From 42ec5d36c2364ee709e7b63c5c19a777031f74c6 Mon Sep 17 00:00:00 2001
From: Lukas Koszyk <lukasz.koszyk@kit.edu>
Date: Mon, 17 Feb 2025 08:39:04 +0000
Subject: [PATCH] Bug 38760: Add support for database connection encryption
 parameters in koha-mysql

The koha-mysql didn't work when the instance was set up to use an encrypted
database connection.

Please note: this testplan is for ktd, not for a production environment!

Unfortunately, there are some issues with the database TLS configuration in koha-testing-docker.
This is described comment 14 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c14)

As a workaround, you can add "mysql_ssl_optional=1" in Koha/Database.pm.
See point (g) in comment 15 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c15)

Testing Database Connection Encryption:
1. Apply the patch.
2. Configure koha-conf.xml to use a TLS connection
(see comment 10 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c10, follow steps 3a-g + 4 )
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the encryption settings in the MySQL console:
- run:
SHOW VARIABLES LIKE '%ssl%';
- run:
STATUS;
Ensure that the following conditions are met:
- have_openssl and have_ssl are set to "YES".
- The SSL cipher in use is displayed.

Testing MySQL Timezone Configuration:
1. Apply the patch.
2. Configure the timezone in koha-conf.xml, for example:
<timezone>Antarctica/South_Pole</timezone>
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the timezone setting in the MySQL console by running:
SELECT @@session.time_zone;
6. Confirm that the output matches the timezone configured in koha-conf.xml.

Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 debian/scripts/koha-mysql | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/debian/scripts/koha-mysql b/debian/scripts/koha-mysql
index 89fa3b69e3..bfbc28476e 100755
--- a/debian/scripts/koha-mysql
+++ b/debian/scripts/koha-mysql
@@ -53,13 +53,31 @@ mysqlhost="$( xmlstarlet sel -t -v 'yazgfs/config/hostname' $kohaconfig )"
 mysqldb="$( xmlstarlet sel -t -v 'yazgfs/config/database' $kohaconfig )"
 mysqluser="$( xmlstarlet sel -t -v 'yazgfs/config/user' $kohaconfig )"
 mysqlpass="$( xmlstarlet sel -t -v 'yazgfs/config/pass' $kohaconfig )"
-
+mysqltls="$( xmlstarlet sel -t -v 'yazgfs/config/tls' $kohaconfig || true )"
+mysqlca="$( xmlstarlet sel -t -v 'yazgfs/config/ca' $kohaconfig || true )"
+mysqlcert="$( xmlstarlet sel -t -v 'yazgfs/config/cert' $kohaconfig || true )"
+mysqlkey="$( xmlstarlet sel -t -v 'yazgfs/config/key' $kohaconfig || true )"
 mysqltz="$( xmlstarlet sel -t -v 'yazgfs/config/timezone' $kohaconfig || true )"
-if [ "$mysqltz" != "" ]
-then
-    mysql --host="$mysqlhost" --user="$mysqluser" --password="$mysqlpass" --init-command="SET time_zone='$mysqltz'" \
-        "$mysqldb"  "${@}"
-else
-    mysql --host="$mysqlhost" --user="$mysqluser" --password="$mysqlpass" \
-        "$mysqldb"  "${@}"
+
+set -- --host="$mysqlhost" "$@"
+set -- --user="$mysqluser" "$@"
+set -- --password="$mysqlpass" "$@"
+
+if [ "$mysqltls" = "yes" ]; then
+    set -- --ssl "$@"
+    if [ -n "$mysqlca" ] && [ "$mysqlca" != "DB_TLS_CA_CERTIFICATE" ]; then
+        set -- --ssl-ca="$mysqlca" "$@"
+    fi
+    if [ -n "$mysqlcert" ] && [ "$mysqlcert" != "__DB_TLS_CLIENT_CERTIFICATE__" ]; then
+        set -- --ssl-cert="$mysqlcert" "$@"
+    fi
+    if [ -n "$mysqlkey" ] && [ "$mysqlkey" != "__DB_TLS_CLIENT_KEY__" ]; then
+        set -- --ssl-key="$mysqlkey" "$@"
+    fi
 fi
+
+if [ "$mysqltz" != "" ]; then
+    set -- --init-command="SET time_zone='$mysqltz'" "$@"
+fi
+
+mysql "$mysqldb" "$@"