Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25785

Add support for OpenSSL 3.0

Details

    Description

      OpenSSL 3.0 is not yet released as GA, but we already experiment with the builds in Fedora (Copr repository available: https://copr.fedorainfracloud.org/coprs/saprasad/openssl-3.0/) or in CentOS Stream 9 (https://kojihub.stream.centos.org/koji/buildinfo?buildID=7571).

      There are some documented changes in OpenSSL 3.0: https://wiki.openssl.org/index.php/OpenSSL_3.0 but there are also some changes that should not be visible. However, since other SW depends on some internals, the changes actually affect the compatibility more than documented.

      MariaDB 10.5.9 (expecting 10.6.x behaves the same) fails to build with this upcoming OpenSSL 3.0.

      The problem is mainly with md5, sha and crypto parts.

      A partial fix is proposed here:
      https://gitlab.com/redhat/centos-stream/rpms/mariadb/-/merge_requests/4
      but some tests (related to encrypting) fail even with this patch, so it is definitely not complete.

      MySQL report is https://bugs.mysql.com/bug.php?id=103818

      Attachments

        Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25949 Add support for OpenSSL 3.0 in Galera

          • Major - Major loss of function.
          • Closed
          causes

          Bug - A problem which impairs or prevents the functions of the product. MCOL-4964 Columnstore doesn't build with OpenSSL 3

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27531 Compilation errors upon building with bundled SSL

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          includes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26015 Remove DH param stuff

          • Major - Major loss of function.
          • In Review

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26302 Unittest failures with OpenSSL-3: aes & mf_iocache

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26771 crash with OpenSSL 3.0.0

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26950 mysqld got signal 6

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27236 mysql_upgrade crashes server process

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27403 Crash in evp_md_ctx_clear_digest/my_md5 while running mysql_install_db on macOS

          • Major - Major loss of function.
          • Closed
          is blocked by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27140 Multiple tests started to fail when OpenSSL-3.0 support patch was backported to the MariaDB Server 10.5 version

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31511 MariaDB 10.4 doesn't support OpenSSL 3

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          is part of

          Task - A task that needs to be done. MDEV-27373 Q1 2022 release merge

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MCOL-4962 Columnstore doesn't build with gcc 12 (on Fedora Rawhide)

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27540 Different OpenSSL versions mix up in build depending on cmake options

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27542 S3 binaries still link with OpenSSL 1.x or with both

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Task - A task that needs to be done. MDEV-29000 Backport OpenSSL-3.0 compatibility to 10.5

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Task - A task that needs to be done. CONC-503 Add support for OpenSSL 3.0

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Task - A task that needs to be done. MDEV-28133 Backport OpenSSL-3.0 compatibility to 10.6 branch

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28339 Crashes with OpenSSL 3.0.2

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            View 15 older comments
            Mingli-Yu Mingli-Yu added a comment - - edited

            Thanks Vladislav very much for your info!

            Mingli-Yu Mingli-Yu added a comment - - edited Thanks Vladislav very much for your info!
            serg Sergei Golubchik added a comment -

            pushed into preview-10.8-MDEV-25785-openssl3.0

            serg Sergei Golubchik added a comment - pushed into preview-10.8- MDEV-25785 -openssl3.0
            elenst Elena Stepanova added a comment - - edited

            I think preview-10.8-MDEV-25785-openssl3.0 as of 7cd965af can and should be pushed into the main 10.8 and released with 10.8.1. There are some limitations and can be a lot of unknowns, depending on the variety of environments and systems, which is why we need the community feedback.

            Current status:

            • Linux: The server and most plugins build with basic build configurations (RelWithDebInfo, Debug, mysql_release) on a variety of Linux versions. Checked: Ubuntu 18.04/20.04, Debian 9/10/11, SLES 12/15, RHEL 7/8, x86_64/aarch64; Ubuntu 20.04 ppc64le; OpenSSL 3.0.1, in-source build and build + local installation in custom location.
              • Limitations:
                • Columnstore does not build, MCOL-4964 to track;
                • A user should be careful with cmake options to make sure the custom OpenSSL 3 does not mix up with the default OpenSSL installation of a different version, MDEV-27540 to track (not directly related to this task)
            • On Fedora Rawhide, where OpenSSL 3.0.0 is installed by default, the packages can be built and installed with it
              • Limitations:
                • Columnstore has to be disabled, MCOL-4962 (unrelated to this task) and MCOL-4964 to track;
                • If btrfs is in use, which is one of Rawhide's defaults, the server may not run. We are looking into it (unrelated to this task), meanwhile use XFS.
            • On Windows, the server can be built and run with both OpenSSL 3.0.0 installed from slpro and with OpenSSL 3.0.1 built locally
              • Limitations:
                • For a local OpenSSL build, installation must be performed (nmake install). With an in-source build, MariaDB server will compile/link, but will issue runtime errors (probably has always been so, and various README notes also suggest installation).
            • CI: There is a Ubuntu 20.04-based buildbot builder which currently builds the server with a local OpenSSL 3.0.1 installation, and there will soon be a Rawhide-based builder which will run RPM builds with the system-wide OpenSSL 3.

            Other notes:

            • There are a few binaries/plugins which still link with OpenSSL 1.x, whether legitimately or not, it is being looked into (MDEV-27542)
            • I didn't manage to build deb packages with OpenSSL 3.0 yet, there are some configuration issues to work around. It shouldn't be important for initial adoption though.
            elenst Elena Stepanova added a comment - - edited I think preview-10.8-MDEV-25785-openssl3.0 as of 7cd965af can and should be pushed into the main 10.8 and released with 10.8.1. There are some limitations and can be a lot of unknowns, depending on the variety of environments and systems, which is why we need the community feedback. Current status: Linux: The server and most plugins build with basic build configurations (RelWithDebInfo, Debug, mysql_release) on a variety of Linux versions. Checked: Ubuntu 18.04/20.04, Debian 9/10/11, SLES 12/15, RHEL 7/8, x86_64/aarch64; Ubuntu 20.04 ppc64le; OpenSSL 3.0.1, in-source build and build + local installation in custom location. Limitations: Columnstore does not build, MCOL-4964 to track; A user should be careful with cmake options to make sure the custom OpenSSL 3 does not mix up with the default OpenSSL installation of a different version, MDEV-27540 to track (not directly related to this task) On Fedora Rawhide, where OpenSSL 3.0.0 is installed by default, the packages can be built and installed with it Limitations: Columnstore has to be disabled, MCOL-4962 (unrelated to this task) and MCOL-4964 to track; If btrfs is in use, which is one of Rawhide's defaults, the server may not run. We are looking into it (unrelated to this task), meanwhile use XFS. On Windows, the server can be built and run with both OpenSSL 3.0.0 installed from slpro and with OpenSSL 3.0.1 built locally Limitations: For a local OpenSSL build, installation must be performed ( nmake install ). With an in-source build, MariaDB server will compile/link, but will issue runtime errors (probably has always been so, and various README notes also suggest installation). CI: There is a Ubuntu 20.04-based buildbot builder which currently builds the server with a local OpenSSL 3.0.1 installation, and there will soon be a Rawhide-based builder which will run RPM builds with the system-wide OpenSSL 3. Other notes: There are a few binaries/plugins which still link with OpenSSL 1.x, whether legitimately or not, it is being looked into ( MDEV-27542 ) I didn't manage to build deb packages with OpenSSL 3.0 yet, there are some configuration issues to work around. It shouldn't be important for initial adoption though.
            jplindst Jan Lindström (Inactive) added a comment -

            elenst Codership reported earlier that Galera library will build with OpenSSL 3.0 but I have not tested (MDEV-25949 ).

            jplindst Jan Lindström (Inactive) added a comment - elenst Codership reported earlier that Galera library will build with OpenSSL 3.0 but I have not tested ( MDEV-25949 ).
            elenst Elena Stepanova added a comment -

            Galera library is obviously out of this server task, it was also stated in advance in this comment.
            I did run .*ssl.* MTR tests as a part of the Linux exercise, including tests in the galera suite with an existing galera-4 library, on a server linked with openssl3, they passed. This is as much as I can say about the current Galera status.

            elenst Elena Stepanova added a comment - Galera library is obviously out of this server task, it was also stated in advance in this comment . I did run .*ssl.* MTR tests as a part of the Linux exercise, including tests in the galera suite with an existing galera-4 library, on a server linked with openssl3, they passed. This is as much as I can say about the current Galera status.

            People

              serg Sergei Golubchik
              hhorak Honza Horak
              Votes:
              3 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.