Skip to content

[4.0] [New feature] Add tls transfer encryption for database connections #26375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wilsonge merged 53 commits into from
Oct 19, 2019
Merged

[4.0] [New feature] Add tls transfer encryption for database connections #26375

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
53 commits
Select commit Hold shift + click to select a range
1eda812
Add tls transfer encryption for database connections
richard67 Sep 21, 2019
a1b8f29
Update composer.lock
richard67 Sep 21, 2019
fb41bcc
Better language strings 1
richard67 Sep 22, 2019
dcfc98b
Update administrator/language/en-GB/en-GB.com_config.ini
richard67 Sep 22, 2019
9fc96d5
Update administrator/language/en-GB/en-GB.com_config.ini
richard67 Sep 22, 2019
0905bb7
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Sep 24, 2019
8d1372e
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Sep 25, 2019
9cfa672
Remove unused key from foreach
richard67 Sep 25, 2019
4f9d7fe
Need to check database connection on global configuration save
andrepereiradasilva Oct 5, 2019
5e2a153
Add new global variables to installation config file
andrepereiradasilva Oct 5, 2019
a2b9ff1
more usable error message
andrepereiradasilva Oct 5, 2019
c1b916c
Update en-GB.com_config.ini
andrepereiradasilva Oct 5, 2019
155fcbf
Merge pull request #7 from andrepereiradasilva/patch-33
richard67 Oct 5, 2019
69f5bab
Merge pull request #6 from andrepereiradasilva/patch-31
richard67 Oct 5, 2019
827388b
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 5, 2019
7ad2ff5
Get databaseConnectionEncryption value in module start
andrepereiradasilva Oct 5, 2019
7d3992e
Add a new line showing the database connection encryption status
andrepereiradasilva Oct 5, 2019
af31ed7
Add the language variables
andrepereiradasilva Oct 5, 2019
b99730a
Merge pull request #9 from andrepereiradasilva/patch-33
richard67 Oct 5, 2019
a70adf7
CS
richard67 Oct 5, 2019
212c2a6
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
infograf768 Oct 11, 2019
9b21dad
language clarifications
andrepereiradasilva Oct 12, 2019
df00277
hints and allow more characters
andrepereiradasilva Oct 12, 2019
be6c19b
Need to save in install configuation.php (on install) the new default…
andrepereiradasilva Oct 12, 2019
8c6ded9
corrections
andrepereiradasilva Oct 12, 2019
11c42e2
correct minor bug and put more friendly client certificates example p…
andrepereiradasilva Oct 12, 2019
fea7da4
Update en-GB.com_config.ini
andrepereiradasilva Oct 12, 2019
65d2cc4
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 12, 2019
767b58e
Merge remote-tracking branch 'upstream/4.0-dev' into 4.0-dev-tls-encr…
richard67 Oct 12, 2019
91bd9ad
Merge pull request #10 from andrepereiradasilva/patch-33
richard67 Oct 13, 2019
a1687f3
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 13, 2019
254d6c9
Update administrator/language/en-GB/en-GB.com_config.ini
richard67 Oct 13, 2019
3a499e9
Update administrator/language/en-GB/en-GB.com_config.ini
richard67 Oct 13, 2019
bdab81f
Merge pull request #11 from andrepereiradasilva/patch-34
richard67 Oct 13, 2019
16854d9
One CA key file only.
richard67 Oct 13, 2019
3e3765b
Remove hints and move into to descriptions + correct some texts
richard67 Oct 13, 2019
045c933
Update ConfigurationModel.php
richard67 Oct 13, 2019
e37b45b
Grr
richard67 Oct 13, 2019
454ec71
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 13, 2019
80a9876
Simplify language strings and remove some obsolete ones
richard67 Oct 13, 2019
a3d0d69
Simplify another one
richard67 Oct 13, 2019
67fadb0
Remove another not needed description
richard67 Oct 13, 2019
4352ff2
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 13, 2019
68c573f
Display CA path only if MySQL
richard67 Oct 13, 2019
594bcf6
Correct showon and text for MySQL only fields
richard67 Oct 13, 2019
80a78c4
Update administrator/language/en-GB/en-GB.com_config.ini
richard67 Oct 13, 2019
197f06d
Drop useless descriptions and shorten label texts
richard67 Oct 14, 2019
230a795
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 14, 2019
dc32440
Fix language text for HTML5
richard67 Oct 14, 2019
98cee42
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 14, 2019
89dbfbb
Merge remote-tracking branch 'upstream/4.0-dev' into 4.0-dev-tls-encr…
richard67 Oct 19, 2019
798199c
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 19, 2019
568774e
Merge branch '4.0-dev' into 4.0-dev-tls-encryption-for-db-connections
richard67 Oct 19, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 12 additions & 10 deletions administrator/components/com_admin/Model/SysinfoModel.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,16 +308,18 @@ public function &getInfo()
$db = $this->getDbo();

$this->info = array(
'php' => php_uname(),
'dbserver' => $db->getServerType(),
'dbversion' => $db->getVersion(),
'dbcollation' => $db->getCollation(),
'dbconnectioncollation' => $db->getConnectionCollation(),
'phpversion' => PHP_VERSION,
'server' => $_SERVER['SERVER_SOFTWARE'] ?? getenv('SERVER_SOFTWARE'),
'sapi_name' => PHP_SAPI,
'version' => (new Version)->getLongVersion(),
'useragent' => $_SERVER['HTTP_USER_AGENT'] ?? '',
'php' => php_uname(),
'dbserver' => $db->getServerType(),
'dbversion' => $db->getVersion(),
'dbcollation' => $db->getCollation(),
'dbconnectioncollation' => $db->getConnectionCollation(),
'dbconnectionencryption' => $db->getConnectionEncryption(),
'dbconnencryptsupported' => $db->isConnectionEncryptionSupported(),
'phpversion' => PHP_VERSION,
'server' => $_SERVER['SERVER_SOFTWARE'] ?? getenv('SERVER_SOFTWARE'),
'sapi_name' => PHP_SAPI,
'version' => (new Version)->getLongVersion(),
'useragent' => $_SERVER['HTTP_USER_AGENT'] ?? '',
);

return $this->info;
Expand Down
16 changes: 16 additions & 0 deletions administrator/components/com_admin/tmpl/sysinfo/default_system.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,22 @@
<?php echo $this->info['dbconnectioncollation']; ?>
</td>
</tr>
<tr>
<th scope="row">
<?php echo Text::_('COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION'); ?>
</th>
<td>
<?php echo $this->info['dbconnectionencryption'] ?: Text::_('JNONE'); ?>
</td>
</tr>
<tr>
<th scope="row">
<?php echo Text::_('COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION_SUPPORTED'); ?>
</th>
<td>
<?php echo $this->info['dbconnencryptsupported'] ? Text::_('JYES') : Text::_('JNO'); ?>
</td>
</tr>
<tr>
<th scope="row">
<?php echo Text::_('COM_ADMIN_PHP_VERSION'); ?>
Expand Down
77 changes: 77 additions & 0 deletions administrator/components/com_config/forms/application.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,83 @@
size="10"
/>

<field
name="dbencryption"
type="list"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_DESC"
default="0"
filter="integer"
>
<option value="0">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE</option>
<option value="1">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY</option>
<option value="2">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY</option>
</field>

<field
name="dbsslverifyservercert"
type="radio"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_DESC"
class="switcher"
default="0"
filter="boolean"
showon="dbencryption:1,2"
>
<option value="0">JNO</option>
<option value="1">JYES</option>
</field>

<field
name="dbsslkey"
type="text"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_DESC"
filter="string"
size="100"
showon="dbencryption:2"
/>

<field
name="dbsslcert"
type="text"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_DESC"
filter="string"
size="100"
showon="dbencryption:2"
/>

<field
name="dbsslca"
type="text"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_DESC"
filter="string"
size="100"
showon="dbencryption:2"
/>

<field
name="dbsslcapath"
type="text"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_DESC"
filter="string"
size="100"
showon="dbencryption:2"
/>

<field
name="dbsslcipher"
type="text"
label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL"
desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_DESC"
filter="string"
size="100"
showon="dbencryption:2"
/>

</fieldset>

<fieldset
Expand Down
2 changes: 2 additions & 0 deletions administrator/language/en-GB/en-GB.com_admin.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ COM_ADMIN_CACHE_DIRECTORY="(Cache folder)"
COM_ADMIN_CONFIGURATION_FILE="Configuration File"
COM_ADMIN_DATABASE_COLLATION="Database Collation"
COM_ADMIN_DATABASE_CONNECTION_COLLATION="Database Connection Collation"
COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION="Database Connection Encryption"
COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION_SUPPORTED="Database Server Supports Connection Encryption"
COM_ADMIN_DATABASE_TYPE="Database Type"
COM_ADMIN_DATABASE_VERSION="Database Version"
COM_ADMIN_DIRECTORY="Folder"
Expand Down
17 changes: 17 additions & 0 deletions administrator/language/en-GB/en-GB.com_config.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,23 @@ COM_CONFIG_FIELD_CACHE_TIME_LABEL="Cache Time (minutes)"
COM_CONFIG_FIELD_COOKIE_DOMAIN_DESC="Precede domain with '.' if cookie should be valid for all subdomains."
COM_CONFIG_FIELD_COOKIE_DOMAIN_LABEL="Cookie Domain"
COM_CONFIG_FIELD_COOKIE_PATH_LABEL="Cookie Path"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_DESC="The full path to the Certificate Authority (CA) certificate file."
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL="CA File"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_DESC="Path to Certificate Authority (CA) certificate files (MySQL only)."
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL="CA Path"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_DESC="The server's certificate file."
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL="Certificate File"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_DESC="The list of permissible ciphers for connection encryption as set on the server."
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL="Cipher Suite"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_DESC="Data in transit encryption (with TLS for database connections)."
Comment thread
richard67 marked this conversation as resolved.
Outdated
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL="Connection Encryption"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE="Default (server controlled)"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY="One-way encryption"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY="Two-way encryption"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_DESC="The server's private key file."
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL="Private Key File"
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_DESC="Verify the server certificate on client side."
Comment thread
richard67 marked this conversation as resolved.
Outdated
COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL="Verify Server Certificate"
COM_CONFIG_FIELD_DATABASE_HOST_LABEL="Host"
COM_CONFIG_FIELD_DATABASE_NAME_LABEL="Database Name"
COM_CONFIG_FIELD_DATABASE_PREFIX_LABEL="Database Tables Prefix"
Expand Down
8 changes: 4 additions & 4 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions libraries/src/Factory.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -667,6 +667,24 @@ protected static function createDbo()

$options = array('driver' => $driver, 'host' => $host, 'user' => $user, 'password' => $password, 'database' => $database, 'prefix' => $prefix);

if ((int) $conf->get('dbencryption') !== 0)
{
$options['ssl'] = [
'enable' => true,
'verify_server_cert' => (bool) $conf->get('dbsslverifyservercert'),
];

foreach (['cipher', 'ca', 'capath', 'key', 'cert'] as $key => $value)
Comment thread
richard67 marked this conversation as resolved.
Outdated
{
$confVal = trim($conf->get('dbssl' . $value, ''));

if ($confVal !== '')
{
$options['ssl'][$value] = $confVal;
}
}
}

try
{
$db = DatabaseDriver::getInstance($options);
Expand Down
18 changes: 18 additions & 0 deletions libraries/src/Service/Provider/Database.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,24 @@ function (Container $container)
'prefix' => $conf->get('dbprefix'),
];

if ((int) $conf->get('dbencryption') !== 0)
{
$options['ssl'] = [
'enable' => true,
'verify_server_cert' => (bool) $conf->get('dbsslverifyservercert'),
];

foreach (['cipher', 'ca', 'capath', 'key', 'cert'] as $key => $value)
{
$confVal = trim($conf->get('dbssl' . $value, ''));

if ($confVal !== '')
{
$options['ssl'][$value] = $confVal;
}
}
}

// Enable utf8mb4 connections for mysql adapters
if (strtolower($dbtype) === 'mysqli')
{
Expand Down
2 changes: 2 additions & 0 deletions plugins/system/debug/DataCollector/InfoCollector.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,8 @@ private function getDatabaseInfo(array $info): array
'dbversion' => $info['dbversion'] ?? '',
'dbcollation' => $info['dbcollation'] ?? '',
'dbconnectioncollation' => $info['dbconnectioncollation'] ?? '',
'dbconnectionencryption' => $info['dbconnectionencryption'] ?? '',
'dbconnencryptsupported' => $info['dbconnencryptsupported'] ?? '',
];
}
}