database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

ssl_cipher parameter cannot configure TLSv1.3 and TLSv1.2 ciphers at the same time

Browse Source 
SSL_CTX_set_ciphersuites() sets the TLSv1.3 cipher suites.

SSL_CTX_set_cipher_list() sets the ciphers for TLSv1.2 and below.

The current TLS configuration logic will not perform SSL_CTX_set_cipher_list()
to configure TLSv1.2 ciphers if the call to SSL_CTX_set_ciphersuites() was
successful. The call to SSL_CTX_set_ciphersuites() is successful if any TLSv1.3
cipher suite is passed into `--ssl-cipher`.

This is a potential security vulnerability because users trying to restrict
specific secure ciphers for TLSv1.3 and TLSv1.2, would unknowingly still have
the database support insecure TLSv1.2 ciphers.

For example:
If setting `--ssl_cipher=TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256`,
the database would still support all possible TLSv1.2 ciphers rather than only
ECDHE-RSA-AES128-GCM-SHA256.

The solution is to execute both SSL_CTX_set_ciphersuites() and
SSL_CTX_set_cipher_list() even if the first call succeeds.

This allows the configuration of exactly which TLSv1.3 and TLSv1.2 ciphers to
support.

Note that there is 1 behavior change with this. When specifying only TLSv1.3
ciphers to `--ssl-cipher`, the database will not support any TLSv1.2 cipher.
However, this does not impose a security risk and considering TLSv1.3 is the
modern protocol, this behavior should be fine.

All TLSv1.3 ciphers are still supported if only TLSv1.2 ciphers are specified
through `--ssl-cipher`.

All new code of the whole pull request, including one or several files that are
either new files or modified ones, are contributed under the BSD-new license. I
am contributing on behalf of my employer Amazon Web Services, Inc.
This commit is contained in:
Tony Chen
2024-09-04 00:58:59 +00:00
committed by Vladislav Vaintroub
parent 9f61aa4f8a
commit be164fc401
5 changed files with 87 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
mysql-test/suite.pm
View File

@ -71,6 +71,9 @@ sub skip_combinations {
$skip{'main/ssl_7937.combinations'} = [ 'x509v3' ]
unless $ssl_lib =~ /WolfSSL/ or $openssl_ver ge "1.0.2";
$skip{'main/tlsv13.test'} = 'does not work with OpenSSL <= 1.1.1'
unless $ssl_lib =~ /WolfSSL/ or $openssl_ver ge "3.0.0";
$skip{'main/ssl_verify_ip.test'} = 'x509v3 support required'
unless $openssl_ver ge "1.0.2";