Merge pull request #1206 from brianmario/dbussink/handle-default-ca-paths

Setup default CA path if not provided

Author: sodabrew

.rubocop_todo.yml

@@ -17,7 +17,7 @@ Layout/IndentHeredoc:
 
 # Offense count: 2
 Metrics/AbcSize:
-  Max: 90
+  Max: 91
 
 # Offense count: 31
 # Configuration parameters: CountComments, ExcludedMethods.
@@ -32,11 +32,11 @@ Metrics/BlockNesting:
 # Offense count: 1
 # Configuration parameters: CountComments.
 Metrics/ClassLength:
-  Max: 125
+  Max: 135
 
 # Offense count: 3
 Metrics/CyclomaticComplexity:
-  Max: 30
+  Max: 32
 
 # Offense count: 313
 # Configuration parameters: AllowHeredoc, AllowURI, URISchemes, IgnoreCopDirectives, IgnoredPatterns.
@@ -51,7 +51,7 @@ Metrics/MethodLength:
 
 # Offense count: 2
 Metrics/PerceivedComplexity:
-  Max: 27
+  Max: 29
 
 # Offense count: 3
 # Configuration parameters: Blacklist.

lib/mysql2/client.rb

@@ -46,9 +46,14 @@ def initialize(opts = {})
       # force the encoding to utf8
       self.charset_name = opts[:encoding] || 'utf8'
 
+      mode = parse_ssl_mode(opts[:ssl_mode]) if opts[:ssl_mode]
+      if (mode == SSL_MODE_VERIFY_CA || mode == SSL_MODE_VERIFY_IDENTITY) && !opts[:sslca]
+        opts[:sslca] = find_default_ca_path
+      end
+
       ssl_options = opts.values_at(:sslkey, :sslcert, :sslca, :sslcapath, :sslcipher)
       ssl_set(*ssl_options) if ssl_options.any? || opts.key?(:sslverify)
-      self.ssl_mode = parse_ssl_mode(opts[:ssl_mode]) if opts[:ssl_mode]
+      self.ssl_mode = mode if mode
 
       flags = case opts[:flags]
       when Array
@@ -115,6 +120,18 @@ def parse_flags_array(flags, initial = 0)
       end
     end
 
+    # Find any default system CA paths to handle system roots
+    # by default if stricter validation is requested and no
+    # path is provide.
+    def find_default_ca_path
+      [
+        "/etc/ssl/certs/ca-certificates.crt",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        "/etc/ssl/ca-bundle.pem",
+        "/etc/ssl/cert.pem",
+      ].find { |f| File.exist?(f) }
+    end
+
     # Set default program_name in performance_schema.session_connect_attrs
     # and performance_schema.session_account_connect_attrs
     def parse_connect_attrs(conn_attrs)