Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-20170

main.tls_version and main.tls_version1 fail in buildbot on RHEL8

Details

    Description

      http://buildbot.askmonty.org/buildbot/builders/kvm-rpm-rhel8-amd64/builds/814

      10.4 11f3e2366282eb8cf1cb0062793d1020

      		 
      main.tls_version1                        w4 [ fail ]
      		 
              Test ended at 2019-07-24 18:01:27
      		 
       
      		 
      CURRENT_TEST: main.tls_version1
      		 
      ERROR 2026 (HY000): Unknown SSL error
      		 
      mysqltest: At line 5: exec of '/usr/bin/mysql --defaults-file=/dev/shm/var/4/my.cnf --host=localhost --ssl -e "show status like 'ssl_version';"' failed, error: 256, status: 1, errno: 11
      		 
      Output from before failure:
      		 
       
      		 
       - saving '/dev/shm/var/4/log/main.tls_version1/' to '/dev/shm/var/log/main.tls_version1/'

      Attachments

        1. MDEV-20170.patch
          1 kB
          Georg Richter
        2. openssl_minprot.c
          1 kB
          Georg Richter

        Issue Links

          relates to

          Task - A task that needs to be done. MDEV-19475 Add support for OpenSSL configuration files

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            sanja Oleksandr Byelkin added a comment -

            georg, check is you can say something about it, if no reassign it to me please

            sanja Oleksandr Byelkin added a comment - georg , check is you can say something about it, if no reassign it to me please
            georg Georg Richter added a comment - - edited

            TLSv1.0 and TLSv1.1 are deprecated in RHEL 8, unless crypto policy will be changed to legacy.

            # update-crypto-policies --set LEGACY

            It also looks like they were removed from core crypto libraries, otherwise the error would be "tlsv1 alert protocol version"

            See also: Security considerations in adopting RHEL8

            georg Georg Richter added a comment - - edited TLSv1.0 and TLSv1.1 are deprecated in RHEL 8, unless crypto policy will be changed to legacy. # update-crypto-policies --set LEGACY It also looks like they were removed from core crypto libraries, otherwise the error would be "tlsv1 alert protocol version" See also: Security considerations in adopting RHEL8
            georg Georg Richter added a comment -

            Patch attached

            georg Georg Richter added a comment - Patch attached
            serg Sergei Golubchik added a comment -

            it's not LEGACY vs DEFAULT, it's

            sh-4.4$ grep MinP /etc/crypto-policies/back-ends/opensslcnf.config 
            MinProtocol = TLSv1.2

            A proper detection of supported protocols could be done like this:

            #!/bin/bash
            		 
             
            		 
            openssl s_server -debug -cert std_data/server-cert.pem -key std_data/server-key.pem </dev/zero >/dev/null 2>&1 &
            		 
            SERVER_PID=$!
            		 
             
            		 
            for v in tls1 tls1_1 tls1_2 tls1_3; do
            		 
              if openssl s_client -$v </dev/null >/dev/null 2>&1; then
            		 
                echo $v is supported
            		 
              else
            		 
                echo $v is disabled
            		 
              fi
            		 
            done
            		 
            kill $SERVER_PID

            But this exact scrips works unreliably, it needs more work.
            Also it might be a tad too heavy to do it on every mtr run independently whether it'll run ssl tests or not.

            serg Sergei Golubchik added a comment - it's not LEGACY vs DEFAULT, it's sh-4.4$ grep MinP /etc/crypto-policies/back-ends/opensslcnf.config MinProtocol = TLSv1.2 A proper detection of supported protocols could be done like this: #!/bin/bash   openssl s_server -debug -cert std_data /server-cert .pem -key std_data /server-key .pem < /dev/zero > /dev/null 2>&1 & SERVER_PID=$!   for v in tls1 tls1_1 tls1_2 tls1_3; do if openssl s_client -$ v < /dev/null > /dev/null 2>&1; then echo $ v is supported else echo $ v is disabled fi done kill $SERVER_PID But this exact scrips works unreliably, it needs more work. Also it might be a tad too heavy to do it on every mtr run independently whether it'll run ssl tests or not.
            serg Sergei Golubchik added a comment -

            stracing openssl s_server on RHEL8 shows that it reads /etc/pki/tls/openssl.cnf and /etc/crypto-policies/back-ends/opensslcnf.config

            serg Sergei Golubchik added a comment - stracing openssl s_server on RHEL8 shows that it reads /etc/pki/tls/openssl.cnf and /etc/crypto-policies/back-ends/opensslcnf.config
            georg Georg Richter added a comment -

            Serg, how about checking the minimum supported version by a small c program which scans the configuration file(s)?! I attached a small example demo for it.

            georg Georg Richter added a comment - Serg, how about checking the minimum supported version by a small c program which scans the configuration file(s)?! I attached a small example demo for it.

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.