Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28239

rsync and mariabackup SST scripts handle sst ssl_mode option differently

    XMLWordPrintable

Details

    • Can result in unexpected behaviour
    • Hide
      Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address. Previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts. Deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly.
      Show
      Galera state transfers (SST) now interpret the ssl-mode=VERIFY_CA setting as documented: a node's certificate must come from a trusted certificate authority, but its name no longer has to match the server's address. Previously, VERIFY_CA was incorrectly treated as strictly as VERIFY_IDENTITY, which could block state transfers between healthy nodes whose certificates did not name their hosts. Deployments that want the stricter name matching should set ssl-mode=VERIFY_IDENTITY explicitly.
    • Q3/2026 Replic. Maintenance, Q3/2026 Replic. Development

    Description

      The wsrep_sst_rsync script checks four different ssl_mode settings:

      • DISABLED (or unset) - do not use encryption
      • REQUIRED - make sure encryption is used
      • VERIFY_CA and VERIFY_IDENTITY set different certificate verification modes

      A closer look at the SST scripts though shows that only the rsync scripts treats both VERIFY modes as different, while the mariabackup script just enables general verification when seeing a mode starting with VERIFY, not checking the rest of the string then and so not making a difference between VERIFY_CA and VERIFY_IDENTITY

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39291 wsrep_sst_mariabackup does not distinguish between VERIFY_CA and VERIFY_IDENTITY

          • Major - Major loss of function.
          • Open

          Activity

            People

              janlindstrom Jan Lindström
              hholzgra Hartmut Holzgraefe
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 2d 7h 50m
                  2d 7h 50m
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 7h 35m Time Not Required
                  7h 35m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.