Bug #68344 [NEW]: MySQLi does not provide way to disable peer certificate validation

From: Date: Tue, 04 Nov 2014 19:42:03 +0000
Subject: Bug #68344 [NEW]: MySQLi does not provide way to disable peer certificate validation
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-188448@lists.php.net to get a copy of this message 
From:             james at jamesreno dot com
Operating system: NA
PHP version:      5.6.2
Package:          MySQLi related
Bug Type:         Bug
Bug description:MySQLi does not provide way to disable peer certificate validation

Description:
------------
When the MySQLi extension is compiled against mysqlnd there is no method
to disable peer_name validation. Since MySQL 5.6 now enables peer_name
validation by DEFAULT those of us connecting to servers with self-signed
certs via SSL are no longer able too.

I have tried to signal the default ssl stream context to disable
peer_name validation but mysqli extension will NOT honor it.

If the remote-server's name does not match the name you are connecting
to (as in, for example, a mysql cluster and connecting to a single node
directly) you will not be able to connect at all in any way shape or
form with mysqli.  -- The old mysql extension is not effected by this
change as it honors the my.cnf mysql client's validation settings.

Test script:
---------------
<?php

stream_context_set_default(array(
        'ssl'   => array(
                'peer_name' => 'generic-server',
                'verify_peer' => FALSE,
                'verify_peer_name' => FALSE,
                'allow_self_signed' => TRUE,
        ),
));

 $mysqli = mysqli_init();
 mysqli_ssl_set($mysqli,"/etc/pki/mysql/client.key","/etc/pki/mysql/client.crt","/etc/pki/mysql/ca-cert.pem",NULL,NULL);
 $conn =
mysqli_real_connect($mysqli,'dbserver.local','test','test1234','',NULL,'',MYSQLI_CLIENT_SSL);
 var_dump($conn);

?>


Expected result:
----------------
I expect to be able to disable peer_name validation for those situations
were the certificate name cant possibly be verified (ie: self-signed
certs) and be able to connect to the mysql server.

Actual result:
--------------
MySQLi will NOT connect to mysql server and throws 4 warnings:

Warning: mysqli_real_connect(): Peer certificate CN=`generic-server' did
not match expected CN=`dbserver.local'
Warning: mysqli_real_connect(): Cannot connect to MySQL by using SSL
Warning: mysqli_real_connect(): [2002]  (trying to connect via
tcp://dbserver.local:3306)
Warning: mysqli_real_connect(): (HY000/2002):

-- 
Edit bug report at https://bugs.php.net/bug.php?id=68344&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=68344&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=68344&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=68344&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=68344&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=68344&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=68344&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=68344&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=68344&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=68344&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=68344&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=68344&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=68344&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=68344&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68344&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=68344&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=68344&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=68344&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=68344&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=68344&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=68344&r=mysqlcfg

Thread (57 messages)

« previous php.bugs (#188448) next »