Fix clients reconnect with SSL by disabling SSL tickets #4537
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SSL sessions resume/tickets aren't supported right now, disabling them shouldn't have negative effects. On the other hand, enabling them can lead to invalid SSL handshakes when the client tries to reuse a previously issued session ticket. Some clients, e.g: MySQL > 8.0.29, attempt session reuses during reconnect operations.
JavierJF
force-pushed
the
v2.x-disable_ssl_tickets
branch
from
fe9255b
to
ded4408
Compare
- Split 'libtap' into different binaries. This allows for the reuse of 'TAP' utilities that make use of MySQL or other third party library versions. Each of these tests that require special library versions that aren't the common ones embedded into the dynamic library 'libtap.so' should be compiled defining special helper targets, in the 'tests' folder Makefile itself. These helper targets with specify the linking of the required version of the library for the test. Each MySQL client version supported by the 'tap' tests that breaks headers compatibility should be compiled into a different object file, following the previous described procedure. - Add MySQL 8.4.0 client library as a new TAP test dependency. - Multiple compilation fixes consequence of the introduced change to 'libtap.a'. - Added as ProxySQL dependency the forward declaration header for 'nlohmann::json'. This header is the proper way of including the library is headers which are sensible of being included in multiples files. This speeds compilation times of each TAP test. - Removed 'std::regex' dependency from 'utils.cpp', and replaced by project dependency 're2'. Library 'std::regex' should not be used in any place that introduces it as a dependency for later objects, it's heavy, slow, and should be avoided in general.
Tests reconnect with and without SSL for 'libmariadb' and 'libmysql'.
JavierJF
force-pushed
the
v2.x-disable_ssl_tickets
branch
from
13b0310
to
afc79e1
Compare
|
retest this please |
This was referenced May 27, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue description
Having SSL session tickets enabled can lead to failed SSL handshakes when the client tries to reuse a previously issued session ticket. Some clients, like for example, MySQL > 8.0.29, attempt session reuses during reconnect operations.
Solution
SSL sessions resume/tickets aren't supported right now, we should explicitly disable them. This will prevent the generation of this unused and potentially faulty session tickets.
PR details
This PR also introduces some major changes for TAP tests:
Aside of these, also multiple minor changes have also been introduced in the TAP tests compilation to reduce their size and increase compilation speed:
std::regexas a dependency, this should be avoided in the future.nlohmann::json. This library imposes significant pre-processing overhead when included in every object file.