tag 674267 +confirmed +upstream
retitle 674267 issues with SSL on i386 and kfreebsd-i386
thanks
The starting point is the build failures listed above. Those are the
only architectures where it has been observed. It only happens when
MySQL is built against the bundled yaSSL rather than openssl (which is a
Debian requirement). It does not happen on squeeze. Within those
parameters it appears to be 100% reproducible. I have to add one other
test to the list: main.ssl_connect .
Within the Debian context there is a quick way to reproduce it:
1.) Install the mysql-testsuite-5.5 package.
2.) cd /usr/lib/mysql-testsuite
3.) ./mysql-test-run --enable-disabled --var=<suitable test area>
main.ssl_connect rpl.rpl_heartbeat_ssl rpl.rpl_ssl1 rpl.rpl_ssl
main.ssl_cipher
To establish its upstream credentials one may build directly from the
upstream tarball and arrive at the same conclusions. (This will not work
on a kfreebsd-i386 machine because a Perl bug on that platfom prevents
any tests from running unless Debian work around patches are applied.)
Now comes the question whether these are broken tests or an indication
of a real problem. To avoid the certificates used being under suspicion
I suggest using the certificates supplied with the test suite. (These
look valid according to openssl tools.) I will describe what happens as
one works one's way up the SSL configuration stack comparing i386 and amd64.
1.) Log into a fresh Debian MySQL i386 or amd64 install and run "show
variables like '%ssl%';" and you will get:
mysql> show variables like '%ssl%';
+---------------+----------+
| Variable_name | Value |
+---------------+----------+
| have_openssl | DISABLED |
| have_ssl | DISABLED |
| ssl_ca | |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_key | |
+---------------+----------+
7 rows in set (0.00 sec)
Don't be confused by "have_openssl". According to the MySQL
documentation these two are aliases.
2.) Now set "ssl-ca=/usr/lib/mysql-testsuite/std_data/cacert.pem" in the
[mysqld] section of the config and bounce the server. Now you would get
on either platform:
mysql> show variables like '%ssl%';
+---------------+----------------------------------------------+
| Variable_name | Value |
+---------------+----------------------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /usr/lib/mysql-testsuite/std_data/cacert.pem |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_key | |
+---------------+----------------------------------------------+
7 rows in set (0.00 sec)
3.) Now set
ssl-cert=/usr/lib/mysql-testsuite/std_data/server-cert.pem
ssl-key=/usr/lib/mysql-testsuite/std_data/server-key.pem
and bounce the server. Now on either platform you will get:
mysql> show variables like '%ssl%';
+---------------+---------------------------------------------------+
| Variable_name | Value |
+---------------+---------------------------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /usr/lib/mysql-testsuite/std_data/cacert.pem |
| ssl_capath | |
| ssl_cert | /usr/lib/mysql-testsuite/std_data/server-cert.pem |
| ssl_cipher | |
| ssl_key | /usr/lib/mysql-testsuite/std_data/server-key.pem |
+---------------+---------------------------------------------------+
7 rows in set (0.00 sec)
4.) Now the difference comes when you try to pass a --ssl-ca argument to
the client. On amd64 you will get:
nicholas@taylor:/usr/lib/mysql-testsuite$ mysql -u root -p --ssl-ca
/usr/lib/mysql-testsuite/std_data/cacert.pem
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 38
Server version: 5.5.23-2 (Debian) ...................................
On the i386 machine you will get:
nicholas@beaumont:~/var/log$ mysql -u root -p --ssl-ca
/usr/lib/mysql-testsuite/std_data/cacert.pem
Enter password:
ERROR 2026 (HY000): SSL connection error:
error:00000005:lib(0):func(0):DH lib
nicholas@beaumont:~/var/log$
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
