From ce486e55405d85a0a534122199c41401e1065347 Mon Sep 17 00:00:00 2001
From: Zaiming Shi <zmstone@gmail.com>
Date: Tue, 5 Oct 2021 15:25:56 +0200
Subject: [PATCH] fix(ssl): verify ciphers list against all available ciphers

Prior to this change the ciphers are only checked against
the list returned from from
`ssl:cipher_suites(all, 'tlsv1.2', openssl)`
which may cause some (weak) ciphers missing in certain
otp + openssl installation
---
 apps/emqx/src/emqx_schema.erl  | 8 +-------
 apps/emqx/src/emqx_tls_lib.erl | 6 ++++--
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 31f973421..a2fb13bab 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -1290,10 +1290,7 @@ parse_user_lookup_fun(StrConf) ->
     {fun Mod:Fun/3, undefined}.
 
 validate_ciphers(Ciphers) ->
-    All = case is_tlsv13_available() of
-              true -> ssl:cipher_suites(all, 'tlsv1.3', openssl);
-              false -> []
-          end ++ ssl:cipher_suites(all, 'tlsv1.2', openssl),
+    All = emqx_tls_lib:all_ciphers(),
     case lists:filter(fun(Cipher) -> not lists:member(Cipher, All) end, Ciphers) of
         [] -> ok;
         Bad -> {error, {bad_ciphers, Bad}}
@@ -1306,6 +1303,3 @@ validate_tls_versions(Versions) ->
         [] -> ok;
         Vs -> {error, {unsupported_ssl_versions, Vs}}
     end.
-
-is_tlsv13_available() ->
-    lists:member('tlsv1.3', proplists:get_value(available, ssl:versions())).
diff --git a/apps/emqx/src/emqx_tls_lib.erl b/apps/emqx/src/emqx_tls_lib.erl
index 6a05274a6..3b3953b83 100644
--- a/apps/emqx/src/emqx_tls_lib.erl
+++ b/apps/emqx/src/emqx_tls_lib.erl
@@ -22,6 +22,7 @@
         , selected_ciphers/1
         , integral_ciphers/2
         , drop_tls13_for_old_otp/1
+        , all_ciphers/0
         ]).
 
 %% non-empty string
@@ -59,6 +60,9 @@ integral_versions(Desired) ->
             Filtered
     end.
 
+%% @doc Return a list of all supported ciphers.
+all_ciphers() -> all_ciphers(default_versions()).
+
 %% @doc Return a list of (openssl string format) cipher suites.
 -spec all_ciphers([ssl:tls_version()]) -> [string()].
 all_ciphers(['tlsv1.3']) ->
@@ -212,8 +216,6 @@ drop_tls13(SslOpts0) ->
 -ifdef(TEST).
 -include_lib("eunit/include/eunit.hrl").
 
-all_ciphers() -> all_ciphers(default_versions()).
-
 drop_tls13_test() ->
     Versions = default_versions(),
     ?assert(lists:member('tlsv1.3', Versions)),