Skip to content

MDEV-40027 : Galera Cluster-peer > Donor command execution #5234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
janlindstrom wants to merge 2 commits into
base: 10.6
Choose a base branch
from
Open

MDEV-40027 : Galera Cluster-peer > Donor command execution #5234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b761db2
MDEV-40027 : Galera Cluster-peer > Donor command execution
janlindstrom Jun 15, 2026
a5a2571
MDEV-40056 : Analyze Galera Dynamic Variables Susceptible to RCEs
janlindstrom Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions mysql-test/suite/galera/r/galera_sst_cn_injection.result
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
connection node_2;
connection node_1;
SELECT 1;
1
1
#
# MDEV-39413 wsrep unsafe handling of parameters
#
call mtr.add_suppression("WSREP: Illegal character in state transfer request:");
call mtr.add_suppression("WSREP: Bad remote auth string. SST canceled.");
call mtr.add_suppression("WSREP: SST preparation failed");
call mtr.add_suppression("WSREP: SST failed:");
call mtr.add_suppression(".*State transfer to:*");
call mtr.add_suppression("WSREP: Illegal character in variable:");
connection node_2;
# force SST again
# using a cert with shell-unsafe CN
# start the server
# the server failed to start
FOUND 1 /Bad remote auth string. SST canceled./ in mysqld.1.err
# cleanup
# restart
call mtr.add_suppression(".*WSREP.*Will never receive state. Need to abort.");
call mtr.add_suppression("WSREP_SST:");
27 changes: 0 additions & 27 deletions mysql-test/suite/galera/r/galera_sst_rsync_encrypt_with_key_server.result
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion ...era_sst_rsync_encrypt_with_key_server.cnf → ...uite/galera/t/galera_sst_cn_injection.cnf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
!include ../galera_2nodes.cnf

[mysqld]
wsrep_sst_method=rsync
wsrep_sst_auth="root:"
wsrep_debug=1

Expand Down
6 changes: 6 additions & 0 deletions mysql-test/suite/galera/t/galera_sst_cn_injection.combinations
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
[rsync]
wsrep-sst-method=rsync

[mariabackup]
wsrep-sst-method=mariabackup

27 changes: 12 additions & 15 deletions ..._mariabackup_encrypt_with_key_server.test → ...ite/galera/t/galera_sst_cn_injection.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,24 +15,16 @@ SELECT 1;
--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size';
--source include/wait_condition.inc

# Confirm that transfer was SSL-encrypted
--let SEARCH_FILE = $MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN = Using openssl based encryption with socat: with key and crt
--source include/search_pattern_in_file.inc

--echo #
--echo # MDEV-39413 wsrep unsafe handling of parameters
--echo #

call mtr.add_suppression('Invalid value for WSREP_SST_OPT_REMOTE_USER');
call mtr.add_suppression('Failed to read from: wsrep_sst_mariabackup');
call mtr.add_suppression('Process completed with error: wsrep_sst_mariabackup');
call mtr.add_suppression('Command did not run: wsrep_sst_mariabackup');
call mtr.add_suppression('State transfer to .* failed');
call mtr.add_suppression('Will never receive state. Need to abort');
call mtr.add_suppression('Error while getting data from donor node');
call mtr.add_suppression('Cleanup after exit with status');
call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal');
call mtr.add_suppression("WSREP: Illegal character in state transfer request:");
call mtr.add_suppression("WSREP: Bad remote auth string. SST canceled.");
call mtr.add_suppression("WSREP: SST preparation failed");
call mtr.add_suppression("WSREP: SST failed:");
call mtr.add_suppression(".*State transfer to:*");
call mtr.add_suppression("WSREP: Illegal character in variable:");

--connection node_2
--source include/shutdown_mysqld.inc
Expand All @@ -51,7 +43,8 @@ call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal'
--exec $MYSQLD_LAST_CMD
--echo # the server failed to start

--let SEARCH_PATTERN = Invalid value for WSREP_SST_OPT_REMOTE_USER
--let SEARCH_FILE = $MYSQLTEST_VARDIR/log/mysqld.1.err
--let SEARCH_PATTERN = Bad remote auth string. SST canceled.
--source include/search_pattern_in_file.inc

--echo # cleanup
Expand All @@ -60,6 +53,10 @@ call mtr.add_suppression('Removing .*/xtrabackup_galera_info file due to signal'
# pkill exit code varies by platform 0 or 1
--error 0,1
--exec pkill -f 'socat.*server-new-cert'

--exec echo ssl-cert=$MYSQL_TEST_DIR/std_data/server-cert.pem >> $MYSQLTEST_VARDIR/my.cnf
--exec echo ssl-key=$MYSQL_TEST_DIR/std_data/server-key.pem >> $MYSQLTEST_VARDIR/my.cnf
--source $MYSQL_TEST_DIR/include/start_mysqld.inc

call mtr.add_suppression(".*WSREP.*Will never receive state. Need to abort.");
call mtr.add_suppression("WSREP_SST:");
13 changes: 0 additions & 13 deletions mysql-test/suite/galera/t/galera_sst_mariabackup_encrypt_with_key_server.cnf
View file
Open in desktop

This file was deleted.

99 changes: 0 additions & 99 deletions mysql-test/suite/galera/t/galera_sst_rsync_encrypt_with_key_server.test
View file
Open in desktop

This file was deleted.

20 changes: 20 additions & 0 deletions mysql-test/suite/sys_vars/r/wsrep_node_address_basic.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,26 @@ ERROR 42000: Variable 'wsrep_node_address' can't be set to the value of 'NULL'
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address

SET @@global.wsrep_node_address="127.0.0.1'ps";
ERROR 42000: Variable 'wsrep_node_address' can't be set to the value of '127.0.0.1'ps'
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address

SET @@global.wsrep_node_address="127.0.0.1 ps";
ERROR 42000: Variable 'wsrep_node_address' can't be set to the value of '127.0.0.1 ps'
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address

SET @@global.wsrep_node_address="127.0.0.1`ps";
ERROR 42000: Variable 'wsrep_node_address' can't be set to the value of '127.0.0.1`ps'
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address

SET @@global.wsrep_node_address="127.0.0.1$ps";
ERROR 42000: Variable 'wsrep_node_address' can't be set to the value of '127.0.0.1$ps'
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address

SET @@global.wsrep_node_address=ON;
SELECT @@global.wsrep_node_address;
@@global.wsrep_node_address
Expand Down
22 changes: 22 additions & 0 deletions mysql-test/suite/sys_vars/r/wsrep_sst_auth_basic.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,29 @@ SELECT @@global.wsrep_sst_auth;
NULL
SET @@global.wsrep_sst_auth=user:pass;
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':pass' at line 1
SET @@global.wsrep_sst_auth='user new:pass';
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user new:pass'
SET @@global.wsrep_sst_auth='user$new:pass';
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user$new:pass'
SET @@global.wsrep_sst_auth="user'new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user'new:pass'
SET @@global.wsrep_sst_auth="user;new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user;new:pass'
SET @@global.wsrep_sst_auth="user|new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user|new:pass'
SET @@global.wsrep_sst_auth="user&new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user&new:pass'
SET @@global.wsrep_sst_auth="user\\new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user\new:pass'
SET @@global.wsrep_sst_auth="user\"new:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user"new:pass'
SET @@global.wsrep_sst_auth="user\nnew:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user
new:pass'
SET @@global.wsrep_sst_auth="user\tnew:pass";
ERROR 42000: Variable 'wsrep_sst_auth' can't be set to the value of 'user new:pass'

# restore the initial value
SET @@global.wsrep_sst_auth = @wsrep_sst_auth_global_saved;
call mtr.add_suppression("WSREP: Illegal character in variable:");
# End of test
13 changes: 13 additions & 0 deletions mysql-test/suite/sys_vars/t/wsrep_node_address_basic.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,19 @@ SELECT @@global.wsrep_node_address;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_node_address=NULL;
SELECT @@global.wsrep_node_address;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_node_address="127.0.0.1'ps";
SELECT @@global.wsrep_node_address;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_node_address="127.0.0.1 ps";
SELECT @@global.wsrep_node_address;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_node_address="127.0.0.1`ps";
SELECT @@global.wsrep_node_address;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_node_address="127.0.0.1$ps";
SELECT @@global.wsrep_node_address;

# The values being assigned to wsrep_node_address are not verified so the
# following alues are currently valid too.
Comment on lines 45 to 46
SET @@global.wsrep_node_address=ON;
Expand Down
22 changes: 22 additions & 0 deletions mysql-test/suite/sys_vars/t/wsrep_sst_auth_basic.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,31 @@ SET @@global.wsrep_sst_auth=1;
SELECT @@global.wsrep_sst_auth;
--error ER_PARSE_ERROR
SET @@global.wsrep_sst_auth=user:pass;
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth='user new:pass';
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth='user$new:pass';
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user'new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user;new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user|new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user&new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user\\new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user\"new:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user\nnew:pass";
--error ER_WRONG_VALUE_FOR_VAR
SET @@global.wsrep_sst_auth="user\tnew:pass";

--echo
--echo # restore the initial value
SET @@global.wsrep_sst_auth = @wsrep_sst_auth_global_saved;

call mtr.add_suppression("WSREP: Illegal character in variable:");

--echo # End of test
3 changes: 2 additions & 1 deletion scripts/wsrep_sst_mariabackup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1117,7 +1117,8 @@ if [ "$WSREP_SST_OPT_ROLE" = 'donor' ]; then
wsrep_log_info "Using '$itmpdir' as mariadb-backup working directory"

if [ -n "$WSREP_SST_OPT_USER" ]; then
INNOEXTRA="$INNOEXTRA --user='$WSREP_SST_OPT_USER'"
WSREP_SST_OPT_USER_SAFE="$(safe WSREP_SST_OPT_USER)"
Comment thread
janlindstrom marked this conversation as resolved.
INNOEXTRA="$INNOEXTRA --user='$WSREP_SST_OPT_USER_SAFE'"
fi

if [ -n "$WSREP_SST_OPT_PSWD" ]; then
Expand Down
Loading