MySqlConnector: MacOS Big Sur: Interop+AppleCrypto+SslException

Hi,

Since the launch of OSX Big Sur we are getting the following error while trying to connect to a Google Cloud SQL MySQL Database (MySQL 5.7).

When connecting to a Database running on Azure DB for MySQL (MySQL 8) we don’t see this problem. In both cases we are using the latest stable release of Pomelo EF Core for MySQL that supports .NET 3.1

I have also tested this with the latest version of MySQL Connector and was able to reproduce this issue. I do have a simple project that can reproduce this issue, but since this issue only occurs on Google Cloud SQL I can’t share the connection string here.

 ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.
 ---> Interop+AppleCrypto+SslException: Internal error
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslStream.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__64_2(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at MySqlConnector.Core.ServerSession.InitSslAsync(ProtocolCapabilities serverCapabilities, ConnectionSettings cs, SslProtocols sslProtocols, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ServerSession.cs:line 1268
   at MySqlConnector.Core.ServerSession.InitSslAsync(ProtocolCapabilities serverCapabilities, ConnectionSettings cs, SslProtocols sslProtocols, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ServerSession.cs:line 1295
   at MySqlConnector.Core.ServerSession.ConnectAsync(ConnectionSettings cs, ILoadBalancer loadBalancer, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ServerSession.cs:line 399
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ConnectionPool.cs:line 112
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ConnectionPool.cs:line 141
   at MySql.Data.MySqlClient.MySqlConnection.CreateSessionAsync(ConnectionPool pool, Nullable`1 ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlConnection.cs:line 645
   at MySql.Data.MySqlClient.MySqlConnection.OpenAsync(Nullable`1 ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlConnection.cs:line 312

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 15 (7 by maintainers)

Most upvoted comments

@kocburak Here’s some sample code you can run on your Mac. If this fails, it really seems like it’s a Big Sur + .NET Core problem:

// connect to server
using var tcpClient = new TcpClient();
tcpClient.Connect("YOUR GOOGLE SQL PUBLIC IP ADDRESS", 3306);
using var stream = tcpClient.GetStream();

// read initial handshake (sent from server)
var initialHandshake = new byte[200];
stream.Read(initialHandshake, 0, initialHandshake.Length);

// send SSL request
var sslRequest = new byte[36];
sslRequest[0] = 0x20; // length
sslRequest[3] = 0x01; // sequence number
sslRequest[4] = 0x05; // CLIENT_LONG_PASSWORD | CLIENT_LONG_FLAG
sslRequest[5] = 0xAA; // CLIENT_PROTOCOL_41 | CLIENT_SSL | CLIENT_TRANSACTIONS | CLIENT_SECURE_CONNECTION
sslRequest[6] = 0x28; // CLIENT_PLUGIN_AUTH | CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA
sslRequest[10] = 0x80; // max packet size
sslRequest[12] = 33; // utf8
stream.Write(sslRequest, 0, sslRequest.Length);

// negotiate SSL
RemoteCertificateValidationCallback validate = (sender, cert, chain, errors) => true;
using var sslStream = new SslStream(stream, false, validate);
sslStream.AuthenticateAsClient("");

// display results
Console.WriteLine(sslStream.SslProtocol);
Console.WriteLine(sslStream.NegotiatedCipherSuite);

With .NET 5 on Windows, this displays:

Tls12
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

bgrainger on Dec 14, 2020

We ended up in regenerating the SSL certificates for the GCP databases. Somehow the certificate was not fully trusted by Big Sur and dotnet could not connect to it (but applications like MySQL Workbench/Sequel Ace were).

With the new certificates the issue is solved and it is now working fine!

Thanks for the suggestions! 😃 I think we can close this issue

luzannew on Dec 6, 2020