MySQL Bugs: #93255: Workbench Incorrectly Shows IP Whitelist..

Bug #93255	Workbench Incorrectly Shows IP Whitelist..
Submitted:	20 Nov 2018 8:46	Modified:	20 Nov 2018 18:42
Reporter:	Guy Thomas	Email Updates:
Status:	Not a Bug	Impact on me:	None
Category:	MySQL Workbench	Severity:	S5 (Performance)
Version:	8.0	OS:	Windows
Assigned to:	MySQL Verification Team	CPU Architecture:	Any
Tags:	whitelist replication group

Description:
I am attempting to connect to my database using a Google App Script. 
In order to connect to a MSQL DB using Java I use the JDBC connectivity libraries which (according to Google: https://developers.google.com/apps-script/guides/jdbc), require a range of IP addresses to be whitelisted on the server.

I have searched the MYSQL documentation and the only place that I find to do this is under GROUP REPLICATION. The text field is a single line text box whose tooltip states use '\n' character to delimit each IP/ range entry.

This done, 'my.ini' shows the following content :
[mysqld]

group_replication_ip_whitelist = 64.18.0.0 - 64.18.15.255
group_replication_ip_whitelist = 64.233.160.0 - 64.233.191.255
group_replication_ip_whitelist = 66.102.0.0 - 66.102.15.255
group_replication_ip_whitelist = 66.249.80.0 - 66.249.95.255
group_replication_ip_whitelist = 72.14.192.0 - 72.14.255.255
group_replication_ip_whitelist = 74.125.0.0 - 74.125.255.255
group_replication_ip_whitelist = 173.194.0.0 - 173.194.255.255
group_replication_ip_whitelist = 207.126.144.0 - 207.126.159.255
group_replication_ip_whitelist = 209.85.128.0 - 209.85.255.255
group_replication_ip_whitelist = 216.239.32.0 - 216.239.63.255

However, when I open Workbench once again... only the very last entry displayts in the text field....? 

I can successfully connect to the database using Telnet / and I have also connected to same DB using a Google application running in the Chrome web browser.

Despite this , I am still unable to connect to the MYSQL database using JDBC 
 in my App Script , and I am trying to understand exactly why this is the case - I am suspecting the IP range that doesnt correctly display in Workbench to be the problem. If only one IP range is being whitelisted, clearly this is likely to be the issue.

I would expect to see the whole range displayed in the 'whitelist' field under GROUP-REPLICATION, instead of a single entry. 
Please confirm.

How to repeat:
Configure my.ini as follows : 

[mysqld]

group_replication_ip_whitelist = 64.18.0.0 - 64.18.15.255
group_replication_ip_whitelist = 64.233.160.0 - 64.233.191.255
group_replication_ip_whitelist = 66.102.0.0 - 66.102.15.255
group_replication_ip_whitelist = 66.249.80.0 - 66.249.95.255
group_replication_ip_whitelist = 72.14.192.0 - 72.14.255.255
group_replication_ip_whitelist = 74.125.0.0 - 74.125.255.255
group_replication_ip_whitelist = 173.194.0.0 - 173.194.255.255
group_replication_ip_whitelist = 207.126.144.0 - 207.126.159.255
group_replication_ip_whitelist = 209.85.128.0 - 209.85.255.255
group_replication_ip_whitelist = 216.239.32.0 - 216.239.63.255

Then load the Workbench and inspect the GROUP_REPLICATION field... only one entry (216.239.32.0 - 216.239.63.255) will display in the field....

Suggested fix:
Ideally, requires a listbox control for each range given....

Hi,

This really is not a MySQL BUG nor even a feature.

What google document talks about is that your java app will be connecting to your database from a list of IP addresses they shown. The "whitelisting" here means that:

1. your database server need to allow connection from these ip addresses (so on the OS level you need to configure your firewall, fail2ban, snort or any other network firewall/monitoring/security tool you need to whitelist these ip addresses and allow connection from those ip adresses to connect to mysql port)

2. on your mysql server you need to create a user that is allowed to connect from all these ip addresses. (easy, but unsafe, is to create 'user'@'%', proper way is to create for each network 'user'@'ipnetwork/netmask')

This document has nothing to do with MySQL Group Replication nor the group replication whitelist you "found" is in any way related to this document.

For additional help please contact MySQL Support team, or use https://forums.mysql.com

kind regards
Bogdan

Bogdan
Thanks for your input - it seems I was way off looking at the replication field!
It makes perfect sense now having to open up my servers firewall to the required IP ranges - which I have now done.
However, it still doesnt work!... I have even assigned 0.0.0.0 as an IP address - the script still fails at the same line - the connection string every signle time......

Jdbc.getConnection('jdbc:mysql://<IP>:3306/exponential_db', 'testing', 'over');

I know that this isnt a MySQL bug, but do you happen to have any other suggestions I could try..?
As I have stated, I can get the connection by other means without any problem at all (Telnet/app. running in Chrome browser), but I need the script option to work for my project ..

Any ideas gratefully received.
Thank you.
G

Bogdan
Thanks for your input - it seems I was way off looking at the replication field!
It makes perfect sense now having to open up my servers firewall to the required IP ranges - which I have now done.
However, it still doesnt work!... I have even assigned 0.0.0.0 as an IP address - the script still fails at the same line - the connection string every signle time......

Jdbc.getConnection('jdbc:mysql://<IP>:3306/exponential_db', 'testing', 'over');

NOTE : The username I have used here 'testing' is:  User 'testing@%' on MySQL

I know that this isnt a MySQL bug, but do you happen to have any other suggestions I could try..?
As I have stated, I can get the connection by other means without any problem at all (Telnet/app. running in Chrome browser), but I need the script option to work for my project ..

Any ideas gratefully received.
Thank you.
G