Fix and extend MySQL TLS modes for all sync paths - #132
Merged
Conversation
Add disabled, preferred, and required connection modes with optional CA and client certificate flags, integration tests, and end-user documentation.
Ad-hoc snapshot signalling now uses the same TLS settings as sync, so encrypted connections work when adding tables to a running follower.
Preferred mode now retries without encryption only when the server cannot use TLS or the handshake fails, not on wrong passwords or other connection errors.
Cover client certificate authentication and MariaDB required/preferred TLS connections using the existing Docker TLS harness.
Replace the misnamed bad-CA test with a real MySQL instance that has TLS disabled, confirming required mode errors instead of connecting.
Explain when encryption does not verify the server, how preferred fallback works, and hostname/CA guidance for managed MySQL.
The trigger source crate already depends on binlog-protocol for production code; drop the redundant dev-dependencies line.
Document preferred fallback, CA verification, hostname guidance, and that snapshot uses the same flags; point MariaDB readers to both guides.
Note in CLI help and user docs that CA and client certificate paths apply only when TLS is enabled.
Restore zlib-backed protocol compression for mysql_async while keeping TLS enabled.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Derive invalid credentials from the container password so auth-failure TLS tests stay realistic without triggering security scanning alerts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Binlog source already had
--tls-modeoptions, butpreferredandrequiredoften failed with typical self-signed MySQL setups, and trigger sync plus snapshots had no TLS settings.This makes the three modes behave as users expect (including falling back to plain when
preferredcan’t encrypt), applies the same flags across MySQL/MariaDB trigger sync, binlog sync, and snapshots.Intends to cover
--tls-modeissues mentioned in #121