[datlechin]

Summary

• Both apps refuse to send a MySQL or MariaDB password the server asks for as typed (mysql_clear_password, or PAM's dialog) on a session without TLS. Connector/C 3.4.4 answers that request whatever MYSQL_ENABLE_CLEARTEXT_PLUGIN says, so a session that may run without TLS sets MARIADB_OPT_RESTRICTED_AUTH to every other method (MySQLPlaintextPassword, TableProMySQLCore). The refusal (errno 5010) comes before anything is sent and reads "The server asked for the password in plain text … Set SSL Mode to Required".
• Preferred asks for TLS outright (the Required options) and falls back to plain text only after an SSL-only error. Connector/C 3.4.4 takes a requested TLS for an established one and answered caching_sha2_password's full authentication with the typed password on a Preferred session to a server without TLS; that is gone with the fallback running with TLS off.
• Exempt, because the way there is encrypted: a Unix socket on the Mac, the Cloud SQL Auth Proxy (so IAM through it keeps working) and an SSH forward to the server's own socket. Only the tunnel a connect opens can claim that: a saved or imported tunnelSecuresTransport field is cleared first.
• Cloud SQL Auth Proxy: a Local Port another program already listens on is refused before the proxy starts, and the proxy counts as ready only once its own process holds the listening socket (proc_pidinfo), so no program that answers on the port first gets the sign-in.
• Docs: docs(databases): a MySQL password asked for in plain text goes only over TLS docs#87 (MySQL page, SSL/TLS section).

Test plan

• Fail on main, pass here: iOS MySQLTLSPolicyTests.plaintextPasswordNeedsTLS (Disabled and Preferred against a server that asks for the password in plain text), preferredKeepsPasswordFromFullSHA2Auth (failed on this branch's first version: the typed password reached the fake server); Mac MariaDBTLSModeTests.plaintextPasswordNeedsTLS, preferredKeepsPasswordFromFullSHA2Auth, securedTunnelSendsPlaintextPassword; CloudSQLIAMAuthTests.savedSecuredTransportClaimIsDropped, socketForwardSecuresTransport; CloudSQLProxyManagerTests.occupiedPortIsRefused, listenerTheProxyDoesNotOwnIsRefused.
• Changed on purpose: preferredFallsBack (both apps) now sees two connections, the TLS attempt ending before the sign-in; MySQLTLSPolicyTests.preferredSendsPlaintextPasswordOverTLS signs in on the first, encrypted attempt.
• Local: iOS MySQLTLSPolicyTests 11 of 11; Mac MariaDBTLSModeTests, CloudSQLIAMAuthTests, CloudSQLProxyManagerTests 38 of 38; TableProMySQLCoreTests 129 of 129; lint, l10n (both catalogs, add-only): pass.
• Probe apple/scripts/probes/check-mariadb-tls-modes.sh against the shipped Connector/C 3.4.4, both apps' headers: 17 of 17, with Disabled (Preferred's fallback) refusing the plain-text request with 5010 and no secret on the wire.
• Measured with that probe: MARIADB_OPT_RESTRICTED_AUTH without mysql_clear_password refuses before the password, on TLS and off it; a native-password sign-in is untouched.
• Codex review and adversarial security review until a round found nothing.