[MDEV-28233] rsync SST script silently runs unencrypted if stunnel is not installed - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.6.7, 10.7.3
Fix Version/s: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
Component/s: Encryption, Galera, Galera SST, SSL
Labels:
- docs_ok

Bug Category:
Notable changes
Release Note Summary:

Hide
When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer.

Show
When a Galera node's state snapshot transfer (SST) was configured for encryption, either through an explicit ssl-mode or through SSL certificates in the configuration, but the encryption could not actually be established, the rsync and mariabackup SST methods silently transferred the donor's data in cleartext: rsync when the stunnel binary was not installed, and mariabackup when no usable SSL certificate and key were found, the SST now aborts with an error in these situations instead of falling back to an unencrypted transfer.
Epic Link:
Galera SST Encryption Fixes
Sprint:
Q3/2026 Replic. Development

Description

When configuring Galera SST to use TLS encryption with the rsync SST method the stunnel tool is used to perform the actual encryption.

When stunnel is not installed though the wsrep_sst_rsync script just falls back to using unencrypted rsync, silently ignoring any TLS/SSL related settings in the [sst] configuration section. Especially even with ssl_mode=REQUIRED unencrypted rsync will be used.

SST will succeed either way, and the only difference is that with stunnel installed the log will show:

Mar 24 22:16:35 node-2 mariadbd[2208]: 2022-03-24 22:16:35 0 [Note] WSREP: Running: 'wsrep_sst_rsync --role 'joiner' --address 'galera-node-2' --datadir '/var/lib/mysql/' --parent '2208' --mysqld-args --wsrep_start_position=00000000-0000-0000-0000-000000000000:-1'

Mar 24 22:16:35 node-2 mariadbd[2219]: WSREP_SST: [INFO] Using stunnel for SSL encryption: CA: '/vagrant/ssl/ca-cert.pem', ssl-mode='VERIFY_CA' (20220324 22:16:35.672)

when the stunnel binary was found, whereas otherwise one will just see:

Mar 24 22:23:32 node-2 mariadbd[2029]: 2022-03-24 22:23:32 0 [Note] WSREP: Running: 'wsrep_sst_rsync --role 'joiner' --address 'galera-node-2' --datadir '/var/lib/mysql/' --parent '2029' --mysqld-args --wsrep_start_position=00000000-0000-0000-0000-000000000000:-1'

Mar 24 22:23:32 node-2 mariadbd[2029]: 2022-03-24 22:23:32 0 [Note] WSREP: Joiner monitor thread started to monitor

Mar 24 22:23:32 node-2 rsyncd[2139]: rsyncd version 3.1.3 starting, listening on port 4444

This is the only hint towards whether encryption is actually being used or not ...

Attachments

Issue Links

causes

MDEV-40630 stunnel as package recommendation for galera SST

Approved

Activity

People

Assignee:: Hemant Dangi

Reporter:: Hartmut Holzgraefe

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2022-04-04 09:17

Updated:: 9 minutes ago

Resolved:: 2026-07-28 14:42

Time Tracking

Estimated:

Remaining:

Logged:

7.75h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.