October 2017 - discuss - lists.mariadb.org

[Maria-discuss] MaxScale behaviour differs for TLs and non-TLS clients
by Pak Chan 16 Oct '17

16 Oct '17

Hi, I'm (still) testing MaxScale, set up to connect only to the master node, on Ubuntu 16.04 fronting a Galera cluster. The cluster comprises of 2 MariaDB 10.1 instances on different servers, with a Galera Arbitrator instance running on the MaxScale server. I'm testing this using the MariaDB client (mysql) from a fourth machine. My test scenario is to see what the client experiences if I stop and restart a MariaDB node part-way through a transaction. I start with the "slave" node, to give me a baseline for comparison, before doing it with the master node. However, the baseline case gives me different results, depending on whether the MySQL client is connecting via TLS or not. If I connect to MaxScale via TLS, the connection disappears when the "slave" node comes back (but not when it goes down). Watching it via a network packet trace, I can see that, just after the slave comes back up, MaxScale sends the client an encrypted packet to the mysql client, then sends a MySQL Quit command to the master node before disconnecting. The syslog contains the line "[galeramon] There are no cluster members". If I connect to MaxScale without TLS, the connection remains stable regardless of the number of times the slave node goes down and up, and the "galeramon" line doesn't appear in the syslog. (I discovered this when I disabled the TLS in order to see what the encrypted packet being sent to the client was...I still don't know what it is!) Has anyone else come across this behaviour? MaxScale is configured as follows (the commented-out configuration is uncommented when connecting via TLS): [dbnode1] type=server address=172.16.1.22 port=3306 protocol=MySQLBackend priority=1 [dbnode2] type=server address=172.16.1.23 port=3306 protocol=MySQLBackend priority=2 [Galera Monitor] type=monitor module=galeramon servers=dbnode1,dbnode2 user=galeramon passwd=galeramon monitor_interval=1000 available_when_donor=true use_priority=true [Galera Service] type=service router=readrouteconn router_options=master servers=dbnode1,dbnode2 user=galeramon passwd=galeramon [MaxAdmin Service] type=service router=cli [Galera Listener] type=listener service=Galera Service protocol=MySQLClient port=3306 #ssl=required #ssl_version=TLSv12 #ssl_cert=/etc/mysql/ssl/server-cert.pem #ssl_key=/etc/mysql/ssl/server-key.pem #ssl_ca_cert=/etc/mysql/ssl/ca-cert.pem #ssl_cert_verify_depth=1 [MaxAdmin Listener] type=listener service=MaxAdmin Service protocol=maxscaled socket=default PC

2 3

[Maria-discuss] GitHub morgo/mysql-compatibility-config - add MariaDB
by Lukas Lehner 15 Oct '17

15 Oct '17

Hey I really like https://github.com/morgo/mysql-compatibility-config is there something similar for MariaDB? Since the repo is owned by some Oracle guy, I guess he won't add MariaDB. Lukas

1 0

[Maria-discuss] MaxScale (lack of) resilience to Galera cluster changes
by Pak Chan 06 Oct '17

06 Oct '17

Hi, Following on from my other thread, I'm testing MaxScale fronting a 2-node Galera cluster (with a Galera Arbitrator acting as the third node). My current test outline is as follows: 1. Identify the Write Master server in MaxScale 2. Connect two mysql clients to MaxScale, and put them both into "READ COMMITTED" isolation level ("set global transaction isolation level read committed") 3. Begin a transaction in each client session 4. Take down the non-Write master node in the Galera cluster ("systemctl stop mysql" on that server) 5. Commit the transaction in client 1 6. Confirm that the clients can see the committed change 7. Start up the stopped node in the Galera cluster ("systemctl start mysql" on that server) 8. Commit the transaction in client 2 9. Confirm that the clients can see the committed change 10. ... What happens is that everything appear to work up until step 8, when client 2 loses its connection to the database when trying to commit, reconnects and loses its uncommitted transaction as a result. At step 9, client 1 announces that it has lost the connection and reconnects. Is this meant to happen? If I run the same test, bypassing MaxScale and connecting both clients directly to the same Galera node, I don't get the connection loss. I understand that MaxScale will route writes to one node and reads to another, but surely the loss of connection to a read node should not result in the loss of connection to the write node? Am I doing something wrong? Yours very puzzled. PC

1 1

[Maria-discuss] MaxScale Server SSL version
by Pak Chan 05 Oct '17

05 Oct '17

Hi, I'm in the process of setting up MaxScale on Ubuntu 16.04 fronting a Galera cluster where the MariaDB database nodes (also on Ubuntu 16.04) are set to use TLSv1.2. There is a "test" user and a "galeramon" user on the database, both requiring SSL. According to the documentation, I can configure this in MaxScale as follows: [dbnode1] type=server address=172.16.1.22 port=3306 protocol=MySQLBackend ssl=required ssl_version=TLSv12 ssl_cert=/etc/mysql/ssl/db-client-cert.pem ssl_key=/etc/mysql/ssl/db-client-key.pem ssl_ca_cert=/etc/mysql/ssl/ca-cert.pem [dbnode2] type=server address=172.16.1.23 port=3306 protocol=MySQLBackend ssl=required ssl_version=TLSv12 ssl_cert=/etc/mysql/ssl/db-client-cert.pem ssl_key=/etc/mysql/ssl/db-client-key.pem ssl_ca_cert=/etc/mysql/ssl/ca-cert.pem [Galera Monitor] type=monitor module=galeramon servers=dbnode1,dbnode2 user=galeramon passwd=galeramon monitor_interval=1000 [Galera Service] type=service router=readwritesplit servers=dbnode1,dbnode2 user=galeramon passwd=galeramon [MaxAdmin Service] type=service router=cli [Galera Listener] type=listener service=Galera Service protocol=MySQLClient port=3306 authenticator=MySQL ssl=required ssl_version=TLSv12 ssl_cert=/etc/mysql/ssl/server-cert.pem ssl_key=/etc/mysql/ssl/server-key.pem ssl_ca_cert=/etc/mysql/ssl/ca-cert.pem ssl_cert_verify_depth=9 [MaxAdmin Listener] type=listener service=MaxAdmin Service protocol=maxscaled socket=default However, this never successfully connects. I ran a packet capture on the connection, and found that the reason it was failing was that MaxScale was trying to connect using TLSv1.0 despite the specification. Changing the "ssl_version" setting to "MAX" had no effect. The version of openssl and libssl1.0.0 on the server are both 1.0.2g-1ubuntu4.8, so it should support TLSv1.2. I installed MaxScale with: curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version=mariadb-10.1 sudo apt install maxscale I can disable the TLS requirement for the "galeramon" user, which allows MaxScale to start up, but the moment I log into the database via MaxScale as the "test" user, the connection fails, as the following transcript (from a different server) shows: test@dbclient01:~$ mysql -h 172.16.2.1 -u test -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MySQL connection id is 31200 Server version: 10.0.0 2.1.9-maxscale Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MySQL [(none)]> show databases; ERROR 2006 (HY000): MySQL server has gone away No connection. Trying to reconnect... Connection id: 31200 Current database: *** NONE *** ERROR 2003 (HY000): Authentication with backend failed. Session will be closed. MySQL [(none)]> Is this a known issue, or is there something wrong with the configuration? For the record, I can connect to a database instance over TLSv1.2 from the MaxScale server using the mysql client with the same ("db-client-*") certificate as specified above. PC

2 2