[CONC-417] Windows clients using Schannel often encounter error SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 3.0.8, 3.1.0, 3.1.5
Fix Version/s: 3.1.6
Component/s: None
Labels:
None

Description

Windows clients that use Schannel often encounter the following error:

SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid

MariaDB Connector/C doesn't actually print the error message text, so users actually see this less understandable error message:

Unknown SSL error (0x80090308)

As part of this fix, maybe SEC_E_INVALID_TOKEN should be added to the switch statement with a more reasonable error message in ma_schannel_set_sec_error , so that users have a easier time understanding what this means.

https://github.com/MariaDB/mariadb-connector-c/blob/v3.1.0/libmariadb/secure/ma_schannel.c#L32

~~CONC-418~~ is also relevant to improving this error message.

In ~~MDEV-13492~~, it was speculated that the cause may be that when the server is using yaSSL, the server may not be able to perform the DH handshake properly. I don't think this is the cause, because some users are seeing this issue while not using yaSSL in the server, and while also not using ciphers that use the DH algorithm.

In ~~CONC-391~~, it was speculated that the cause may be that the client may need to be upgraded to a newer Windows version. I don't think this is the cause, because some users are seeing this issue while using an up-to-date Windows 10.

It seems that we still need to determine the root cause.

Attachments

Issue Links

relates to

CONC-418 Use FormatMessage to get error string for unknown Schannel error codes

Closed

CONC-432 Use GnuTLS for Windows builds instead of Schannel

Closed

CONC-391 Unknown SSL error - MariaDB

Closed

MDEV-13492 main.ssl_connect failed with 2026: Unknown SSL error (0x80090308)

Closed

MDEV-13726 main.ssl_timeout, main.ssl_7937 failed (sporadically) in buildbot, unknown SSL error (0x80090308)

Closed

Activity

Ascending order - Click to sort in descending order

Geoff Montee (Inactive) created issue - 2019-06-04 19:01

Geoff Montee (Inactive) made changes - 2019-06-04 19:01

Field	Original Value	New Value
Link		This issue relates to ~~CONC-391~~ [ ~~CONC-391~~ ]

Geoff Montee (Inactive) made changes - 2019-06-04 19:01

Link

This issue relates to ~~MDEV-13492~~ [ ~~MDEV-13492~~ ]

Geoff Montee (Inactive) made changes - 2019-06-04 19:01

Link

This issue relates to ~~MDEV-13726~~ [ ~~MDEV-13726~~ ]

Geoff Montee (Inactive) made changes - 2019-06-04 19:15

Description

Windows clients that use Schannel often encounter the following error:

{noformat}
SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
{noformat}

MariaDB Connector/C doesn't actually print the error message text, so users actually see this less understandable error message:

{noformat}
Unknown SSL error (0x80090308)
{noformat}

In ~~MDEV-13492~~, it was speculated that the cause may be that when the server is using yaSSL, the server may not be able to perform the DH handshake properly. I don't think this is the cause, because some users are seeing this issue while *not* using yaSSL in the server, and while also *not* using ciphers that use the DH algorithm.

In ~~CONC-391~~, it was speculated that the cause may be that the client may need to be upgraded to a newer Windows version. I don't think this is the cause, because some users are seeing this issue while using an up-to-date Windows 10.

It seems that we still need to determine the root cause.

Windows clients that use Schannel often encounter the following error:

{noformat}
SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
{noformat}

MariaDB Connector/C doesn't actually print the error message text, so users actually see this less understandable error message:

{noformat}
Unknown SSL error (0x80090308)
{noformat}

As part of this fix, maybe SEC_E_INVALID_TOKEN should be added to the switch statement with a more reasonable error message in ma_schannel_set_sec_error , so that users have a easier time understanding what this means.

https://github.com/MariaDB/mariadb-connector-c/blob/v3.1.0/libmariadb/secure/ma_schannel.c#L32

In ~~MDEV-13492~~, it was speculated that the cause may be that when the server is using yaSSL, the server may not be able to perform the DH handshake properly. I don't think this is the cause, because some users are seeing this issue while *not* using yaSSL in the server, and while also *not* using ciphers that use the DH algorithm.

In ~~CONC-391~~, it was speculated that the cause may be that the client may need to be upgraded to a newer Windows version. I don't think this is the cause, because some users are seeing this issue while using an up-to-date Windows 10.

It seems that we still need to determine the root cause.

Geoff Montee (Inactive) made changes - 2019-06-04 19:30

Link

This issue relates to ~~CONC-418~~ [ ~~CONC-418~~ ]

Geoff Montee (Inactive) made changes - 2019-06-04 19:33

Description

Windows clients that use Schannel often encounter the following error:

{noformat}
SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
{noformat}

MariaDB Connector/C doesn't actually print the error message text, so users actually see this less understandable error message:

{noformat}
Unknown SSL error (0x80090308)
{noformat}

As part of this fix, maybe SEC_E_INVALID_TOKEN should be added to the switch statement with a more reasonable error message in ma_schannel_set_sec_error , so that users have a easier time understanding what this means.

https://github.com/MariaDB/mariadb-connector-c/blob/v3.1.0/libmariadb/secure/ma_schannel.c#L32

In ~~MDEV-13492~~, it was speculated that the cause may be that when the server is using yaSSL, the server may not be able to perform the DH handshake properly. I don't think this is the cause, because some users are seeing this issue while *not* using yaSSL in the server, and while also *not* using ciphers that use the DH algorithm.

In ~~CONC-391~~, it was speculated that the cause may be that the client may need to be upgraded to a newer Windows version. I don't think this is the cause, because some users are seeing this issue while using an up-to-date Windows 10.

It seems that we still need to determine the root cause.

Windows clients that use Schannel often encounter the following error:

{noformat}
SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
{noformat}

MariaDB Connector/C doesn't actually print the error message text, so users actually see this less understandable error message:

{noformat}
Unknown SSL error (0x80090308)
{noformat}

As part of this fix, maybe SEC_E_INVALID_TOKEN should be added to the switch statement with a more reasonable error message in ma_schannel_set_sec_error , so that users have a easier time understanding what this means.

https://github.com/MariaDB/mariadb-connector-c/blob/v3.1.0/libmariadb/secure/ma_schannel.c#L32

~~CONC-418~~ is also relevant to improving this error message.

In ~~MDEV-13492~~, it was speculated that the cause may be that when the server is using yaSSL, the server may not be able to perform the DH handshake properly. I don't think this is the cause, because some users are seeing this issue while *not* using yaSSL in the server, and while also *not* using ciphers that use the DH algorithm.

In ~~CONC-391~~, it was speculated that the cause may be that the client may need to be upgraded to a newer Windows version. I don't think this is the cause, because some users are seeing this issue while using an up-to-date Windows 10.

It seems that we still need to determine the root cause.

Geoff Montee (Inactive) made changes - 2019-07-16 17:41

Priority

Major [ 3 ]

Critical [ 2 ]

Geoff Montee (Inactive) made changes - 2019-08-05 18:45

Link

This issue relates to ~~CONC-432~~ [ ~~CONC-432~~ ]

Richard Stracke made changes - 2019-08-29 14:24

Link

This issue relates to TODO-1973 [ TODO-1973 ]

Geoff Montee (Inactive) made changes - 2019-11-15 18:33

Affects Version/s

3.1.5 [ 24016 ]

Geoff Montee (Inactive) made changes - 2019-12-03 17:34

Fix Version/s		3.1.6 [ 24033 ]
Fix Version/s	3.1 [ 23223 ]
Assignee	Georg Richter [ georg ]	Vladislav Vaintroub [ wlad ]
Resolution		Fixed [ 1 ]
Status	Open [ 1 ]	Closed [ 6 ]

Julien Fritsch made changes - 2022-01-11 15:33

Workflow

MariaDB connectors [ 97335 ]

MariaDB v4 [ 161171 ]

People

Assignee:: Vladislav Vaintroub

Reporter:: Geoff Montee (Inactive)

Votes:: 1 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2019-06-04 19:01

Updated:: 2020-08-25 16:24

Resolved:: 2019-12-03 17:34

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.