MySQLSSLissues

From the mailing list at https://lists.phpmyadmin.net/pipermail/developers/2016-June/019564.html

Hi,

I had a problem with secure connection to sql server.
I use mysqli extension, I configured

. I have a user 'szabolcs' in sql who needs ssl.
First I received

'mysqli_real_connect(): (HY000/1045): Access denied for user 'szabolcs'@'localhost' (using password: YES)'.
That was why PMA doesn't use

. I should add it to $client_flags.

After this I got the following error:

'mysqli_query(): SSL operation failed with code 1. OpenSSL Error messages: error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length'.

PMA uses openssel functions to encrypt values in COOKIE if openssl functions exist, other case PMA uses Crypt\AES. With Crypt\AES PMA works fine.

I don't know the exact source of this problem. I think openssl functions have a bug.

Because the mysqli connection with ssl is successful After connection in common.inc.php

is called. This function stores the username and password and other parameters into COOKIE. To encrypt:

I think the problem is that openssl_encrypt change the cipher to AES-128-CBC globally. It means the cipher of mysqli connection is also modified. This is why mysqli_query failed after encryption.

Here is my solution:

diff -ruN original/libraries/dbi/DBIMysqli.php working/libraries/dbi/DBIMysqli.php
--- original/libraries/dbi/DBIMysqli.php 2016-05-25 19:07:44.000000000 +0200
+++ working/libraries/dbi/DBIMysqli.php 2016-05-26 15:55:49.000000000 +0200
@@ -152,6 +152,7 @@
/* Optionally enable SSL */
if ($cfg[&＃039;Server&＃039;][&＃039;ssl&＃039;]) {
+ $client_flags |= MYSQLI_CLIENT_SSL;
mysqli_ssl_set(
$link,
$cfg[&＃039;Server&＃039;][&＃039;ssl_key&＃039;],
diff -ruN original/libraries/plugins/auth/AuthenticationCOOKIE.php working/libraries/plugins/auth/AuthenticationCOOKIE.php
--- original/libraries/plugins/auth/AuthenticationCOOKIE.php 2016-05-25 19:07:44.000000000 +0200
+++ working/libraries/plugins/auth/AuthenticationCOOKIE.php 2016-05-26 15:56:27.000000000 +0200
@@ -661,6 +661,7 @@
*/
public static function useOpenSSL()
{
+ return false;
return (
function_exists(&＃039;openssl_encrypt&＃039;)
&& function_exists(&＃039;openssl_decrypt&＃039;)
diff -ruN original/RELEASE-DATE-4.6.1 working/RELEASE-DATE-4.6.1
--- original/RELEASE-DATE-4.6.1 1970-01-01 01:00:00.000000000 +0100
+++ working/RELEASE-DATE-4.6.1 2016-05-02 17:24:00.000000000 +0200
@@ -0,0 +1 @@
+Mon May 2 21:23:35 UTC 2016

Regards,
Szabolcs

该提问来源于开源项目：phpmyadmin/phpmyadmin