[MDEV-19278] TLS cipher is not negotiated correctly in REQUIRE CIPHER Created: 2019-04-18  Updated: 2022-01-08  Resolved: 2022-01-08

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System, Documentation, SSL
Affects Version/s: 10.3.14
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Thomas Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None
Environment:

RHEL/CentOS 7.6.1810

Attachments: File odbc-test-ciphers.php     HTML File openssl-1.0.2k.html     HTML File openssl-1.1.1f.html    

 Description   

When you use a cipher string in create/alter user with REQUIRE like described here
https://mariadb.com/kb/en/library/create-user/ and here
https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/
this doesn't resolve on connect. So if you use REQUIRE CIPHER 'TLSv1.2' for instance and then you connect through an application with a "real cipher" MariaDB throws an error expecting the string which is written in REQUIRE CIPHER and not an actual cipher. This cannot be correct behavior.
The cipher used is a cipher out of TLSv1.2 of course. The end is you cannot authenticate and use the connection then.

[Note] X509 ciphers mismatch: should be 'TLSv1.2' but is 'DHE-RSA-AES256-GCM-SHA384'

 Comments   
Comment by Thomas [ 2019-04-18 ]

To be honest there seems to be a lot going wrong regarding TLS connections/handshakes under the hood. After doing some more investigation, e.g. this is not possible, too.
in my.cnf

ssl_cert="/etc/ssl/certs/mysql.pem"
 
ssl_key="/etc/ssl/certs/mysql.pem"
 
ssl_ca="/etc/ssl/certs/ca-bundle.crt"
 
ssl_cipher="TLSv1.2"

Then you can connect with a client, does not matter if command line or not. with using ssl. But you cannot connect with for instance ECDHE-RSA-AES256-GCM-SHA384, the really only cipher which is accepted is DHE-RSA-AES256-GCM-SHA384, from command line and from other cllients. Other ciphers generate handshake errors. EDIT : This is not true, you can use DHE ciphers not just the one mentioned but for instance no ECDHE ciphers at all EDIT OFF. Although the ciphers are in the cipher list. 

show status like '%ssl%';
 
+--------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 
| Variable_name                  | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 
+--------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 
| Com_show_processlist           | 0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
| Ssl_accept_renegotiates        | 0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
| Ssl_accepts                    | 15                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 
| Ssl_callback_cache_hits        | 0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
| Ssl_cipher                     | DHE-RSA-AES256-GCM-SHA384                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
| Ssl_cipher_list                | ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:ADH-AES256-GCM-SHA384:ADH-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DH-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:ADH-AES128-GCM-SHA256:ADH-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256:NULL-SHA256 |

Comment by Sergei Golubchik [ 2019-04-19 ]

How did you create the user that you cannot connect to, what does SHOW CREATE USER show?

Comment by Thomas [ 2019-04-19 ]

First of all the second problem in my comment is not user dependent at all, it is a global problem.

You simply cannot connect with ECDHE ciphers for instance, also as root

[root@ms1 ~]# mysql --ssl --ssl-cipher="ECDHE-RSA-AES256-GCM-SHA384"
 
ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
 
 
 
[root@ms1 ~]# mysql --ssl --ssl-cipher="DHE-RSA-AES256-GCM-SHA384"
 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
 
Your MariaDB connection id is 19
 
Server version: 10.3.14-MariaDB-log MariaDB Server
 
 
 
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 
 
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
 
 
MariaDB [(none)]>
 
 
 
------------------------------------------------------------------------------------------------------------------------------------------------------------
 
To the original problem with the user
 
MariaDB [(none)]> show create user;
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+
 
| CREATE USER for vmail@localhost                                                                                                               |
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+
 
| CREATE USER 'vmail'@'localhost' IDENTIFIED BY PASSWORD '<pwd>' REQUIRE CIPHER 'TLSv1.2' |
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+
 
 
while this works
 
MariaDB [(none)]> show create user;
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+
 
| CREATE USER for vmail@localhost                                                                                                               |
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+
 
| CREATE USER 'vmail'@'localhost' IDENTIFIED BY PASSWORD '<pwd>' REQUIRE CIPHER 'DHE-RSA-AES256-GCM-SHA384' |
 
+-----------------------------------------------------------------------------------------------------------------------------------------------+

but also only with DHE ciphers

Comment by Hartmut Holzgraefe [ 2021-09-14 ]

It seems to be a platform specific problem, or more precise: a SSL library version related one.

When trying ECDHE-RSA-AES256-GCM-SHA384 with MariaDB 10.5 server and client both on Ubuntu 20.04 "Focal", which comes with OpenSSL 1.1.1f, it works fine with TLSv1.2 (but picks TLS_AES_256_GCM_SHA384 when requesting/enforcing TLSv1.3, which is OK according to te TLSv1.3 standard).

But when trying to connect with an equally configured 10.5 installation on CentOS 7, which still uses OpenSSL 1.0.2k-fips, I'm getting

ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure

So we have two problems here:

1) With OpenSSL 1.0.2k none of the ECDHE-* ciphers actually work. With OpenSSL 1.1.1f ECDHE-RSA-* ciphers work, but ECDHE-ECDSA-* and ECDHE-PSK-* ones still fail.

2) The list of ciphers reported in the Ssl_cipher_list status variable is not correct, it is not possible to connect using all of the ciphers listed there. OpenSSL seems to report the list of ciphers it has support for in general here, not the list of ciphers that will actually work with the current library version, server code, and server configuration.

For my current tests I used:

  • the cacert.pem, cakey.pem, server-cert.pem, server-key.pem, client-cert.pem and client-key.pem files from the MariaDB 10.5 mysql-test/std_data directory
  • default configuration, plus the following for enabling TLS:

[mysqld]
 
# allow remote connections
 
bind_address=0.0.0.0
 
 
 
# TLS cert setup using files copied from server test dir
 
ssl
 
ssl-ca=/etc/mysql/ssl/cacert.pem
 
ssl-key=/etc/mysql/ssl/server-key.pem
 
ssl-cert=/etc/mysql/ssl/server-cert.pem
 
 
 
# raised this for testing as tests cause connect errors a lot
 
max_connect_errors=1000000

For testing I invoke the client as

mysql --user=... --password=... --host=... --ssl --ssl-ca=/etc/mysql/ssl/cacert.pem --tls-version=... --ssl-cipher=...

iterating over all TLS versions and SSL ciphers the given server reports as supported according to the tls_version config variable and the ssl_cipher_list status variabe, retrieving those values right before performing the actual test iteration loops.

The client binary used was always the one installed on Ubuntu, using OpenSSL 1.1.1f

I processed the various connection results/errors and created two HTML summaries from thee, one with the Server using OpenSSL 1.1.1f, the other with the server using the older 1.0.2k. Red cells show errors, yellow cells show the server picking a different cipher, or the default one if none was given, green cells show that the cipher the client and server agreed on was the same that the client explicitly requested.

openssl-1.0.2k.html openssl-1.1.1f.html

Comment by Hartmut Holzgraefe [ 2021-09-14 ]

For

"2) The list of ciphers reported in the Ssl_cipher_list status variable is not correct, it is not possible to connect using all of the ciphers listed there."

I'm going to report a different MDEV ...

Comment by Hartmut Holzgraefe [ 2021-09-14 ]

I'm also considering to extend my test script for this a bit more so that it does a tcpdump capture for each of the connection attempts, and to run tests with YaSSL/WolfSSL based servers and clients, and Windows SChannel based clients, too, to get a full picture of actually supported ciphers ...

Comment by Hartmut Holzgraefe [ 2021-09-27 ]

attached my odbc-test-ciphers.php test script

Comment by Sergei Golubchik [ 2022-01-08 ]

Back to the original bug report, ECDHE aside, it's an error in how REQUIRE CIPHER is documented in the KB.

Revision https://mariadb.com/kb/en/create-user/+r/77357/ was still correct, saying

Specifies that a specific cipher method is used for encrypting connections.

Revision https://mariadb.com/kb/en/create-user/+r/77358/ is the first wrong one, saying

Also, the encryption used for the connection must use one of the methods specified in the string cipher.

But it still had the correct example with CIPHER 'SHA-DES-CBC3-EDH-RSA'.

And then a revision https://mariadb.com/kb/en/create-user/+r/81279/ changed the example to CIPHER 'TLSv1.2' that never worked or was supposed to be working.

The manual is now fixed, thanks.

Generated at Thu Feb 08 08:50:24 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.