_ssl_client_cert && $mysql_ssl_client_cert ne '__DB_TLS_CLIENT_CERTIFICATE__' ) {
>+                $dsn .= sprintf( ';mysql_ssl_client_cert=%s', $mysql_ssl_client_cert );
>+            }
>+
>+            if ( $mysql_ssl_ca_file && $mysql_ssl_ca_file ne '__DB_TLS_CA_CERTIFICATE__' ) {
>+                $dsn .= sprintf( ';mysql_ssl_ca_file=%s', $mysql_ssl_ca_file );
>+            }
>         }
> 
>         $attr->{mysql_enable_utf8} = 1;
>-- 
>2.39.5

Actions: View | Diff | Splinter Review

Attachments on bug 36026: 172587 | 172822 | 173381 | 173426