[SERVER-36616] Enable ECDHE support if platform supports it Created: 13/Aug/18  Updated: 29/Oct/23  Resolved: 30/Oct/18

Status: Closed
Project: Core Server
Component/s: Security
Affects Version/s: None
Fix Version/s: 4.1.5

Type: Task Priority: Major - P3
Reporter: Gregory McKeon (Inactive) Assignee: Patrick Freed
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates SERVER-35064 OpenSSL Elliptic Curve Auto Negotiati... Closed
is duplicated by SERVER-48533 Centos 7 mongodb-org-server-3.6 rpm s... Closed
Backwards Compatibility: Fully Compatible
Sprint: Security 2018-11-05
Participants:

 Description   

At runtime:

  • Continue to call SSL_CTX_set_ecdh_auto, if present at compile time.
    • This will activate ECDHE when built against OpenSSL 1.0.2, and leave it activated when running on OpenSSL 1.1.0 or above.
  • If SSL_CTX_set_ecdh_auto is not present, attempt to call SSL_CTX_ctrl and set option SSL_CTRL_SET_ECDH_AUTO, which is equivalent to the integer literal 94, to 'true'.
    • If, at runtime, we have been linked against OpenSSL 1.0.2, this will enable ECDHE auto-negotiation.
    • If, at runtime, we have been linked against OpenSSL 1.0.1, this function will return an error and be ignored.
    • OpenSSL 1.0.2 defines SSL_CTRL_SET_ECDH_AUTO to 94. Vendor patches to OpenSSL 1.0.1 should not have been able to repurpose 94 to another configuration option, as doing so would likely harm forward ABI compatibility with OpenSSL 1.0.2.
  • If SSL_CTX_ctrl fails, and OpenSSL has defined the types necessary to hardcode an ECDHE curve, hardcode the named curve prime256v1.
    • This is the named curve hard coded by both Python and Apache, when SSL_CTX_set_ecdh_auto is not present[6].
  • Otherwise, if SSL_CTX_set_ecdh_auto is not defined at compile time, SSL_CTX_ctrl fails, and we failed to detect ECDHE support at compile time, do not enable ECDHE.

We should also extend jstests/ssl/ssl_ECDHE_suites.js to assert that ECDHE cipher suites are offered on all platforms.



 Comments   
Comment by Ian Whalen (Inactive) [ 13/May/19 ]

work caught under DRIVERS-551.

Comment by Githook User [ 30/Oct/18 ]

Author:

{'name': 'Patrick Freed', 'email': 'patrick.freed@mongodb.com', 'username': 'patrickfreed'}

Message: SERVER-36616 Enable ECDHE support if platform supports it
Branch: master
https://github.com/mongodb/mongo/commit/b9f13ea4f0f8e5a3e69ed99c954d94629e7e2d4a

Comment by Spencer Jackson [ 12/Oct/18 ]

When we merge this, and update the TLS protocol version probe test, we should add a tag to it which suggests it should not run on burn in. We'd then mark that tag as excluded for the burn in suite.

Generated at Thu Feb 08 04:43:38 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.