Skip to content

Commit 1508045

Browse files
soklakovsoklakov
committed
Fix for Bug#31117686, PROTOCOL ALLOWLIST NOT COMPATIBLE WITH IBM JAVA.
1 parent 5c5e8e1 commit 1508045

File tree

3 files changed

+104
-76
lines changed

3 files changed

+104
-76
lines changed

‎CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
Version 8.0.27
55

6+
- Fix for Bug#31117686, PROTOCOL ALLOWLIST NOT COMPATIBLE WITH IBM JAVA.
7+
68
- Fix for Bug#104559 (33232419), ResultSet.getObject(i, java.util.Date.class) throws NPE when the value is null.
79

810
- WL#14707, Support OCI IAM authentication.

‎src/main/core-impl/java/com/mysql/cj/protocol/ExportControlled.java

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,19 @@ public class ExportControlled {
122122
try {
123123
Properties tlsSettings = new Properties();
124124
tlsSettings.load(ExportControlled.class.getResourceAsStream(TLS_SETTINGS_RESOURCE));
125-
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Mandatory").split("\\s*,\\s*")).forEach(s -> ALLOWED_CIPHERS.add(s.trim()));
126-
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Approved").split("\\s*,\\s*")).forEach(s -> ALLOWED_CIPHERS.add(s.trim()));
127-
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Deprecated").split("\\s*,\\s*")).forEach(s -> ALLOWED_CIPHERS.add(s.trim()));
125+
// Ciphers prefixed with "TLS_" are used by Oracle Java while the ones prefixed with "SSL_" are used by IBM Java
126+
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Mandatory").split("\\s*,\\s*")).forEach(s -> {
127+
ALLOWED_CIPHERS.add("TLS_" + s.trim());
128+
ALLOWED_CIPHERS.add("SSL_" + s.trim());
129+
});
130+
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Approved").split("\\s*,\\s*")).forEach(s -> {
131+
ALLOWED_CIPHERS.add("TLS_" + s.trim());
132+
ALLOWED_CIPHERS.add("SSL_" + s.trim());
133+
});
134+
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Deprecated").split("\\s*,\\s*")).forEach(s -> {
135+
ALLOWED_CIPHERS.add("TLS_" + s.trim());
136+
ALLOWED_CIPHERS.add("SSL_" + s.trim());
137+
});
128138
Arrays.stream(tlsSettings.getProperty("TLSCiphers.Unacceptable.Mask").split("\\s*,\\s*")).forEach(s -> RESTRICTED_CIPHER_SUBSTR.add(s.trim()));
129139
} catch (IOException e) {
130140
throw ExceptionFactory.createException("Unable to load TlsSettings.properties");

‎src/main/resources/com/mysql/cj/TlsSettings.properties

Lines changed: 89 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2019, 2020, Oracle and/or its affiliates.
1+
# Copyright (c) 2019, 2021, Oracle and/or its affiliates.
22
#
33
# This program is free software; you can redistribute it and/or modify it under
44
# the terms of the GNU General Public License, version 2.0, as published by the
@@ -27,84 +27,100 @@
2727

2828
# Mandatory TLS Ciphers
2929
TLSCiphers.Mandatory=\
30-
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\
31-
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\
32-
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
30+
ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\
31+
ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\
32+
ECDHE_RSA_WITH_AES_128_GCM_SHA256
3333

3434
# Approved TLS Ciphers
3535
TLSCiphers.Approved=\
36-
TLS_AES_128_GCM_SHA256,\
37-
TLS_AES_256_GCM_SHA384,\
38-
TLS_CHACHA20_POLY1305_SHA256,\
39-
TLS_AES_128_CCM_SHA256,\
40-
TLS_AES_128_CCM_8_SHA256,\
41-
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,\
42-
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,\
43-
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,\
44-
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,\
45-
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,\
46-
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,\
47-
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,\
48-
TLS_DH_DSS_WITH_AES_128_GCM_SHA256,\
49-
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,\
50-
TLS_DH_DSS_WITH_AES_256_GCM_SHA384,\
51-
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,\
52-
TLS_DH_RSA_WITH_AES_128_GCM_SHA256,\
53-
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,\
54-
TLS_DH_RSA_WITH_AES_256_GCM_SHA384,\
55-
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
36+
AES_128_GCM_SHA256,\
37+
AES_256_GCM_SHA384,\
38+
CHACHA20_POLY1305_SHA256,\
39+
AES_128_CCM_SHA256,\
40+
AES_128_CCM_8_SHA256,\
41+
ECDHE_RSA_WITH_AES_256_GCM_SHA384,\
42+
DHE_RSA_WITH_AES_128_GCM_SHA256,\
43+
DHE_DSS_WITH_AES_128_GCM_SHA256,\
44+
DHE_DSS_WITH_AES_256_GCM_SHA384,\
45+
DHE_RSA_WITH_AES_256_GCM_SHA384,\
46+
ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,\
47+
ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,\
48+
ECDHE_ECDSA_WITH_AES_256_CCM,\
49+
ECDHE_ECDSA_WITH_AES_128_CCM,\
50+
DHE_RSA_WITH_AES_256_CCM,\
51+
DHE_RSA_WITH_AES_128_CCM,\
52+
DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,\
53+
ECDHE_ECDSA_WITH_AES_256_CCM_8,\
54+
ECDHE_ECDSA_WITH_AES_128_CCM_8,\
55+
DHE_RSA_WITH_AES_256_CCM_8,\
56+
DHE_RSA_WITH_AES_128_CCM_8
5657

5758
# Deprecated TLS Ciphers
5859
TLSCiphers.Deprecated=\
59-
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,\
60-
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,\
61-
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,\
62-
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,\
63-
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,\
64-
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,\
65-
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,\
66-
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,\
67-
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,\
68-
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,\
69-
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,\
70-
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,\
71-
TLS_DHE_DSS_WITH_AES_128_CBC_SHA,\
72-
TLS_DHE_RSA_WITH_AES_128_CBC_SHA,\
73-
TLS_DHE_DSS_WITH_AES_256_CBC_SHA,\
74-
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,\
75-
TLS_DH_RSA_WITH_AES_128_CBC_SHA256,\
76-
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,\
77-
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,\
78-
TLS_DH_RSA_WITH_AES_256_CBC_SHA256,\
79-
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,\
80-
TLS_DH_DSS_WITH_AES_128_CBC_SHA256,\
81-
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,\
82-
TLS_DH_DSS_WITH_AES_128_CBC_SHA,\
83-
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,\
84-
TLS_DH_DSS_WITH_AES_256_CBC_SHA,\
85-
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,\
86-
TLS_DH_DSS_WITH_AES_256_CBC_SHA256,\
87-
TLS_DH_RSA_WITH_AES_128_CBC_SHA,\
88-
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,\
89-
TLS_DH_RSA_WITH_AES_256_CBC_SHA,\
90-
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,\
91-
TLS_RSA_WITH_AES_128_GCM_SHA256,\
92-
TLS_RSA_WITH_AES_256_GCM_SHA384,\
93-
TLS_RSA_WITH_AES_128_CBC_SHA256,\
94-
TLS_RSA_WITH_AES_256_CBC_SHA256,\
95-
TLS_RSA_WITH_AES_128_CBC_SHA,\
96-
TLS_RSA_WITH_AES_256_CBC_SHA,\
97-
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,\
98-
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,\
99-
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,\
100-
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,\
101-
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,\
102-
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,\
103-
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,\
104-
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,\
105-
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,\
106-
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,\
107-
TLS_RSA_WITH_3DES_EDE_CBC_SHA
60+
ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,\
61+
ECDHE_RSA_WITH_AES_128_CBC_SHA256,\
62+
ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,\
63+
ECDHE_RSA_WITH_AES_256_CBC_SHA384,\
64+
DHE_DSS_WITH_AES_128_CBC_SHA256,\
65+
DHE_DSS_WITH_AES_256_CBC_SHA256,\
66+
DHE_RSA_WITH_AES_256_CBC_SHA256,\
67+
DHE_RSA_WITH_AES_128_CBC_SHA256,\
68+
DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,\
69+
DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,\
70+
ECDHE_RSA_WITH_AES_128_CBC_SHA,\
71+
ECDHE_ECDSA_WITH_AES_128_CBC_SHA,\
72+
ECDHE_RSA_WITH_AES_256_CBC_SHA,\
73+
ECDHE_ECDSA_WITH_AES_256_CBC_SHA,\
74+
DHE_DSS_WITH_AES_128_CBC_SHA,\
75+
DHE_RSA_WITH_AES_128_CBC_SHA,\
76+
DHE_RSA_WITH_AES_256_CBC_SHA,\
77+
DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,\
78+
RSA_WITH_CAMELLIA_128_CBC_SHA,\
79+
DH_RSA_WITH_AES_128_CBC_SHA256,\
80+
ECDH_ECDSA_WITH_AES_128_CBC_SHA256,\
81+
ECDH_RSA_WITH_AES_128_CBC_SHA256,\
82+
DH_RSA_WITH_AES_256_CBC_SHA256,\
83+
ECDH_RSA_WITH_AES_256_CBC_SHA384,\
84+
DH_DSS_WITH_AES_128_CBC_SHA256,\
85+
ECDH_ECDSA_WITH_AES_256_CBC_SHA384,\
86+
DH_DSS_WITH_AES_128_CBC_SHA,\
87+
ECDH_ECDSA_WITH_AES_128_CBC_SHA,\
88+
DH_DSS_WITH_AES_256_CBC_SHA,\
89+
ECDH_ECDSA_WITH_AES_256_CBC_SHA,\
90+
DH_DSS_WITH_AES_256_CBC_SHA256,\
91+
DH_RSA_WITH_AES_128_CBC_SHA,\
92+
ECDH_RSA_WITH_AES_128_CBC_SHA,\
93+
DH_RSA_WITH_AES_256_CBC_SHA,\
94+
ECDH_RSA_WITH_AES_256_CBC_SHA,\
95+
RSA_WITH_AES_128_GCM_SHA256,\
96+
RSA_WITH_AES_128_CCM,\
97+
RSA_WITH_AES_128_CCM_8,\
98+
RSA_WITH_AES_256_GCM_SHA384,\
99+
RSA_WITH_AES_256_CCM,\
100+
RSA_WITH_AES_256_CCM_8,\
101+
RSA_WITH_AES_128_CBC_SHA256,\
102+
RSA_WITH_AES_256_CBC_SHA256,\
103+
RSA_WITH_AES_128_CBC_SHA,\
104+
RSA_WITH_AES_256_CBC_SHA,\
105+
RSA_WITH_CAMELLIA_256_CBC_SHA,\
106+
RSA_WITH_CAMELLIA_128_CBC_SHA,\
107+
DH_DSS_WITH_AES_128_GCM_SHA256,\
108+
ECDH_ECDSA_WITH_AES_128_GCM_SHA256,\
109+
DH_DSS_WITH_AES_256_GCM_SHA384,\
110+
ECDH_ECDSA_WITH_AES_256_GCM_SHA384,\
111+
DH_RSA_WITH_AES_128_GCM_SHA256,\
112+
ECDH_RSA_WITH_AES_128_GCM_SHA256,\
113+
DH_RSA_WITH_AES_256_GCM_SHA384,\
114+
ECDH_RSA_WITH_AES_256_GCM_SHA384,\
115+
DH_DSS_WITH_3DES_EDE_CBC_SHA,\
116+
DH_RSA_WITH_3DES_EDE_CBC_SHA,\
117+
DHE_DSS_WITH_3DES_EDE_CBC_SHA,\
118+
DHE_RSA_WITH_3DES_EDE_CBC_SHA,\
119+
ECDH_RSA_WITH_3DES_EDE_CBC_SHA,\
120+
ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,\
121+
ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,\
122+
ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,\
123+
RSA_WITH_3DES_EDE_CBC_SHA
108124

109125
# Unacceptable TLS Ciphers
110126
TLSCiphers.Unacceptable.Mask=_ANON_,_NULL_,_EXPORT,_MD5,_DES,_RC2_,_RC4_,_PSK_

0 commit comments

Comments
 (0)