database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-26015 ssl: remove insecure fixed DH params (mostly unused)- #5639

Browse Source 
WolfSSL code path already operates without fixed DH parameters. OpenSSL code path still sets fixed static precomputed DH params, which is now prohibited by IETF.

Also OPENSSL_init_ssl is not required since OpenSSL 1.1.0, for over 10 years now. Also cleaned up at the same time.

https://www.rfc-editor.org/rfc/rfc10015.html#section-2:
> Clients MUST NOT offer and servers MUST NOT select non-ephemeral FFDH cipher suites in (D)TLS 1.2 connections.

https://www.rfc-editor.org/rfc/rfc10015.html#section-3:
> Clients MUST NOT offer and servers MUST NOT select FFDHE cipher suites in (D)TLS 1.2 connections.

And the depreciated tables include all ciphersuites that can use SSL_CTX_set_tmp_dh as part of the connection.

Also for a very long time OpenSSL was handling these automatically anyway, back when DHE was still recommended.
This commit is contained in:
Dimitri John Ledkov
2026-09-06 21:08:47 +00:00
committed by Daniel Black
parent bfabe0e530
commit 02c842c30d
3 changed files with 0 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/violite.h
View File

@@ -174,8 +174,6 @@ struct st_VioSSLFd
int sslaccept(struct st_VioSSLFd*, Vio *, long timeout, unsigned long *errptr);
int sslconnect(struct st_VioSSLFd*, Vio *, long timeout, unsigned long *errptr);
void vio_check_ssl_init();
struct st_VioSSLFd
*new_VioSSLConnectorFd(const char *key_file, const char *cert_file,
const char *ca_file, const char *ca_path,

2
sql/encryption.cc
View File

@@ -65,8 +65,6 @@ int initialize_encryption_plugin(void *plugin_)
if (encryption_manager)
return 1;
vio_check_ssl_init();
if (plugin->plugin->init && plugin->plugin->init(plugin))
{
sql_print_error("Plugin '%s' init function returned error.",

90
vio/viosslfactories.c
View File

@@ -21,67 +21,11 @@
#include <string.h>
#ifdef HAVE_OPENSSL
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/x509.h>
static my_bool ssl_algorithms_added = FALSE;
static my_bool ssl_error_strings_loaded= FALSE;
#ifndef X509_VERSION_3
#define X509_VERSION_3 2
#endif
/* the function below was generated with "openssl dhparam -2 -C 2048" */
#ifndef HAVE_WOLFSSL
static
DH *get_dh2048()
{
static unsigned char dhp_2048[] = {
0xA1,0xBB,0x7C,0x20,0xC5,0x5B,0xC0,0x7B,0x21,0x8B,0xD6,0xA8,
0x15,0xFC,0x3B,0xBA,0xAB,0x9F,0xDF,0x68,0xC4,0x79,0x78,0x0D,
0xC1,0x12,0x64,0xE4,0x15,0xC9,0x66,0xDB,0xF6,0xCB,0xB3,0x39,
0x02,0x5B,0x78,0x62,0xFB,0x09,0xAE,0x09,0x6B,0xDD,0xD4,0x5D,
0x97,0xBC,0xDC,0x7F,0xE6,0xD6,0xF1,0xCB,0xF5,0xEB,0xDA,0xA7,
0x2E,0x5A,0x43,0x2B,0xE9,0x40,0xE2,0x85,0x00,0x1C,0xC0,0x0A,
0x98,0x77,0xA9,0x31,0xDE,0x0B,0x75,0x4D,0x1E,0x1F,0x16,0x83,
0xCA,0xDE,0xBD,0x21,0xFC,0xC1,0x82,0x37,0x36,0x33,0x0B,0x66,
0x06,0x3C,0xF3,0xAF,0x21,0x57,0x57,0x80,0xF6,0x94,0x1B,0xA9,
0xD4,0xF6,0x8F,0x18,0x62,0x0E,0xC4,0x22,0xF9,0x5B,0x62,0xCC,
0x3F,0x19,0x95,0xCF,0x4B,0x00,0xA6,0x6C,0x0B,0xAF,0x9F,0xD5,
0xFA,0x3D,0x6D,0xDA,0x30,0x83,0x07,0x91,0xAC,0x15,0xFF,0x8F,
0x59,0x54,0xEA,0x25,0xBC,0x4E,0xEB,0x6A,0x54,0xDF,0x75,0x09,
0x72,0x0F,0xEF,0x23,0x70,0xE0,0xA8,0x04,0xEA,0xFF,0x90,0x54,
0xCD,0x84,0x18,0xC0,0x75,0x91,0x99,0x0F,0xA1,0x78,0x0C,0x07,
0xB7,0xC5,0xDE,0x55,0x06,0x7B,0x95,0x68,0x2C,0x33,0x39,0xBC,
0x2C,0xD0,0x6D,0xDD,0xFA,0xDC,0xB5,0x8F,0x82,0x39,0xF8,0x67,
0x44,0xF1,0xD8,0xF7,0x78,0x11,0x9A,0x77,0x9B,0x53,0x47,0xD6,
0x2B,0x5D,0x67,0xB8,0xB7,0xBC,0xC1,0xD7,0x79,0x62,0x15,0xC2,
0xC5,0x83,0x97,0xA7,0xF8,0xB4,0x9C,0xF6,0x8F,0x9A,0xC7,0xDA,
0x1B,0xBB,0x87,0x07,0xA7,0x71,0xAD,0xB2,0x8A,0x50,0xF8,0x26,
0x12,0xB7,0x3E,0x0B,
};
static unsigned char dhg_2048[] = {
0x02
};
DH *dh = DH_new();
BIGNUM *dhp_bn, *dhg_bn;
if (dh == NULL)
return NULL;
dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
if (dhp_bn == NULL || dhg_bn == NULL
|| !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
DH_free(dh);
BN_free(dhp_bn);
BN_free(dhg_bn);
return NULL;
}
return dh;
}
#endif
static const char*
ssl_error_string[] =
{
@@ -236,22 +180,6 @@ vio_set_cert_stuff(SSL_CTX *ctx, const char *cert_file, const char *key_file,
DBUG_RETURN(0);
}
void vio_check_ssl_init()
{
if (!ssl_algorithms_added)
{
ssl_algorithms_added= TRUE;
OPENSSL_init_ssl(0, NULL);
}
if (!ssl_error_strings_loaded)
{
ssl_error_strings_loaded= TRUE;
SSL_load_error_strings();
}
}
#ifdef HAVE_WOLFSSL
static int wolfssl_recv(WOLFSSL* ssl, char* buf, int sz, void* vio)
{
@@ -458,8 +386,6 @@ new_VioSSLFd(const char *key_file, const char *cert_file, const char *ca_file,
"cipher: '%s' crl_file: '%s' crl_path: '%s'", key_file,
cert_file, ca_file, ca_path, cipher, crl_file, crl_path));
vio_check_ssl_init();
if (!(ssl_fd= ((struct st_VioSSLFd*)
my_malloc(key_memory_vio_ssl_fd,
sizeof(struct st_VioSSLFd), MYF(0)))))
@@ -562,22 +488,6 @@ new_VioSSLFd(const char *key_file, const char *cert_file, const char *ca_file,
goto err2;
}
#ifndef HAVE_WOLFSSL
/* DH stuff */
if (!is_client_method)
{
DH *dh= get_dh2048();
if (!SSL_CTX_set_tmp_dh(ssl_fd->ssl_context, dh))
{
*error= SSL_INITERR_DH;
DH_free(dh);
goto err2;
}
DH_free(dh);
}
#endif
#ifdef HAVE_WOLFSSL
/* set IO functions used by wolfSSL */
wolfSSL_SetIORecv(ssl_fd->ssl_context, wolfssl_recv);