Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23772

Automate SSL connection tests for MariaDB

    XMLWordPrintable

Details

    Description

      There are various bugs open about TLS connection issues in Debian and Ubuntu:

      https://bugs.launchpad.net/ubuntu/+source/mariadb-10.3/+bug/1885632

      • MariaDB 10.3 as provided by Ubuntu.org is compiled against YaSSL version 2.4.4, which supports a maximum TLS version of 1.1. The Ubuntu 20.04 release has a minimum TLS 1.2 requirement, rendering all MariaDB TLS connections unusable.

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921151

      • appears that the Debian client is only attempting to negotiate a connection with TLSv1.1, which is blacklisted

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927289

      • Apparently YaSSL (now WolfSSL) did not support any other certificate format than PEM, and the error message is uninformative

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956401

      • Option --ssl-verify-server-cert did not work. Possibly because of MDEV-12190: YaSSL's highest supported version is TLSv1.1 (=3.2) - if the client requests a higher version, it needs to be downgraded in Server Hello packet to TLSv1.1 instead of interrupting the handshake and closing the connection.

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956810

      • libmariadb3 compiled libdbd-mysql failed to connect to MySQL server that required TLS

      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875457

      • clients could not connect using ssl (the error message was: ERROR 2026 (HY000): SSL connection error: protocol version mismatch)

      The biggest problem right now is that we don't know the status of these issues.

      We should extend the debian/salsa-ci.yml to do a simple TLS scenario and test the connection so we know if it even works in the most basic case.

      Attachments

        Issue Links

          Activity

            People

              otto Otto Kekäläinen
              otto Otto Kekäläinen
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.