[CONJ-249] Does not support TLSv1.2 Created: 2016-01-24  Updated: 2016-06-20  Resolved: 2016-06-20

Status: Closed
Project: MariaDB Connector/J
Component/s: Other
Affects Version/s: None
Fix Version/s: 1.5.0-RC

Type: Bug Priority: Critical
Reporter: Rich Theobald Assignee: Diego Dupin
Resolution: Fixed Votes: 2
Labels: None

Sub-Tasks:
Key
 Summary
 Type
 Status
 Assignee
CONJ-301 Option needed to set enabled Cipher s... Sub-Task Closed Diego Dupin  

 Description   

Checking the source code, I see that the only protocol enabled is TLSv1.

My tests trying to connect to a MariaDB Galera Server 10.0.21 with ssl-cipher = TLSv1.2 confirm this. Please see attached JAVA log.



 Comments   
Comment by Rich Theobald [ 2016-01-24 ] 

2016-01-24T10:38:12.36+0000 [App/0]      OUT SSLv3 protocol was requested but was not enabled
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Is initial handshake: true
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Is initial handshake: true
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_256_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_256_CBC_SHA384
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_256_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_256_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_CBC_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.36+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_256_GCM_SHA384
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_GCM_SHA256
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT %% No cached client session
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT *** ClientHello, TLSv1
 
2016-01-24T10:38:12.37+0000 [App/0]      OUT RandomCookie:  
2016-01-24T10:38:12.37+0000 [App/0]      OUT GMT: 1436788884 
2016-01-24T10:38:12.37+0000 [App/0]      OUT bytes = { 
...
 
2016-01-24T10:38:12.39+0000 [App/0]      OUT  }
 
2016-01-24T10:38:12.39+0000 [App/0]      OUT Session ID:  
2016-01-24T10:38:12.40+0000 [App/0]      OUT {}
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Cipher Suites: [TLS_EMPTY_RENEGOTIATION_INFO_SCSV, SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_AES_128_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA]
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Compression Methods:  { 
2016-01-24T10:38:12.40+0000 [App/0]      OUT 0
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT  }
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Extension elliptic_curves, curve names: {secp256r1, secp192r1, secp224r1, secp384r1, secp521r1, secp160k1, secp160r1, secp160r2, secp192k1, secp224k1, secp256k1}
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Extension ec_point_formats, formats: [uncompressed]
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT ***
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT [write] MD5 and SHA1 hashes:  len = 123
 
...
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Default Executor-thread-486, WRITE: TLSv1 Handshake, length = 123
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT [Raw write]: length = 128
 
...
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT [Raw read]: length = 5
 
..                                    .....
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT [Raw read]: length = 2
 
...                                            ..
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Default Executor-thread-486, READ: TLSv1 Alert, length = 2
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT Default Executor-thread-486
 
2016-01-24T10:38:12.40+0000 [App/0]      OUT , RECV TLSv1.2 ALERT:  
2016-01-24T10:38:12.41+0000 [App/0]      OUT fatal, 
2016-01-24T10:38:12.41+0000 [App/0]      OUT handshake_failure
 
2016-01-24T10:38:12.41+0000 [App/0]      OUT Default Executor-thread-486, called closeSocket()
 
2016-01-24T10:38:12.41+0000 [App/0]      OUT Default Executor-thread-486, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR [ERROR   ] SRVE0777E: Exception thrown by application class 'org.springframework.web.servlet.FrameworkServlet.processRequest:948'
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:948)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:838)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:812)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1287)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at [internal classes]
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR Caused by: org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.getConnection(DataSourceUtils.java:80)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:1007)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.jdbc.core.JdbcTemplate.call(JdbcTemplate.java:1070)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at 
...
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at java.lang.reflect.Method.invoke(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.bind.annotation.support.HandlerMethodInvoker.invokeHandlerMethod(HandlerMethodInvoker.java:176)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:440)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:428)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:925)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:856)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:936)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	... 6 more
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR Caused by: java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2294)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createDataSource(BasicDataSource.java:2039)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.getConnection(BasicDataSource.java:1533)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.doGetConnection(DataSourceUtils.java:111)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.getConnection(DataSourceUtils.java:77)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	... 25 more
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR Caused by: java.sql.SQLNonTransientConnectionException: Could not connect to x:y: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.SQLExceptionMapper.get(SQLExceptionMapper.java:136)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.SQLExceptionMapper.throwException(SQLExceptionMapper.java:106)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.Driver.connect(Driver.java:114)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:39)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:256)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.validateConnectionFactory(BasicDataSource.java:2304)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2290)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	... 29 more
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR Caused by: org.mariadb.jdbc.internal.common.QueryException: Could not connect to x:y: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:513)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:673)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.<init>(MySQLProtocol.java:266)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.Driver.connect(Driver.java:110)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	... 33 more
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.j.a(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.j.a(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.as.b(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.as.a(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.as.i(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.as.a(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at com.ibm.jsse2.as.startHandshake(Unknown Source)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:444)
 
2016-01-24T10:38:12.44+0000 [App/0]      ERR 	... 36 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR [ERROR   ] SRVE0315E: An exception occurred: java.lang.Throwable: org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4900)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at [internal classes]
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:948)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:838)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:812)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1287)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 1 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.getConnection(DataSourceUtils.java:80)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:1007)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.jdbc.core.JdbcTemplate.call(JdbcTemplate.java:1070)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at 
...
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at java.lang.reflect.Method.invoke(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.bind.annotation.support.HandlerMethodInvoker.invokeHandlerMethod(HandlerMethodInvoker.java:176)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:440)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:428)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:925)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:856)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:936)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 6 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: java.sql.SQLException: Cannot create PoolableConnectionFactory (Could not connect to x:y: Received fatal alert: handshake_failure)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2294)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createDataSource(BasicDataSource.java:2039)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.getConnection(BasicDataSource.java:1533)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.doGetConnection(DataSourceUtils.java:111)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.springframework.jdbc.datasource.DataSourceUtils.getConnection(DataSourceUtils.java:77)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 25 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: java.sql.SQLNonTransientConnectionException: Could not connect to x:y: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.SQLExceptionMapper.get(SQLExceptionMapper.java:136)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.SQLExceptionMapper.throwException(SQLExceptionMapper.java:106)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.Driver.connect(Driver.java:114)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:39)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:256)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.validateConnectionFactory(BasicDataSource.java:2304)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.apache.commons.dbcp2.BasicDataSource.createPoolableConnectionFactory(BasicDataSource.java:2290)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 29 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: org.mariadb.jdbc.internal.common.QueryException: Could not connect to x:y: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:513)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:673)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.<init>(MySQLProtocol.java:266)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.Driver.connect(Driver.java:110)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 33 more
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.j.a(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.j.a(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.as.b(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.as.a(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.as.i(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.as.a(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at com.ibm.jsse2.as.startHandshake(Unknown Source)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	at org.mariadb.jdbc.internal.mysql.MySQLProtocol.connect(MySQLProtocol.java:444)
 
2016-01-24T10:38:12.47+0000 [App/0]      ERR 	... 36 more
 
2016-01-24T10:38:12.51+0000 [App/0]      OUT Finalizer thread, called close()
 
2016-01-24T10:38:12.52+0000 [App/0]      OUT Finalizer thread, called closeInternal(true)

Comment by Rich Theobald [ 2016-01-24 ]

From this code snippet from https://github.com/MariaDB/mariadb-connector-j/blob/d6581e89d9c686bf7a01ec72005ef0653da5bd88/src/main/java/org/mariadb/jdbc/internal/protocol/AbstractConnectProtocol.java, it looks to me that only TLSv1 is supported: 

   private void handleConnectionPhases() throws QueryException {
 
        InputStream reader = null;
 
        try {
 
            reader = new BufferedInputStream(socket.getInputStream(), 32768);
 
            packetFetcher = new ReadPacketFetcher(reader);
 
            writer = new PacketOutputStream(socket.getOutputStream());
 
 
 
            final ReadInitialConnectPacket greetingPacket = new ReadInitialConnectPacket(packetFetcher);
 
            this.serverThreadId = greetingPacket.getServerThreadId();
 
            this.serverLanguage = greetingPacket.getServerLanguage();
 
            this.charset = CharsetUtils.getServerCharset(serverLanguage);
 
            this.version = greetingPacket.getServerVersion();
 
            parseVersion();
 
            int clientCapabilities = initializeClientCapabilities();
 
 
 
            byte packetSeq = 1;
 
            if (urlParser.getOptions().useSsl && (greetingPacket.getServerCapabilities() & MariaDbServerCapabilities.SSL) != 0) {
 
                clientCapabilities |= MariaDbServerCapabilities.SSL;
 
                SendSslConnectionRequestPacket amcap = new SendSslConnectionRequestPacket(clientCapabilities);
 
                amcap.send(writer);
 
 
 
                SSLSocketFactory sslSocketFactory = getSslSocketFactory();
 
                SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(socket,
 
                        socket.getInetAddress().getHostAddress(), socket.getPort(), true);
 
 
 
                sslSocket.setEnabledProtocols(new String[]{"TLSv1"});
 
                sslSocket.setUseClientMode(true);
 
                sslSocket.startHandshake();
 
                socket = sslSocket;
 
                writer = new PacketOutputStream(socket.getOutputStream());
 
                reader = new BufferedInputStream(socket.getInputStream(), 32768);
 
                packetFetcher = new ReadPacketFetcher(reader);
 
 
 
                packetSeq++;
 
            } else if (urlParser.getOptions().useSsl) {
 
                throw new QueryException("Trying to connect with ssl, but ssl not enabled in the server");
 
            }
 
 

Comment by Kasra Rasaee [ 2016-06-06 ]

I submitted a quick fix passing TLSv1.2 as an enabled protocol simply by checking the version returned from the server and determining whether it supports TLSv1.2... github pull request checks out and tests were successful.

0. If MariaDB && version is >= 10.0.15 || MariaDB && major_version != 10 && version >= 5.5.41 then return "TLSv1.2", "TLSv1.1" and "TLSv1.0"

1. For MySQL >= 5.7.10 the documentation suggests support for TLSv1.2 – however, the packaged binaries are usually compiled with yaSSL which only support "TLSv1" and "TLSv1.1". As a result, a temporary workaround is to set "TLSv1" and "TLSv1.1" for MySQL is >= 5.7.10. This is such that SSL handshake does not break (when TLSv1.2 is passed – InputRecord#readV3Record ProtocolVersion returns Unknown-0-0 and does not downgrade protocol to TLSv1.1).

2. There should be a more efficient mechanism/strategy to negotiate highest protocol (even with older MySQL / MariaDB versions), example: perhaps via a "exception-retry-negotiate-lower-tlsversion-cache-decision" strategy; or, allowing the SSLSocket do it on it own, not so sure about the latter.

3. Alternatively, does the connection have information on supported protocols via capabilities attributes or ssl connection itself? it appears that SSLSocket#getSupportedProtocols() when connected to MySQL returns everything, despite database server tls_version returning only "TLSv1" and "TLSv1.1" (see below copied from debugger on sslSocket in AbstractConnectProtocol):

  • 0 = "SSLv2Hello"
  • 1 = "SSLv3"
  • 2 = "TLSv1"
  • 3 = "TLSv1.1"
  • 4 = "TLSv1.2"

Suggestion? I'll code it.

Comment by Diego Dupin [ 2016-06-07 ]

Hi Rich,

Better to avoid forcing the enabled protocol : use default java enabled protocol (driver require jre >= 1.7).
So SSL3 will be active too, and that would avoid breaking old server SSL configuration.
Server will tell which version to use.
(I just need to verify how default protocol is handled, long time not seen SSL protocol -> java 7 default to TLS1.0 )

Remain the server compiled with yaSSL. There will be an exception "Unknown-0-0"
I see 2 solutions :

  • Assisted version : let client send this TLS1.2 handshake, catch the exception if there is and retry with TLS1.1, throwing the TLS1.2 exception if TLS1.1 handshake failed too.
  • Just throw the exception, and document it. Add a new option enabledSSLProtocolSuites that will list permitted protocol. (i.e. force socket.setEnabledProtocols() )

I'll ask other connector guy's point of view about that, and come back to you today.

Comment by Diego Dupin [ 2016-06-07 ]

forget first message, this isn't an effective solution.

Your pull request is just fine.

  • Driver java minimum version is 1.7, so testing java version is not needed.
  • adding "exception-retry-negotiate-lower-tlsversion-cache-decision" additional implementation would be great, that would permit to avoid the yaSSL compilation problems : Let client send the TLS1.2 handshake, catch the exception if there is and retry without the TLS1.2 protocol (so use TLS1.1).
  • Adding an additional option enabledSSLProtocolSuites would permit to force some protocol if needed, and avoid the renegociate part.
Comment by Kasra Rasaee [ 2016-06-07 ]

I'll remove the Java >= 1.7 dependency on the next pull request.

As for the TLS strategy

  • I suspect the simplest approach would be to add the enabledSSLProtocolSuites as you suggested.
  • I did a quick test to see how easy it would be to implement the retry strategy and it was not as simple as popping off a Stack<String>, additionally I would think that this approach would also confuse some users.

Implement solution?
If you are ok with the enabledSSLProtocolSuites approach I'll go ahead and implement it ideally before the 1.4.6 release, it is the quickest, cleanest approach and lowest risk of the two solutions. (Note: if null then default value = as implemented in my previous post: choose based on version MariaDB >= 10.0.15 = TLSv1.2 and !10 && 5.5.41 = TLSv1.2, when MySQL >= 5.7.10 = TLSv1.1)

Thanks.

Comment by Diego Dupin [ 2016-06-07 ]

Hi,
After discussion with server guys, best to activate only "TLSv1", "TLSv1.1" by default.
catching exception and relaunch will increase server failure stats without good reasons.
TLSv1.2 has to be enabled only if parameter is set ( a new parameter )

Thanks for implementing it !

Comment by Kasra Rasaee [ 2016-06-07 ]

OK I'll add in the extra parameter as suggested..

Note however, default value for MariaDB only versions >= 10.0.15 || (version != 10 && >= 5.5.41) should it remain as TLSv1.2 since we know that those versions will work and are compiled with OpenSSL NOT yaSSL?

I'll start the implementation later today/tomorrow after I get a response.

Comment by Diego Dupin [ 2016-06-07 ]

Excellent!
MySQL Community Edition binary distributions are compiled using yaSSL, even after 5.5.41, (entreprise edition with openSSL).
Mariadb on windows is using yaSSL.
(And it seems some people even prefer compile mariadb with yaSSL since the openSSL heartbleed problem)

... So, better to avoid testing versions.

Comment by Kasra Rasaee [ 2016-06-10 ]

Diego, I have checked in the code pertaining to "enabledSslProtocolSuites" and travis builds/tests check out – please let me know if any changes are required and if we can have it merged into 1.4.6 release.

Comment by Kasra Rasaee [ 2016-06-10 ]

Also may want to update the site documentation to reflect the new parameter/attribute.

Comment by Diego Dupin [ 2016-06-20 ]

krasaee,
Your PR84 is merged in 1.5 branch, with additional implementation so support CONJ-301, and testing against server 10.2 version.

Generated at Thu Feb 08 03:14:16 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.