gmysql backend fails when server sends "Authentication Switch Request" #10340
Comments
|
This look like an excellent piece of investigation, thank you! |
|
/me breathes a sigh of relief. Happy to dodge the dreaded "this seems like a support request" comment. 😄 |
|
Right now, the only opportunity for us saying that is when this turns out to be a bug in the mysql/maria client lib. We'll see once we investigate more. We have also been no strangers to reporting bugs elsewhere as a result of our investigations :) |
|
I have reproduced the segfault (with zero SSL involved). |
|
Valgrind reports: relevant part of our call stack: so, this actually does look like a libmariadb bug. |
Ironically, these two functions are very related. They just are not compatible.
In any case, this really is a MariaDB bug. I haven't been able to think of a workaround yet (other than your various combinations of SSL settings). I also did not check if there's a ticket at MariaDB about this. |
Sorry, I misread that. You had no combination that actually worked. That resolves one mystery. |
|
(I confirmed that a pdns built without libsodium works fine.) |
I am aware I have ignored this part so far; I suspect it is unrelated to the crashes, but I did not look into it yet. |
There does not appear to be one yet. |
|
|
|
Reported to MariaDB as https://jira.mariadb.org/browse/CONC-548 |
And fixed in mariadb-corporation/mariadb-connector-c@180c543 |
|
Thanks so much! In parallel I'm coordinating figuring out how to get these changes pulled back into RHEL / CentOS through the "Modularity*"/"AppStream" mechanism. *Modularity is the "circuit breaker" for working around some of the versioning statements I made in #9929, but is narrowly scoped for specific user-space applications. As the challenges with SSL are a totally separate issue, I'm closing this as resolved. I'll explore that more and open an issue once I can craft a more meaningful bug report. |
Please let us know how that goes. Normally we discourage commenting on closed tickets but in this case I'd say this ticket is a fine place for that.
Perfect. Thanks! |
Short description
Attempting to use the
gmysqlbackend with MariaDB fails when the server sends an Authentication Switch Request. This has been validated using the ed25519 authentication plugin.Environment
Steps to reproduce
ed25519authentication plugin as per the documentation above.mysqlcommand line client and check the plugin used for the user:wiresharkcapture to introspect the connection handling (tshark -i eth0 -w /tmp/mysql.pcap tcp port 3306)pdnsExpected behaviour
Actual behaviour
It depends on whether SSL is enabled or not. If SSL is enabled directly in
pdns.conf(e.g.gmysql-ssl=yes) then pdns fails to start the backend, throwing the errorCaught an exception instantiating a backend: Unable to launch gmysql connection: Unable to connect to database: ERROR 1043 (08S01): Bad handshake:If SSL is configured through the system
my.cnfthrough the use of the group mechanism or if SSL is unused pdns crashes outright:Other information
Additionally, I am curious as to why the behavior of pdns is further mutated by the presence of
gmysql-ssl=yesinpdns.conf.The packet trace of a vanilla connection with the configuration files supplied above (and no SSL so as to allow introspection of the protocol stream) appears as follows, with successful authentication occurring on lines 6-10:
Conversely the packet trace of pdns attempting to login appears as follows:
The text was updated successfully, but these errors were encountered: