fix(plugin-mongodb): Atlas connect crash, TLS -9838, Unauthorized on import#1251
Merged
Conversation
…log listDatabases failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three independent MongoDB Atlas connect bugs surfaced after upgrading to macOS 26. Each was hit by a real user (#1249 crash report, follow-up TLS error, follow-up Unauthorized on URL import).
MongoDBConnection.serverVersion()didqueue.syncon a queue it was already running on whenever the cache was cold and the call came from inside anon-queueblock (e.g.listDatabasesSync). Triggereddispatch_sync called on queue already owned by current threadBREAKPOINT on every fresh connect. Fixed by detecting on-queue re-entry via a per-instanceDispatchSpecificKeyand callingfetchServerVersionSync()directly when already on the queue.errSSLPeerInternalError (-9838)against Atlas. Root cause: libmongoc was built with Apple Secure Transport (MONGOC_ENABLE_SSL_SECURE_TRANSPORT=1), which now misnegotiates TLS 1.3 with Atlas on macOS 26. OpenSSL handshake works against the same endpoints (verified withopenssl s_client). Rebuilt libmongoc 1.28.1 with OpenSSL 3.4.3 backend; the app already bundles OpenSSL dylibs for Redis/MSSQL/MySQL so the link surface is unchanged.MongoDBPluginDriver.connect()calledlistDatabasesonadminfor any connection without an explicit DB; Atlas users restricted to a single database lacklistDatabasesprivilege and the call threw, killing the connection. Two-part fix: passauthorizedDatabases: true(MongoDB 4.0+) so the server filters to databases the user can actually see, and don't kill the connection whenlistDatabasesstill fails (auth was verified by the ping duringconnect()itself).Out-of-band release work already done
Libs/libmongoc{,_arm64,_x86_64,_universal}.aandLibs/libbson*.arebuilt with OpenSSL backend.tablepro-libs-v1.tar.gzre-uploaded to thelibs-v1GitHub release so CI and fresh clones pick up the new statics.Libs/checksums.sha256in this PR matches the uploaded archive.Plugins/MongoDBDriverPlugin/CLibMongoc/include/mongoc/mongoc-config.hregenerated to flipMONGOC_ENABLE_SSL_*defines.-framework Security/CoreFoundation, added-lssl.3 -lcrypto.3, extendedLIBRARY_SEARCH_PATHS/LD_RUNPATH_SEARCH_PATHSto includeLibs/dylibs.Follow-up (not in this PR)
MongoDB is a registry-only plugin. After merge, re-tag
plugin-mongodb-v<next>so CI publishes a ZIP, then bumpplugins.jsonin TableProApp/plugins (version,downloadURL,sha256for both architectures).Test plan
s_clienthandshake againstac-h69imyr-shard-00-00.7uzbwhl.mongodb.net:27017succeeds (control for layer where -9838 originates).nm Libs/libmongoc_arm64.ashows OpenSSL symbols (SSL_CTX_new) and zero Secure Transport references (SSLHandshake,SSLCreateContext).otool -L MongoDBDrivershows@rpath/libssl.3.dyliband@rpath/libcrypto.3.dylib, no Security framework./dbpath; previously returned Unauthorized, should now succeed.listDatabasesshould still return the full list.