Segfault with nodejs 0.12.6 and 0.12.7 using SSL and pool connection

[Drazke]

Hi,

I updated nodejs to version 0.12.6 and now node-mysql with SSL option give me a segmentation fault when I try to get a connexion (getConnection call) for a pool. Everything worked fine in nodejs 0.12.4 with SSL option.

After some test I figured out that it works if I remove the SSL option.

Here an example that segfault :

var mysql = require('mysql');
var fs = require("fs");

var pool = mysql.createPool({
    host     : 'host',
    user     : 'user',
    password : 'password',
    database : 'database',
    ssl      : {
        rejectUnauthorized: false,
        ca: fs.readFileSync('./ca-file')
    }
});

pool.getConnection(function(err, connexion) {
    if (err) {
            console.log(err);
        }
        else {
            console.log("ok");
        }
    });

Today I try to update nodejs to 0.12.7 but there is still no change.

For information, i'm on ubuntu trusty 14.04 LTS.

Regards,

[dougwilson]

If you are getting a segmentation fault, the issue is in Node.js itself. Have you opened an issue over at Node.js? We can use try blocks all we want, but there is nothing we can do to catch a segfault issue.

[dougwilson]

You may very well be hitting this issue: nodejs/node-v0.x-archive#25648

[dougwilson]

Actually, most likely, if it has to do with TLS, you are probably hitting the bug nodejs/node-v0.x-archive#8780 which has been fixed in io.js, but not backported to Node.js 0.12. Can you verify if you can reproduce with the latest io.js?

[Drazke]

Hi,

The fact is that everything worked fine in nodejs v0.12.4. In the changelog, it said that they updated openssl in v0.12.6 and v0.12.7.

I try some new test without pool connection (on nodejs v 0.12.7), and the callback for connection.query are never called...

Here my example :

try {
var connection = mysql.createConnection({
    host     : 'host',
    user     : 'user',
    password : 'password',
    database : 'database',
    ssl      : {
        rejectUnauthorized: false,
        ca: fs.readFileSync('./ca-file')
    }
});
connection.query("SELECT * FROM TABLE", function(err, rows) {
    if (err)
        console.log(err);
    else
        console.log(rows);
});
} catch(err) {
    console.log(err);
}

I will try later with io.js.

[dougwilson]

Ah, I see. To me, if it worked, then they upgraded OpenSSL and now it doesn't, it sounds like Node.js may have had a regression in their code, no? Have you opened an issue with Node.js yet?

[dougwilson]

Ah, I see you did. Please let me know what they say :)

[Drazke]

Hi, I did some new test and this is what I got :

nodejs v0.12.4 --> OK
nodejs v0.12.5 --> NOK (Segfault)
nodejs v0.12.6 --> NOK (Segfault)
nodejs v0.12.7 --> NOK (Segfault)
iojs v2.2.1 --> OK
iojs v2.3.0 --> NOK (Segfault)
iojs v2.3.1 --> NOK (Segfault)
iojs v2.3.2 --> NOK (Handshake inactivity timeout, PROTOCOL_SEQUENCE_TIMEOUT)
iojs v2.3.3 --> NOK (Handshake inactivity timeout, PROTOCOL_SEQUENCE_TIMEOUT)
iojs v2.3.4 --> NOK (Handshake inactivity timeout, PROTOCOL_SEQUENCE_TIMEOUT)
iojs v2.4.0 --> NOK (Handshake inactivity timeout, PROTOCOL_SEQUENCE_TIMEOUT)

[dougwilson]

Thanks for the information :) would you be willing to make the same report using the mysql2 module as well, just to see if there is a difference? The API is identical, so you example code should work with only a change to the require.

[Drazke]

Here is the result with mysql2:

nodejs v0.12.4 --> OK
nodejs v0.12.5 --> NOK (SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small)
nodejs v0.12.6 --> NOK (SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small)
nodejs v0.12.7 --> NOK (SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small)
iojs v2.2.1 --> OK
iojs v2.3.0 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)
iojs v2.3.1 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)
iojs v2.3.2 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)
iojs v2.3.3 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)
iojs v2.3.4 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)
iojs v2.4.0 --> NOK (SSL routines:ssl3_check_cert_and_algorithm:dh key too small)

For every test, I have this log : "createCredentials() is deprecated, use tls.createSecureContext instead".

Here the whole log for the test with nodejs 0.12.7 and pool connection :

createCredentials() is deprecated, use tls.createSecureContext instead
events.js:85
      throw er; // Unhandled 'error' event
            ^
Error: 1074450592:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:../deps/openssl/openssl/ssl/s3_clnt.c:3366:

    at Error (native)
    at SlabBuffer.use (_tls_legacy.js:62:18)
    at CleartextStream.read [as _read] (_tls_legacy.js:280:29)
    at CleartextStream.Readable.read (_stream_readable.js:341:10)
    at EncryptedStream.write [as _write] (_tls_legacy.js:194:25)
    at doWrite (_stream_writable.js:301:12)
    at writeOrBuffer (_stream_writable.js:288:5)
    at EncryptedStream.Writable.write (_stream_writable.js:217:11)
    at Socket.ondata (_stream_readable.js:540:20)
    at Socket.emit (events.js:107:17)

[dougwilson]

So the thing is, both io.js and Node.js broke right on a release with an OpenSSL update, and the update includes the following note, which seems to play in with the errors from mysql2:

OpenSSL has added protection for TLS clients by rejecting handshakes
with DH parameters shorter than 768 bits.

This leads me to believe the reason I cannot reproduce your issue is because it may be related to your specific SSL configuration and private cert on your MySQL server combined with a change in behavior of OpenSSL in those releases. I'm not sure if we can do anything here, but since you can reproduce, if you can pit together a fix in our module (assuming it's not a Node.js or OpenSSL issue), that may be the only course of action from this point.

[dougwilson]

Hey @sidorares are you able to replicate this issue, by chance?

[Drazke]

Thank you for your answer.
I finally found out thanks to your hint that the problem is due to mysql-server which use 512 bit DH parameter in the source code (hardcoding) in version below 5.7.6.

I upgraded my mysql server to the latest version (v5.7.7-rc) and now everything work fine.
Tested with nodejs v0.12.7 and iojs v2.4.0 with both node-mysql2 and node-mysql.

Again, thank you for your time.

[sidorares]

thanks @Drazke , could not find time to test node-mysql2 myself