util: Disable 3DES ciphers for TLS connections (#27690)

[ti-srebot]

cherry-pick #27690 to release-5.2
You can switch your code base to this Pull Request by using git-extras:

# In tidb repo:
git pr https://github.com/pingcap/tidb/pull/27859

After apply modifications, you can push your change to this PR via:

git push git@github.com:ti-srebot/tidb.git pr/27859:release-5.2-c85b3e283566

---

What problem does this PR solve?

Problem Summary:

Depending on the version of Go that is used, etc some insecure TLS ciphersuites are enabled.

This removes the following ciphersuites:

• TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_RSA_WITH_3DES_EDE_CBC_SHA

Note that https://docs.pingcap.com/tidb/stable/enable-tls-between-clients-and-servers didn't list these ciphersuites.

See also:

• https://csrc.nist.gov/news/2017/update-to-current-use-and-deprecation-of-tdea

What is changed and how it works?

How it Works:

tls.CipherSuites() only lists ciphersuite that have Insecure=false, but in some cases this includes 3DES based ciphersuites, and these are explicitly removed from the list before using it in the tls.Config

Check List

Tests

• Manual test (add detailed scripts or steps below)

openssl s_client -starttls mysql -connect 127.0.0.1:4000 -tls1_2 -cipher ECDHE-RSA-DES-CBC3-SHA

Side effects

• Breaking backward compatibility

This intentionally removes compatibility with 3DES ciphersuites. This is not expected to impact any users as this is not commonly used for MySQL connections.

Release note

Support for 3DES based TLS ciphersuites was removed

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• kennytm
• morgo

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[ti-srebot]

/run-all-tests

[ti-srebot]

@dveeden you're already a collaborator in bot's repo.

[ti-chi-bot]

@dveeden: Thanks for your review. The bot only counts approvals from reviewers and higher roles in list, but you're still welcome to leave your comments.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[dveeden]

/run-all-tests

[dveeden]

/assign @morgo

[morgo]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: ce11d54