starred/mumble-mumble-voip

Fork 0

mirror of https://github.com/mumble-voip/mumble.git synced 2026-03-03 00:46:56 -05:00

configured sslciphers not respected. #2854

New issue

Open

opened 2026-02-20 22:13:45 -05:00 by deekerman · 9 comments

deekerman commented

2026-02-20 22:13:45 -05:00

Owner

Originally created by @eebssk1 on GitHub (Jun 12, 2024).

The issue

I configed sslCiphers=DHE-RSA-CHACHA20-POLY1305 in server ini to disable AES.
However when starting server the following indicating it's not respected and clients still connecting with AES encryption.

2024-06-12 13:01:34.054 MetaParams: TLS cipher preference is "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-CHACHA20-POLY1305"

Mumble version

1.5.634

Mumble component

Server

OS

Linux

Additional information

No response

Originally created by @eebssk1 on GitHub (Jun 12, 2024). ### The issue I configed sslCiphers=DHE-RSA-CHACHA20-POLY1305 in server ini to disable AES. However when starting server the following indicating it's not respected and clients still connecting with AES encryption. <W>2024-06-12 13:01:34.054 MetaParams: TLS cipher preference is "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-CHACHA20-POLY1305" ### Mumble version 1.5.634 ### Mumble component Server ### OS Linux ### Additional information _No response_

deekerman added the

bug

server

good first issue

labels

2026-02-20 22:13:45 -05:00

deekerman commented

2026-02-20 22:13:46 -05:00

Author

Owner

@eebssk1 commented on GitHub (Jun 13, 2024):

I had to clear tls1.3 and unintended ciphers in openssl.cnf to make it work.

@eebssk1 commented on GitHub (Jun 13, 2024): I had to clear tls1.3 and unintended ciphers in openssl.cnf to make it work.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@Krzmbrzl commented on GitHub (Jun 13, 2024):

openssl.cnf as in the OpenSSL config file? The intended way is that this is not required 🤔

Does the Mumble config setting (without changed OpenSSL config) come into effect when you create a fresh server (that doesn't reuse the old's database)?

@Krzmbrzl commented on GitHub (Jun 13, 2024): `openssl.cnf` as in the OpenSSL config file? The intended way is that this is not required :thinking: Does the Mumble config setting (without changed OpenSSL config) come into effect when you create a fresh server (that doesn't reuse the old's database)?

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@eebssk1 commented on GitHub (Jun 13, 2024):

openssl.cnf as in the OpenSSL config file? The intended way is that this is not required 🤔

Does the Mumble config setting (without changed OpenSSL config) come into effect when you create a fresh server (that doesn't reuse the old's database)?

So I digged a little.

It looks like official client does not support chacha20 in (EC)DHE mode. And it seems the sslciphers config options does not accept ciphersuit name.
Which means the only way for me is to remove the AES one from openssl.cnf ciphersuit so chacha20 one is the prefered.
Maybe it's better to seprate the config options for TLS1.3 and TLS1.2_and_older, as indicated by openssl that they are unrelated.

@eebssk1 commented on GitHub (Jun 13, 2024): > `openssl.cnf` as in the OpenSSL config file? The intended way is that this is not required 🤔 > > Does the Mumble config setting (without changed OpenSSL config) come into effect when you create a fresh server (that doesn't reuse the old's database)? So I digged a little. It looks like official client does not support chacha20 in (EC)DHE mode. And it seems the sslciphers config options does not accept ciphersuit name. Which means the only way for me is to remove the AES one from openssl.cnf ciphersuit so chacha20 one is the prefered. Maybe it's better to seprate the config options for TLS1.3 and TLS1.2_and_older, as indicated by openssl that they are unrelated.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@eebssk1 commented on GitHub (Jun 18, 2024):

So for clafirication. I'm still using TLS 1.3 but with only chacha20 one. I removed AES ciphersuit from openssl.cnf since mumble config does not regconise ciphersuit name which means i can not set the preference there.

@eebssk1 commented on GitHub (Jun 18, 2024): So for clafirication. I'm still using TLS 1.3 but with only chacha20 one. I removed AES ciphersuit from openssl.cnf since mumble config does not regconise ciphersuit name which means i can not set the preference there.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@Krzmbrzl commented on GitHub (Jul 6, 2024):

When using the sslciphers config option, you should get a message like MetaParams: TLS cipher preference is ... when starting up the server. Does this message agree with what you have configured in the INI file?

'cause what is printed there should also be used for the actual connections if I read the code correctly 🤔

@Krzmbrzl commented on GitHub (Jul 6, 2024): When using the `sslciphers` config option, you should get a message like `MetaParams: TLS cipher preference is ...` when starting up the server. Does this message agree with what you have configured in the INI file? 'cause what is printed there should also be used for the actual connections if I read the code correctly :thinking:

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@eebssk1 commented on GitHub (Jul 6, 2024):

When using the sslciphers config option, you should get a message like MetaParams: TLS cipher preference is ... when starting up the server. Does this message agree with what you have configured in the INI file?

'cause what is printed there should also be used for the actual connections if I read the code correctly 🤔

Server won't startup. The TLS1.3 cipher string is not recognized by the option.

@eebssk1 commented on GitHub (Jul 6, 2024): > When using the `sslciphers` config option, you should get a message like `MetaParams: TLS cipher preference is ...` when starting up the server. Does this message agree with what you have configured in the INI file? > > 'cause what is printed there should also be used for the actual connections if I read the code correctly 🤔 Server won't startup. The TLS1.3 cipher string is not recognized by the option.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@eebssk1 commented on GitHub (Jul 6, 2024):

When using the sslciphers config option, you should get a message like MetaParams: TLS cipher preference is ... when starting up the server. Does this message agree with what you have configured in the INI file?
'cause what is printed there should also be used for the actual connections if I read the code correctly 🤔

Server won't startup. The TLS1.3 cipher string is not recognized by the option.

It's very weired that MetaParams automatically prepend tls1.3 ciphers,but the options does not recognize it when manually entered.

@eebssk1 commented on GitHub (Jul 6, 2024): > > When using the `sslciphers` config option, you should get a message like `MetaParams: TLS cipher preference is ...` when starting up the server. Does this message agree with what you have configured in the INI file? > > 'cause what is printed there should also be used for the actual connections if I read the code correctly 🤔 > > Server won't startup. The TLS1.3 cipher string is not recognized by the option. It's very weired that MetaParams automatically prepend tls1.3 ciphers,but the options does not recognize it when manually entered.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@Krzmbrzl commented on GitHub (Jul 6, 2024):

The appending of additional ciphers is actually done by OpenSSL, it seems. The cipher list entering
github.com/mumble-voip/mumble@9f0b143d0f/src/SSL.cpp (L49-L108)
is the one from the INI file but the one leaving this function contains the extra ciphers.

@Krzmbrzl commented on GitHub (Jul 6, 2024): The appending of additional ciphers is actually done by OpenSSL, it seems. The cipher list entering https://github.com/mumble-voip/mumble/blob/9f0b143d0f114c6ff4cd417fdeb5c8f6ccd6562d/src/SSL.cpp#L49-L108 is the one from the INI file but the one leaving this function contains the extra ciphers.

deekerman commented

2026-02-20 22:13:48 -05:00

Author

Owner

@eebssk1 commented on GitHub (Oct 10, 2024):

According to https://manpages.debian.org/testing/libssl-doc/OPENSSL_config.3ssl.en.html
Maybe we could set OPENSSL_CONF to load the modded conf instead of loading/modifying the global one.
Since the function will always called by qt dependencies(it seems), this way might work.

@eebssk1 commented on GitHub (Oct 10, 2024): According to https://manpages.debian.org/testing/libssl-doc/OPENSSL_config.3ssl.en.html Maybe we could set [OPENSSL_CONF](https://manpages.debian.org/testing/libssl-doc/OPENSSL_config.3ssl.en.html#OPENSSL_CONF) to load the modded conf instead of loading/modifying the global one. Since the function will always called by qt dependencies(it seems), this way might work.