Skip to content

branch-4.0: [Fix](mysql) Disable renegotiation during TLS #57631 #57749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yiguolei merged 1 commit into from
Nov 6, 2025
Merged

branch-4.0: [Fix](mysql) Disable renegotiation during TLS #57631 #57749

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 26 additions & 12 deletions fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,12 @@ protected void decryptData(ByteBuffer dstBuf, boolean isHeader) throws SSLExcept
// unwrap will remove ssl header.
while (true) {
SSLEngineResult result = sslEngine.unwrap(dstBuf, decryptAppData);
if (result.getStatus() == SSLEngineResult.Status.OK
&& result.getHandshakeStatus() != SSLEngineResult.HandshakeStatus.NOT_HANDSHAKING) {
LOG.warn("SSL renegotiation requested by {} is not supported. handshakeStatus={}",
remoteHostPortString, result.getHandshakeStatus());
throw new SSLException("SSL renegotiation is not supported.");
}
if (handleUnwrapResult(result) && !dstBuf.hasRemaining()) {
break;
}
Expand Down Expand Up @@ -339,20 +345,22 @@ public ByteBuffer fetchOnePacket() throws IOException {
result.limit(result.position() + packetLen);
readLen = readAll(result, false);
if (isSslMode && remainingBuffer.position() == 0 && result.hasRemaining()) {
int available = result.limit();
if (available < PACKET_HEADER_LEN) {
LOG.warn("SSL mode: invalid mysql packet header, available bytes: " + available);
throw new IOException("Invalid mysql packet header.");
}
byte[] header = result.array();
int mysqlPacketLength = (header[0] & 0xFF) | ((header[1] & 0xFF) << 8) | ((header[2] & 0xFF) << 16);
if (result.position() >= 4 && mysqlPacketLength > 0 && mysqlPacketLength
<= MAX_PHYSICAL_PACKET_LENGTH) {
int packetId = header[3] & 0xFF;
if (packetId != sequenceId) {
LOG.warn("receive packet sequence id[" + packetId + "] want to get[" + sequenceId + "]");
throw new IOException("Bad packet sequence.");
}
} else {
if (LOG.isDebugEnabled()) {
LOG.debug("SSL mode: skipping sequence check, packet length: " + mysqlPacketLength
+ ", buffer position: " + result.position());
}
if (mysqlPacketLength > MAX_PHYSICAL_PACKET_LENGTH) {
LOG.warn("SSL mode: mysql packet length(" + mysqlPacketLength + ") is larger than max physical "
+ "packet length(" + MAX_PHYSICAL_PACKET_LENGTH + ")");
throw new IOException("Mysql packet too large.");
}
int packetId = header[3] & 0xFF;
if (packetId != sequenceId) {
LOG.warn("receive packet sequence id[" + packetId + "] want to get[" + sequenceId + "]");
throw new IOException("Bad packet sequence.");
}
// remove mysql packet header
result.position(4);
Expand Down Expand Up @@ -453,6 +461,12 @@ protected ByteBuffer encryptData(ByteBuffer dstBuf) throws SSLException {
encryptNetData.clear();
while (true) {
SSLEngineResult result = sslEngine.wrap(dstBuf, encryptNetData);
if (result.getStatus() == SSLEngineResult.Status.OK
&& result.getHandshakeStatus() != SSLEngineResult.HandshakeStatus.NOT_HANDSHAKING) {
LOG.warn("SSL renegotiation requested by {} is not supported while writing. handshakeStatus={}",
remoteHostPortString, result.getHandshakeStatus());
throw new SSLException("SSL renegotiation is not supported.");
}
if (handleWrapResult(result) && !dstBuf.hasRemaining()) {
break;
}
Expand Down
Loading