March 2021 - discuss - lists.mariadb.org

[Maria-discuss] Galera 23.2.7 mariadb 5.5.33a msvc 1600 binaries available
by Yann Nayn 18 Nov '24

18 Nov '24

Binaries have been uploaded for both x86 and amd64 platforms. due to github file size limitations , the directories have been uploaded unarchived. for Win33 binaries , please checkout https://github.com/YannNayn/galera-mariadb-win32.git and for Win64(amd64) binaries (being uploaded/pushed): https://github.com/YannNayn/galera-mariadb-win64.git they are not recommended for a production environment. in the my.cnf file: _________ wsrep_provider=galera_smm.dll wsrep_sst_method=msqldump # percona xtrabackup will be tested soon _________ libevent and openssl(the provided binaries use respectively 2.1.3-alpha and 1.1.0-dev versions ) will be added next on github some limitations are stated on openssl website copied here for convenience: ____________ from http://www.openssl.org/ ____________ This software package uses strong cryptography, so even if it is created, maintained and distributed from liberal countries in Europe (where it is legal to do this), it falls under certain export/import and/or use restrictions in some other parts of the world. PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS OF OPENSSL ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY. ________________________________________________ msvc 1600 redistributables SP1 need to be installed/available on the target machine: vcredist_x86.exe : http://www.microsoft.com/en-us/download/details.aspx?id=8328 vcredist_x64.exe : http://www.microsoft.com/en-us/download/details.aspx?id=13523 MSys binaries are provided and msqld.bat should then be used instead of mysqld.exe (e.g. mysld.bat --console --wsrep_cluster_address=gcomm:// ) in order to have a working sh shell(cygwin has been proved to do it as well) Please note that oqgraph is disabled (boost trunk is used , that is 1.55) Comments and suggestions are welcome.

2 1

[Maria-discuss] Galera with TLS not happy.
by lejeczek 30 Mar '21

30 Mar '21

Hi guys. I'm trying to add encryption to my already working galera cluster and I've look at number of tutorials, official ones included. I've added these to configs: [mariadb] ssl_cert = /etc/my.cnf.d/certs/c8kubernode2.private.pawel.crt ssl_key = /etc/my.cnf.d/certs/c8kubernode2.private.pawel.key ssl_ca = /etc/my.cnf.d/certs/ca.crt [mysqld] wsrep_provider_options="socket.ssl=yes;socket.ssl_cert=/etc/my.cnf.d/certs/c8kubernode2.private.pawel.crt;socket.ssl_key=/etc/my.cnf.d/certs/c8kubernode2.private.pawel.key;socket.ssl_ca=/etc/my.cnf.d/certs/ca.crt" First server, above configs, starts okey with 'galera_new_cluster' but the second, I'm on Centos 8, when started as normal with systemd shows: ... 2021-03-29 17:33:34 0 [ERROR] WSREP: gcomm/src/asio_tcp.cpp:handshake_handler():128: handshake with remote endpoint ssl://10.1.1.223:4567 failed: asio.ssl:337047686: 'certificate verify failed' ( 337047686: 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed') 2021-03-29 17:33:36 0 [ERROR] WSREP: gcomm/src/asio_tcp.cpp:handshake_handler():128: handshake with remote endpoint ssl://10.1.1.223:4567 failed: asio.ssl:337047686: 'certificate verify failed' ( 337047686: 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed') ... and eventually after a moment fails. The second server has the same bits in configs only, naturally, files names are different respectively. I also see this, in case might tell more or be relevant, this is on 'galera_new_cluster' up & running: -> $ mysql --ssl -h c8kubernode2.private.pawel -u wordpress -p --ssl-verify-server-cert=true Enter password: ERROR 2026 (HY000): SSL connection error: self signed certificate in certificate chain -> $ mysql --ssl -h c8kubernode2.private.pawel -u wordpress -p --ssl-verify-server-cert=false Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. But if this is 'CN' problem then looking at the mysql server cert: -> $ _my._sslPrintCert.sh c8kubernode2.private.pawel.crt issuer=CN = "nodemaster.private.pawel," # <= here, it matches server's hostname as expected. subject=CN = c8kubernode2.private.pawel notAfter=Jul 2 20:50:57 2023 GMT Certificate: ... Also, in case it might matter, I do not have as you can see [sst] bits done yet. Any ideas someone cares to share I'll appreciate. many thanks, L.

1 0

[Maria-discuss] Introduction and Task Suggestion
by Hemant Kumar Singh 22 Mar '21

22 Mar '21

Hi everyone, I am Hemant from Nepal, currently a Computer Science Junior at NIT Warangal, India willing to take part in GSoC 2021. I saw a major priority task "MDEV-13648- Add FULL OUTER JOIN to MariaDB (https://link.getmailspring.com/link/F02B618E-9401-406B-BD92-A573A39AD858@ge…)" unresolved since gsoc 2019; but it's not listed in 2021 List of Ideas. So, I was just wondering whether I can contribute to this task for gsoc 2021. Can anyone confirm this? Regards, Hemant Kumar Singh https://iamhks.com (https://link.getmailspring.com/link/F02B618E-9401-406B-BD92-A573A39AD858@ge…)

3 3

[Maria-discuss] Is it possible to upgrade SHA-1 and MD5 algorithms in Mariadb-10.5?
by Lukas Javorsky 22 Mar '21

22 Mar '21

Hi, In RHEL-9 we are deprecating, old SHA-1 and MD5 and that's why I want to ask you if there is any chance that upstream is going to change it, or we should do it downstream. These algorithms are no longer considered as safe, so it may be a good thing to upgrade them. AFAIK mariadb uses these algorithms in *mariadb* and *mariadb-connector-c.* Also if you have no intention to change it, is there any chance you could help us somehow. Maybe point out what we should be aware of. Please let me know what you think Lukas -- S pozdravom/ Best regards Lukáš Javorský Associate Software Engineer, Core service - Databases Red Hat <https://www.redhat.com> Purkyňova 115 (TPB-C) 612 00 Brno - Královo Pole ljavorsk(a)redhat.com <https://www.redhat.com>

5 8

[Maria-discuss] Why does MariaDB needs SELinux capability for setuid/setgid?
by Lukas Javorsky 16 Mar '21

16 Mar '21

Hi guys, I'm looking into SELinux in Fedora's MariaDB package and I can see that we have two types in MariaDB that have setuid/setgid capability. 1st: https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/module… 2nd: https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/module… My question is, does mysqld_t need to have this capability? I found that setuid/setgid is used inside mysqld_safe_helper (mariadbd-safe-helper). Are there any other cases when MariaDB uses these functions? Thank you for letting me know Lukas -- S pozdravom/ Best regards Lukáš Javorský Associate Software Engineer, Core service - Databases Red Hat <https://www.redhat.com> Purkyňova 115 (TPB-C) 612 00 Brno - Královo Pole ljavorsk(a)redhat.com <https://www.redhat.com>

3 5

[Maria-discuss] Problem with InnoDB: Semaphore wait after upgrading to 10.3.27
by Conor Murphy 16 Mar '21

16 Mar '21

Hi, We have a handful of servers running MariaDB 10.3. We noticed issues on two of them where we were getting issues like "InnoDB: A long semaphore wait:--Thread 140602802394880 has waited at dict0stats.cc line 1969 for 241.00 seconds the semaphore:" and crashes like "ERROR] [FATAL] InnoDB: Semaphore wait has lasted > 600 seconds. We intentionally crash the server because it appears to be hung.210215 7:14:24 [ERROR] mysqld got signal 6 ;" Turned out that these two servers were running 10.3.27 whereas the others were running 10.3.17. After downgrading the two problem servers to 10.3.17, all the issues with InnoDB semaphores stopped. Any ideas on how to track down what change between 10.3.17 to 10.3.27 might be causing this problem? Thanks, Conor

3 4

[Maria-discuss] RocksDB doubt
by Roberto Spadim 04 Mar '21

04 Mar '21

Hi folks! Could be possible write/read from rocksdb and at the same machine have a mariadb+myrocksdb running? -- Roberto Spadim

1 0