influxdata / influxdata/influxdb
3DES cipher present even after adding `tls-strict-ciphers`
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
Start influxdb with a configuration for TLS as follows:
```
https-certificate = "client.crt"
https-private-key = "client.key"
tls-strict-ciphers = true #trying all combinations
[tls]
min-version = "tls1.2"
max-version = "tls1.3"
tls-strict-ciphers = true #trying all combinations
strict-ciphers = true #trying all combinations
```
__Expected behavior:__
The strict cipher suites are the only options given to client.
__Actual behavior:__
nmap -sV --script ssl-enum-ciphers -p 8086 localhost
```
Starting Nmap 7.60 ( https://nmap.org ) at 2022-06-07 09:23 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000054s latency).
Other addresses for localhost (not scanned): ::1
rDNS record for 127.0.0.1: 1c9d847e-c4eb-44ea-b301-e8a22cb5f04d
PORT STATE SERVICE VERSION
8086/tcp open ssl/http InfluxDB http admin 1.8.10
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| compressors:
| NULL
| cipher preference: client
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
|_ least strength: C
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.67 seconds
```
3DES cipehers are still present
__Environment info:__
* System info: Linux 5.4.0-110-generic x86_64
* InfluxDB version: InfluxDB v1.8.10 (git: 1.8 688e697c51fd)
* Other relevant environment details: Normal VM
__Config:__
```
[meta]
dir = "/var/vcap/store/influxdb/meta"
[data]
dir = "/var/vcap/store/influxdb/data"
wal-dir = "/var/vcap/store/influxdb/wal"
index-version = "tsi1"
query-log-enabled = true
[coordinator]
log-queries-after = "20s"
[http]
auth-enabled = true
log-enabled = true
pprof-enabled = false
flux-enabled = true
https-enabled = true
https-certificate = "/var/vcap/jobs/influxdb/config/client.crt"
https-private-key = "/var/vcap/jobs/influxdb/config/client.key"
tls-strict-ciphers = true
[tls]
min-version = "tls1.2"
max-version = "tls1.3"
tls-strict-ciphers = true
strict-ciphers = true
[[graphite]]
enabled = true
database = "metrics"
```
Contributor guide
Research direction
Start by reproducing the reported HTTP TLS configuration with tls-strict-ciphers and the [tls] min/max-version settings, then inspect how those options affect the server's advertised cipher suites. Use the provided nmap ssl-enum-ciphers command to verify the result; done means 3DES suites are no longer offered while the configured TLS versions remain available.
Written by the indexing model from the issue text.
Assessment
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100