<div dir="ltr">Hello,<div><br></div><div>I tested this dev version and it works fine.</div><div><br></div><div>Thanks.</div><div><br></div><div>Regards,</div><div>Szablcs</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-06-09 5:15 GMT+02:00 Isaac Bennetch <span dir="ltr"><<a href="mailto:bennetch@gmail.com" target="_blank">bennetch@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Kordován Szabolcs,<br>
<br>
As noted in the issue tracker at<br>
<a href="https://github.com/phpmyadmin/phpmyadmin/issues/12293" rel="noreferrer" target="_blank">https://github.com/phpmyadmin/phpmyadmin/issues/12293</a> Michal has made<br>
some improvements here.<br>
<br>
Would you be able to test these changes and report back if it helps the<br>
situation? If you don't use the git version, you can download an updated<br>
snapshot from <a href="https://github.com/phpmyadmin/phpmyadmin/archive/master.zip" rel="noreferrer" target="_blank">https://github.com/phpmyadmin/phpmyadmin/archive/master.zip</a><br>
<br>
Thanks<br>
<span class="HOEnZb"><font color="#888888">Isaac<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On 6/4/16 4:45 PM, Isaac Bennetch wrote:<br>
> I think it's easier to track this in the issue tracker than on the<br>
> mailing list, so we can track progress as a team. I've opened an issue<br>
> at <a href="https://github.com/phpmyadmin/phpmyadmin/issues/12293" rel="noreferrer" target="_blank">https://github.com/phpmyadmin/phpmyadmin/issues/12293</a><br>
><br>
> On 6/3/16 2:50 AM, Kordován Szabolcs wrote:<br>
>> Hi,<br>
>><br>
>> Sorry for delay.<br>
>> I forgot the versions:<br>
>> Database server<br>
>><br>
>> Server: fone2 (127.0.0.1 via TCP/IP)<br>
>> Server type: MySQL<br>
>> Server version: 5.7.12-0ubuntu1 - (Ubuntu)<br>
>> Protocol version: 10<br>
>> User: szabolcs@localhost<br>
>> Server charset: UTF-8 Unicode (utf8)<br>
>> Web server<br>
>><br>
>> Apache/2.4.18 (Ubuntu)<br>
>> Database client version: libmysql - mysqlnd 5.0.12-dev - 20150407 - $Id:<br>
>> f59eb767fe17a6679589b5c076d9fa88d3d4eac0 $<br>
>> PHP extension: mysqli curl mbstring<br>
>> PHP version: 7.0.4-7ubuntu2.1<br>
>><br>
>> openssl<br>
>><br>
>> OpenSSL supportenabled<br>
>> OpenSSL Library VersionOpenSSL 1.0.2g-fips 1 Mar 2016<br>
>> OpenSSL Header VersionOpenSSL 1.0.2g-fips 1 Mar 2016<br>
>> Openssl default config/usr/lib/ssl/openssl.cnf<br>
>><br>
>><br>
>> If you have to authenticate with certification you use mysqli_ssl_set().<br>
>> In this case you need private key and certification. But if you want<br>
>> only a secure communication (like https) you don't need these. Only need<br>
>> mysqli_client_ssl flag to use ssl.<br>
>> From mysql log:<br>
>> 2016-06-03T06:02:02.098148Z11604 Connect szabolcs@xxx.xxx.xxx.xxx<br>
>> on using SSL/TLS<br>
>><br>
>> Regards,<br>
>> Szabolcs<br>
>><br>
>> Date: Thu, 2 Jun 2016 09:16:40 -0400<br>
>> From: Isaac Bennetch <<a href="mailto:bennetch@gmail.com">bennetch@gmail.com</a> <mailto:<a href="mailto:bennetch@gmail.com">bennetch@gmail.com</a>>><br>
>> To: Developer discussion for phpMyAdmin <<a href="mailto:developers@phpmyadmin.net">developers@phpmyadmin.net</a><br>
>> <mailto:<a href="mailto:developers@phpmyadmin.net">developers@phpmyadmin.net</a>>><br>
>> Subject: Re: [phpMyAdmin Developers] Connect with SSL<br>
>> Message-ID: <<a href="mailto:dc965fae-89cf-26a0-d22a-c3b7fab3f561@gmail.com">dc965fae-89cf-26a0-d22a-c3b7fab3f561@gmail.com</a><br>
>> <mailto:<a href="mailto:dc965fae-89cf-26a0-d22a-c3b7fab3f561@gmail.com">dc965fae-89cf-26a0-d22a-c3b7fab3f561@gmail.com</a>>><br>
>> Content-Type: text/plain; charset=utf-8<br>
>><br>
>> Hi, thanks for your report and detailed research. Please see below...<br>
>><br>
>> On 6/2/16 8:24 AM, Kordován Szabolcs wrote:<br>
>> > Hi,<br>
>> ><br>
>> > I had a problem with secure connection to sql server.<br>
>> > I use mysqli extension, I configured server['ssl'] = true. I have<br>
>> a user<br>
>> > 'szabolcs' in sql who needs ssl.<br>
>> > First I received 'mysqli_real_connect(): (HY000/1045): Access<br>
>> denied for<br>
>> > user 'szabolcs'@'localhost' (using password: YES)'.<br>
>> > That was why PMA doesn't use MYSQLI_CLIENT_SSL. I should add it to<br>
>> > $client_flags.<br>
>><br>
>> As far as I'm aware, PHP doesn't need MYSQLI_CLIENT_SSL when calling<br>
>> mysql_ssl_set() before mysqli_real_connect(). The current documentation<br>
>> doesn't reference this scenario at all, but previous versions did state<br>
>> that MYSQLI_CLIENT_SSL was not required here (see, for example, [1]).<br>
>><br>
>> > After this I got the following error:'mysqli_query(): SSL operation<br>
>> > failed with code 1. OpenSSL Error messages: error:0607A082:digital<br>
>> > envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length<br>
>> > error:0607A082:digital envelope<br>
>> > routines:EVP_CIPHER_CTX_set_key_length:invalid key length'.<br>
>> ><br>
>> > PMA uses openssel functions to encrypt values in cookie if openssl<br>
>> > functions exist, other case PMA uses Crypt\AES. With Crypt\AES PMA<br>
>> works<br>
>> > fine.<br>
>> > I don't know the exact source of this problem. I think openssl<br>
>> functions<br>
>> > have a bug.<br>
>><br>
>> There was some incompatibility between MySQL and OpenSSL (see [2]),<br>
>> however the error reported was a bit different.<br>
>><br>
>> > Because the mysqli connection with ssl is successful After connection<br>
>> > in common.inc.php $auth_plugin->storeUserCredentials() is called. This<br>
>> > function stores the username and password and other parameters into<br>
>> > cookie. To encrypt:<br>
>> > openssl_encrypt(<br>
>> > $data,<br>
>> > 'AES-128-CBC',<br>
>> > $secret,<br>
>> > 0,<br>
>> > $this->_cookie_iv<br>
>> > );<br>
>> > I think the problem is that openssl_encrypt change the cipher to<br>
>> > AES-128-CBC globally. It means the cipher of mysqli connection is also<br>
>> > modified. This is why mysqli_query failed after encryption.<br>
>><br>
>> Interesting.<br>
>><br>
>> > Here is my solution:<br>
>> ><br>
>> > diff -ruN original/libraries/dbi/DBIMysqli.php<br>
>> > working/libraries/dbi/DBIMysqli.php<br>
>> > --- original/libraries/dbi/DBIMysqli.php 2016-05-25<br>
>> > 19:07:44.000000000 +0200<br>
>> > +++ working/libraries/dbi/DBIMysqli.php 2016-05-26<br>
>> 15:55:49.000000000 +0200<br>
>> > @@ -152,6 +152,7 @@<br>
>> ><br>
>> > /* Optionally enable SSL */<br>
>> > if ($cfg['Server']['ssl']) {<br>
>> > + $client_flags |= MYSQLI_CLIENT_SSL;<br>
>> > mysqli_ssl_set(<br>
>> > $link,<br>
>> > $cfg['Server']['ssl_key'],<br>
>> > diff -ruN original/libraries/plugins/auth/AuthenticationCookie.php<br>
>> > working/libraries/plugins/auth/AuthenticationCookie.php<br>
>> > --- original/libraries/plugins/auth/AuthenticationCookie.php<br>
>> > 2016-05-25 19:07:44.000000000 +0200<br>
>> > +++ working/libraries/plugins/auth/AuthenticationCookie.php<br>
>> > 2016-05-26 15:56:27.000000000 +0200<br>
>> > @@ -661,6 +661,7 @@<br>
>> > */<br>
>> > public static function useOpenSSL()<br>
>> > {<br>
>> > + return false;<br>
>><br>
>> This also makes me think about some sort of OpenSSL problem.<br>
>><br>
>> > return (<br>
>> > function_exists('openssl_encrypt')<br>
>> > && function_exists('openssl_decrypt')<br>
>> > diff -ruN original/RELEASE-DATE-4.6.1 working/RELEASE-DATE-4.6.1<br>
>> > --- original/RELEASE-DATE-4.6.1 1970-01-01 01:00:00.000000000 +0100<br>
>> > +++ working/RELEASE-DATE-4.6.1 2016-05-02 17:24:00.000000000 +0200<br>
>> > @@ -0,0 +1 @@<br>
>> > +Mon May 2 21:23:35 UTC 2016<br>
>> ><br>
>> > Regards,<br>
>> > Szabolcs<br>
>> ><br>
>> ><br>
>> > _______________________________________________<br>
>> > Developers mailing list<br>
>> > <a href="mailto:Developers@phpmyadmin.net">Developers@phpmyadmin.net</a> <mailto:<a href="mailto:Developers@phpmyadmin.net">Developers@phpmyadmin.net</a>><br>
>> > <a href="https://lists.phpmyadmin.net/mailman/listinfo/developers" rel="noreferrer" target="_blank">https://lists.phpmyadmin.net/mailman/listinfo/developers</a><br>
>><br>
>> >From phpinfo() could you please provide your OpenSSL version? Mine is<br>
>> 1.0.1k.<br>
>><br>
>> >From the main page of phpMyAdmin, could you please provide "Database<br>
>> client version", "PHP extension", and "PHP version" information? (Mine<br>
>> is libmysql - 5.5.49 / mysqli curl mbstring / 5.6.20-0+deb8u1 )<br>
>><br>
>> Regards,<br>
>> Isaac<br>
>><br>
>><br>
>> 1 -<br>
>> <a href="http://board.phpbuilder.com/showthread.php?10383611-Connecting-PHP-and-MYSQL-using-SSL&s=f12add2a512f61180c75efc107856c04&p=10998575&viewfull=1#post10998575" rel="noreferrer" target="_blank">http://board.phpbuilder.com/showthread.php?10383611-Connecting-PHP-and-MYSQL-using-SSL&s=f12add2a512f61180c75efc107856c04&p=10998575&viewfull=1#post10998575</a><br>
>> 2 - <a href="https://bugs.mysql.com/bug.php?id=64870" rel="noreferrer" target="_blank">https://bugs.mysql.com/bug.php?id=64870</a><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Developers mailing list<br>
>> <a href="mailto:Developers@phpmyadmin.net">Developers@phpmyadmin.net</a><br>
>> <a href="https://lists.phpmyadmin.net/mailman/listinfo/developers" rel="noreferrer" target="_blank">https://lists.phpmyadmin.net/mailman/listinfo/developers</a><br>
>><br>
<br>
_______________________________________________<br>
Developers mailing list<br>
<a href="mailto:Developers@phpmyadmin.net">Developers@phpmyadmin.net</a><br>
<a href="https://lists.phpmyadmin.net/mailman/listinfo/developers" rel="noreferrer" target="_blank">https://lists.phpmyadmin.net/mailman/listinfo/developers</a><br>
</div></div></blockquote></div><br></div>