[MDEV-29994] Length of Password for replication and upgrade Created: 2022-11-10  Updated: 2023-11-28

Status: Stalled
Project: MariaDB Server
Component/s: Replication
Affects Version/s: 10.7.4
Fix Version/s: 10.11

Type: Bug Priority: Minor
Reporter: Aurélien LEQUOY Assignee: Andrei Elkin
Resolution: Unresolved Votes: 0
Labels: beginner-friendly


 Description   

I set up replication, with this password : (10.7.4)

ePE5A0jpBrpyzDRILDGeuh5L9IoUCbDE1wgLWe4xCJg=

Everything working fine, after i decided to upgrade to 10.7.7

apt update
 
apt upgrade

then the password become :

ePE5A0jpBrpyzDRILDGeuh5L9IoUCbDE1wgLWe4xC

(in master.info), look the password is now truncated.

 Comments   
Comment by Tuukka Pasanen [ 2022-11-18 ]

Thank you for report and could you fill which Debian version. So I can try to replicate this easier.

Comment by Tuukka Pasanen [ 2022-11-18 ]

Please provide Debian/Ubuntu version was in use

Comment by Andrew Hutchings [ 2022-11-18 ]

Hi,

In https://mariadb.com/kb/en/change-master-to/ it mentions "The maximum length of the MASTER_PASSWORD string is 32 characters.".

In this case the file will have been read by MariaDB Server and truncated at that point (the read segment only reads around 41 characters). Then the truncated version will have been written out when the file was updated.

Please for now use a smaller password and please feel free to open a feature request to support longer passwords.

Comment by Aurélien LEQUOY [ 2022-11-26 ]

the exact version :

No LSB modules are available.
 
Distributor ID:	Debian
 
Description:	Debian GNU/Linux 11 (bullseye)
 
Release:	11
 
Codename:	bullseye
 
uname -a
 
Linux gcp-prod-oos-sql-0001-mariadb-g01-001 5.10.0-19-cloud-amd64 #1 SMP Debian 5.10.149-2 (2022-10-21) x86_64 GNU/Linux

Comment by Aurélien LEQUOY [ 2022-11-26 ] 

dmidecode -s system-product-name
 
Google Compute Engine

Comment by markus makela [ 2022-12-02 ]

The problem appears to be on line 500 in rpl_mi.cc:

        init_strvar_from_file(mi->password, SCRAMBLED_PASSWORD_CHAR_LENGTH+1,
 
                              &mi->file, 0) ||

SCRAMBLED_PASSWORD_CHAR_LENGTH+1 expands to 20 * 2 + 1 which would be OK if the password was stored in its hashed form but since it's in plaintext form, the length should be 96 to allow 32 character passwords in multi-byte character sets to be used (MDEV-4013 seems to have added support for them).

Comment by Aurélien LEQUOY [ 2022-12-09 ]

we should return an error when we set a password more than 32 no ?

Generated at Thu Feb 08 10:12:50 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.