Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-6975

Implement TLS protocol

        Details

        • Type: Task
        • Status: Closed
        • Priority: Major
        • Resolution: Fixed
        • Fix Version/s: 10.0.15, 5.5.41
        • Component/s: SSL
        • Labels:
          None

          Description

          Support for TLS protocols may well be there, but it is not documented; if present, it has no options to control it.

          Currently MariaDB claims to support SSLv3. We would like to move away from SSLv3 due to the POODLE vulnerability.

          In testing, MariaDB client/server currently cannot connect using any of the TLS protocols. Testing was performed on MariaDB 5.5.32-1 on CentOS 6.x x86_64, compiled against OpenSSL.

          We used the technique of trying ciphers that are not supported in SSLv2 or SSLv3, which leaves the TLS 1.x ciphers - http://www.percona.com/blog/2014/10/15/how-to-close-poodle-sslv3-security-flaw-cve-2014-3566/ . All connections failed with "ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)".

          Ideally, MariaDB should have...

          • a configuration value to disable SSLv2/v3
          • a clear statement of which TLS protocol variants are known to work (perhaps qualified by SSL library used – with yaSSL, with OpenSSL...)

          thank you!

            Gliffy Diagrams

              Attachments

                Issue Links

                relates to

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7547 Include TLS tests in the test suite

                • Major - Major loss of function.
                • Closed
                links to

                Web Link MySQL Bug #75239

                  Activity

                  Ascending order - Click to sort in descending order
                  8 older comments
                  Hide
                  Permalink
                  martin.langhoff Martin Langhoff added a comment -

                  Great to hear. At my end, given that MariaDB does not support SSLv3, but only TLSv1, a docs update indicating so would be satisfactory.

                  Unlocking support for newer versions of TLS is of course a good outcome too.

                  Show
                  martin.langhoff Martin Langhoff added a comment - Great to hear. At my end, given that MariaDB does not support SSLv3, but only TLSv1, a docs update indicating so would be satisfactory. Unlocking support for newer versions of TLS is of course a good outcome too.
                  Hide
                  Permalink
                  thoger Tomas Hoger added a comment -

                  If users should be able to disable specific TLS protocol versions, there will need to be a separate configuration option for that (similar to httpd's SSLProtocol or nginx's ssl_protocols). Cipher string in general can not do that. Examples:

                  • In the past, you could use 'DEFAULT:!SSLv2' to practically disable SSLv2 and leave SSLv3 and TLSv1 enabled, because SSLv2 ciphers were noted used by SSLv3 or later.
                  • However, the similar 'DEFAULT:!SSLv3' can not be used to disable SSLv3 and only enable TLSv1.0 and later.
                  • Users may also ask for a way to disable TLSv1.0 and only enable 1.1 or later because of BEAST. The 'DEFAULT:!SSLv3' somewhat does the trick, but it only enables ciphers new in TLS 1.2.

                  There may be a little immediate need now, but it seems to be the way to go long term.

                  Show
                  thoger Tomas Hoger added a comment - If users should be able to disable specific TLS protocol versions, there will need to be a separate configuration option for that (similar to httpd's SSLProtocol or nginx's ssl_protocols). Cipher string in general can not do that. Examples: In the past, you could use 'DEFAULT:!SSLv2' to practically disable SSLv2 and leave SSLv3 and TLSv1 enabled, because SSLv2 ciphers were noted used by SSLv3 or later. However, the similar 'DEFAULT:!SSLv3' can not be used to disable SSLv3 and only enable TLSv1.0 and later. Users may also ask for a way to disable TLSv1.0 and only enable 1.1 or later because of BEAST. The 'DEFAULT:!SSLv3' somewhat does the trick, but it only enables ciphers new in TLS 1.2. There may be a little immediate need now, but it seems to be the way to go long term.
                  Hide
                  Permalink
                  thoger Tomas Hoger added a comment -

                  A simple test program that attempts to establish TLS connection with MySQL / MariaDB and prints TLS session information similar to what's printed by openssl s_client.

                  Show
                  thoger Tomas Hoger added a comment - A simple test program that attempts to establish TLS connection with MySQL / MariaDB and prints TLS session information similar to what's printed by openssl s_client.
                  Hide
                  Permalink
                  thoger Tomas Hoger added a comment -

                  For posterity, this commit now disables SSLv2 and SSLv3 as discussed above:

                  http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/4369

                  Thank you!

                  Show
                  thoger Tomas Hoger added a comment - For posterity, this commit now disables SSLv2 and SSLv3 as discussed above: http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/4369 Thank you!
                  Hide
                  Permalink
                  dveeden Daniël van Eeden added a comment -

                  Related bug for Support for TLSv1.1 and TLSv1.2 in MySQL

                  Show
                  dveeden Daniël van Eeden added a comment - Related bug for Support for TLSv1.1 and TLSv1.2 in MySQL

                    People

                    • Assignee:
                      serg Sergei Golubchik
                      Reporter:
                      martin.langhoff Martin Langhoff
                    • Votes:
                      0 Vote for this issue
                      Watchers:
                      5 Start watching this issue

                      Dates

                      • Created:
                        Updated:
                        Resolved:

                        Time Tracking

                        Estimated:
                        Original Estimate - Not Specified
                        Not Specified
                        Remaining:
                        Remaining Estimate - 0 minutes
                        0m
                        Logged:
                        Time Spent - 2 hours, 23 minutes
                        2h 23m