Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23772

Automate SSL connection tests for MariaDB

    XMLWordPrintable

    Details

      Description

      There are various bugs open about TLS connection issues in Debian and Ubuntu:

      https://bugs.launchpad.net/ubuntu/+source/mariadb-10.3/+bug/1885632

      • MariaDB 10.3 as provided by Ubuntu.org is compiled against YaSSL version 2.4.4, which supports a maximum TLS version of 1.1. The Ubuntu 20.04 release has a minimum TLS 1.2 requirement, rendering all MariaDB TLS connections unusable.

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921151

      • appears that the Debian client is only attempting to negotiate a connection with TLSv1.1, which is blacklisted

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927289

      • Apparently YaSSL (now WolfSSL) did not support any other certificate format than PEM, and the error message is uninformative

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956401

      • Option --ssl-verify-server-cert did not work. Possibly because of MDEV-12190: YaSSL's highest supported version is TLSv1.1 (=3.2) - if the client requests a higher version, it needs to be downgraded in Server Hello packet to TLSv1.1 instead of interrupting the handshake and closing the connection.

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956810

      • libmariadb3 compiled libdbd-mysql failed to connect to MySQL server that required TLS

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875457

      • clients could not connect using ssl (the error message was: ERROR 2026 (HY000): SSL connection error: protocol version mismatch)

      The biggest problem right now is that we don't know the status of these issues.

      We should extend the debian/salsa-ci.yml to do a simple TLS scenario and test the connection so we know if it even works in the most basic case.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              otto Otto Kekäläinen
              Reporter:
              otto Otto Kekäläinen
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.