Implement mysql_clear_password

[ldanilek]

Fixes #2443 by implementing AuthPlugin::MySqlClearPassword as described in mysql docs and sufficient to connect to a MySQL server hosted by AWS using IAM authentication with ephemeral passwords.

For consistency with other clients, like mysql, and to avoid accidental security issues, we also add a flag to ConnectionOpts to enable this plugin, as described here.

[nipunn1313]

nice!!

[nipunn1313]

looks good!
If one of the maintainers could take a look and decide whether to merge, that would be great.

[abonander]

@ldanilek cargo fmt needs to be run.

[ldanilek]

@abonander i ran cargo fmt. can you take another look 🙏

[abonander]

I've been putting off merging this because honestly the idea is rather horrifying to me.

With this plugin enabled, and without additional defensive configuration like ssl-mode=VERIFY_IDENTITY (which isn't even suggested in the AWS tutorial), it would be quite straightforward for an attacker, e.g. by a compromised router, to trick the application into divulging its credentials.

The documentation on the configuration option should at the very least recommend a stronger .ssl_mode() setting than the default, either Required or VerifyCa in the case of connecting to AWS where a root certificate is provided.

[ldanilek]

The documentation on the configuration option should at the very least recommend a stronger .ssl_mode() setting than the default, either Required or VerifyCa in the case of connecting to AWS where a root certificate is provided.

i could add an assertion on ssl-mode when enable_cleartext_plugin is true, if that would reduce the security risk. maybe in DoHandshake::new we could throw an error if enable_cleartext_plugin && ssl_mode < REQUIRED? does that sound like a good place to put such an assertion, and what kind of error would we throw?

[abonander]

We shouldn't have a panic that you can't work around without enabling TLS as that could get really annoying.

I would accept maybe logging a warning, but making the implications clearer in the documentation is the main point.

[ldanilek]

@abonander could you take another look please 🙏 . i've updated the comments to be scarier, and added a warning log when connecting in an insecure manner.