Skip to content

Commit 820abdd

Browse files
author
Ramil Kalimullin
committed
WL#12361: Support TLS 1.3 in the server and libmysql
1 parent 10903f9 commit 820abdd

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+495
-214
lines changed

‎client/base/ssl_options.cc

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License, version 2.0,
@@ -56,6 +56,8 @@ void Mysql_connection_options::Ssl_options::create_options() {
5656
"X509 cert in PEM format.");
5757
this->create_new_option(&::opt_ssl_cipher, "ssl-cipher",
5858
"SSL cipher to use.");
59+
this->create_new_option(&::opt_tls_ciphersuites, "tls-ciphersuites",
60+
"TLS v1.3 cipher to use.");
5961
this->create_new_option(&::opt_ssl_key, "ssl-key", "X509 key in PEM format.");
6062
this->create_new_option(&::opt_ssl_crl, "ssl-crl",
6163
"Certificate revocation list.");

‎client/client_priv.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2001, 2018, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.
33
44
This program is free software; you can redistribute it and/or modify
55
it under the terms of the GNU General Public License, version 2.0,
@@ -171,6 +171,7 @@ enum options_client {
171171
OPT_SSL_MODE,
172172
OPT_PRINT_TABLE_METADATA,
173173
OPT_SSL_FIPS_MODE,
174+
OPT_TLS_CIPHERSUITES,
174175
/* Add new option above this */
175176
OPT_MAX_CLIENT_OPTION
176177
};

‎cmake/ssl.cmake

+9-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2009, 2018, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2009, 2019, Oracle and/or its affiliates. All rights reserved.
22
#
33
# This program is free software; you can redistribute it and/or modify
44
# it under the terms of the GNU General Public License, version 2.0,
@@ -308,6 +308,13 @@ MACRO (MYSQL_CHECK_SSL)
308308
"^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9]([0-9][0-9]).*$" "\\1"
309309
OPENSSL_MINOR_VERSION "${OPENSSL_VERSION_NUMBER}"
310310
)
311+
STRING(REGEX REPLACE
312+
"^.*OPENSSL_VERSION_NUMBER[\t ]+0x[0-9][0-9][0-9]([0-9][0-9]).*$" "\\1"
313+
OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}"
314+
)
315+
ENDIF()
316+
IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0")
317+
ADD_DEFINITIONS(-DHAVE_TLSv13)
311318
ENDIF()
312319
IF(OPENSSL_INCLUDE_DIR AND
313320
OPENSSL_LIBRARY AND
@@ -379,6 +386,7 @@ MACRO (MYSQL_CHECK_SSL)
379386
MESSAGE(STATUS "CRYPTO_LIBRARY = ${CRYPTO_LIBRARY}")
380387
MESSAGE(STATUS "OPENSSL_MAJOR_VERSION = ${OPENSSL_MAJOR_VERSION}")
381388
MESSAGE(STATUS "OPENSSL_MINOR_VERSION = ${OPENSSL_MINOR_VERSION}")
389+
MESSAGE(STATUS "OPENSSL_FIX_VERSION = ${OPENSSL_FIX_VERSION}")
382390
# The server hangs in OpenSSL_add_all_algorithms() in ssl_start()
383391
IF(WIN32 AND OPENSSL_MINOR_VERSION VERSION_EQUAL 1)
384392
MESSAGE(WARNING "OpenSSL 1.1 is experimental on Windows")

‎include/mysql.h

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -207,7 +207,8 @@ enum mysql_option {
207207
MYSQL_OPT_GET_SERVER_PUBLIC_KEY,
208208
MYSQL_OPT_RETRY_COUNT,
209209
MYSQL_OPT_OPTIONAL_RESULTSET_METADATA,
210-
MYSQL_OPT_SSL_FIPS_MODE
210+
MYSQL_OPT_SSL_FIPS_MODE,
211+
MYSQL_OPT_TLS_CIPHERSUITES
211212
};
212213

213214
/**

‎include/mysql.h.pp

+2-1
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,8 @@
393393
MYSQL_OPT_GET_SERVER_PUBLIC_KEY,
394394
MYSQL_OPT_RETRY_COUNT,
395395
MYSQL_OPT_OPTIONAL_RESULTSET_METADATA,
396-
MYSQL_OPT_SSL_FIPS_MODE
396+
MYSQL_OPT_SSL_FIPS_MODE,
397+
MYSQL_OPT_TLS_CIPHERSUITES
397398
};
398399
struct st_mysql_options_extention;
399400
struct st_mysql_options {

‎include/sql_common.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SQL_COMMON_INCLUDED
22
#define SQL_COMMON_INCLUDED
33

4-
/* Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
4+
/* Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License, version 2.0,
@@ -124,6 +124,7 @@ struct st_mysql_options_extention {
124124
unsigned int ssl_mode;
125125
unsigned int retry_count;
126126
unsigned int ssl_fips_mode; /* SSL fips mode for enforced encryption.*/
127+
char *tls_ciphersuites;
127128
};
128129

129130
struct MYSQL_METHODS {

‎include/sslopt-longopts.h

+16-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -159,7 +159,7 @@
159159
{"tls-version",
160160
OPT_TLS_VERSION,
161161
"TLS version to use, "
162-
"permitted values are: TLSv1, TLSv1.1, TLSv1.2",
162+
"permitted values are: TLSv1, TLSv1.1, TLSv1.2, TLSv1.3",
163163
&opt_tls_version,
164164
&opt_tls_version,
165165
0,
@@ -190,4 +190,18 @@
190190
0,
191191
0,
192192
0},
193+
{"tls-ciphersuites",
194+
OPT_TLS_CIPHERSUITES,
195+
"TLS v1.3 cipher to use.",
196+
&opt_tls_ciphersuites,
197+
&opt_tls_ciphersuites,
198+
0,
199+
GET_STR,
200+
REQUIRED_ARG,
201+
0,
202+
0,
203+
0,
204+
0,
205+
0,
206+
0},
193207
#endif /* HAVE_OPENSSL */

‎include/sslopt-vars.h

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -70,6 +70,7 @@ static char *opt_ssl_ca = 0;
7070
static char *opt_ssl_capath = 0;
7171
static char *opt_ssl_cert = 0;
7272
static char *opt_ssl_cipher = 0;
73+
static char *opt_tls_ciphersuites = 0;
7374
static char *opt_ssl_key = 0;
7475
static char *opt_ssl_crl = 0;
7576
static char *opt_ssl_crlpath = 0;
@@ -102,6 +103,7 @@ static inline int set_client_ssl_options(MYSQL *mysql) {
102103
mysql_options(mysql, MYSQL_OPT_SSL_FIPS_MODE, &opt_ssl_fips_mode);
103104
if (opt_ssl_fips_mode > 0 && mysql_errno(mysql) == CR_SSL_FIPS_MODE_ERR)
104105
return 1;
106+
mysql_options(mysql, MYSQL_OPT_TLS_CIPHERSUITES, opt_tls_ciphersuites);
105107

106108
return 0;
107109
}

‎include/violite.h

+7-5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
1+
/* Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -262,8 +262,9 @@ int sslconnect(struct st_VioSSLFd *, MYSQL_VIO, long timeout,
262262

263263
struct st_VioSSLFd *new_VioSSLConnectorFd(
264264
const char *key_file, const char *cert_file, const char *ca_file,
265-
const char *ca_path, const char *cipher, enum enum_ssl_init_error *error,
266-
const char *crl_file, const char *crl_path, const long ssl_ctx_flags);
265+
const char *ca_path, const char *cipher, const char *ciphersuites,
266+
enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path,
267+
const long ssl_ctx_flags);
267268

268269
long process_tls_version(const char *tls_version);
269270

@@ -273,8 +274,9 @@ uint get_fips_mode();
273274

274275
struct st_VioSSLFd *new_VioSSLAcceptorFd(
275276
const char *key_file, const char *cert_file, const char *ca_file,
276-
const char *ca_path, const char *cipher, enum enum_ssl_init_error *error,
277-
const char *crl_file, const char *crl_path, const long ssl_ctx_flags);
277+
const char *ca_path, const char *cipher, const char *ciphersuites,
278+
enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path,
279+
const long ssl_ctx_flags);
278280
void free_vio_ssl_acceptor_fd(struct st_VioSSLFd *fd);
279281

280282
void vio_ssl_end();

‎mysql-test/include/allowed_ciphers.inc

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#
2+
# List of allowed TLSv1.2 and TLSv1.3 ciphers which will be
3+
# replaced with "SSL_CIPHER" in the result files.
4+
# Usage: --replace_regex $ALLOWED_CIPHERS_REGEX
5+
#
6+
7+
LET $ALLOWED_CIPHERS_REGEX = /ECDHE-RSA-AES128-GCM-SHA256|DHE-RSA-AES128-GCM-SHA256|DHE-RSA-AES256-SHA|ECDHE-RSA-AES128-SHA256|TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256/SSL_CIPHER/;

‎mysql-test/include/excludenoskip.list

+2
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ have_ssl.inc
106106
have_ssl_crypto_functs.inc
107107
not_openssl.inc
108108
check_openssl_version.inc
109+
have_tlsv13.inc
110+
not_have_tlsv13.inc
109111

110112
# 4.5 Reason for inclusion: Tests should run only with supported innodb page
111113
# sizes and skip on others. However, this can be handled using a custom

‎mysql-test/include/have_openssl.inc

+1
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ let $shavars= query_get_value("SHOW STATUS LIKE 'Rsa_public_key'", Variable_name
33
if ($shavars != 'Rsa_public_key'){
44
skip Need OpenSSL support;
55
}
6+
--source include/allowed_ciphers.inc

‎mysql-test/include/have_ssl.inc

+1
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ if (!$have_ssl)
33
{
44
--skip Test requires 'have_ssl'
55
}
6+
--source include/allowed_ciphers.inc

‎mysql-test/include/have_tlsv13.inc

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
if (`SELECT @@GLOBAL.tls_version NOT LIKE '%TLSv1.3%'`) {
2+
--skip Requires TLSv1.3
3+
}

‎mysql-test/include/not_have_tlsv13.inc

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
if (`SELECT @@GLOBAL.tls_version LIKE '%TLSv1.3%'`) {
2+
--skip Doesn't support TLSv1.3
3+
}

‎mysql-test/r/all_persisted_variables.result

+4-4
Original file line numberDiff line numberDiff line change
@@ -43,17 +43,17 @@ include/assert.inc ['Expect 554 variables in the table. Due to open Bugs, we are
4343

4444
# Test SET PERSIST
4545

46-
include/assert.inc [Expect 374 persisted variables in the table. Due to open Bugs, we are checking for 369]
46+
include/assert.inc [Expect 375 persisted variables in the table. Due to open Bugs, we are checking for 370]
4747

4848
************************************************************
4949
* 3. Restart server, it must preserve the persisted variable
5050
* settings. Verify persisted configuration.
5151
************************************************************
5252
# restart
5353

54-
include/assert.inc [Expect 369 persisted variables in persisted_variables table.]
55-
include/assert.inc [Expect 369 persisted variables shown as PERSISTED in variables_info table.]
56-
include/assert.inc [Expect 369 persisted variables with matching peristed and global values.]
54+
include/assert.inc [Expect 370 persisted variables in persisted_variables table.]
55+
include/assert.inc [Expect 370 persisted variables shown as PERSISTED in variables_info table.]
56+
include/assert.inc [Expect 370 persisted variables with matching peristed and global values.]
5757

5858
************************************************************
5959
* 4. Test RESET PERSIST IF EXISTS. Verify persisted variable

‎mysql-test/r/mysqld--help-notwin.result

+4-1
Original file line numberDiff line numberDiff line change
@@ -1298,7 +1298,9 @@ The following options may be given as the first argument:
12981298
Define threads usage for handling queries, one of
12991299
one-thread-per-connection, no-threads, loaded-dynamically
13001300
--thread-stack=# The stack size for each thread
1301-
--tls-version=name TLS version, permitted values are TLSv1, TLSv1.1, TLSv1.2
1301+
--tls-ciphersuites=name
1302+
--tls-version=name TLS version, permitted values are TLSv1, TLSv1.1,
1303+
TLSv1.2, TLSv1.3
13021304
--tmp-table-size=# If an internal in-memory temporary table in the MEMORY
13031305
storage engine exceeds this size, MySQL will
13041306
automatically convert it to an on-disk table
@@ -1692,6 +1694,7 @@ temptable-use-mmap TRUE
16921694
thread-cache-size 9
16931695
thread-handling one-thread-per-connection
16941696
thread-stack 262144
1697+
tls-ciphersuites (No default value)
16951698
tmp-table-size 16777216
16961699
transaction-alloc-block-size 8192
16971700
transaction-isolation REPEATABLE-READ

‎mysql-test/r/mysqld--help-win.result

+4-1
Original file line numberDiff line numberDiff line change
@@ -1309,7 +1309,9 @@ The following options may be given as the first argument:
13091309
Define threads usage for handling queries, one of
13101310
one-thread-per-connection, no-threads, loaded-dynamically
13111311
--thread-stack=# The stack size for each thread
1312-
--tls-version=name TLS version, permitted values are TLSv1, TLSv1.1, TLSv1.2
1312+
--tls-ciphersuites=name
1313+
--tls-version=name TLS version, permitted values are TLSv1, TLSv1.1,
1314+
TLSv1.2, TLSv1.3
13131315
--tmp-table-size=# If an internal in-memory temporary table in the MEMORY
13141316
storage engine exceeds this size, MySQL will
13151317
automatically convert it to an on-disk table
@@ -1707,6 +1709,7 @@ temptable-use-mmap TRUE
17071709
thread-cache-size 9
17081710
thread-handling one-thread-per-connection
17091711
thread-stack 262144
1712+
tls-ciphersuites (No default value)
17101713
tmp-table-size 16777216
17111714
transaction-alloc-block-size 8192
17121715
transaction-isolation REPEATABLE-READ

‎mysql-test/r/openssl_1.result

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ SHOW STATUS LIKE 'Ssl_cipher';
9696
Variable_name Value
9797
Ssl_cipher AES128-SHA
9898
WARNING: no verification of server certificate will be done. Use --ssl-mode=VERIFY_CA or VERIFY_IDENTITY.
99-
mysqltest: Could not open connection 'default': 2026 SSL connection error: Failed to set ciphers to use
99+
mysqltest: Could not open connection 'default': 2026 SSL connection error: xxxx
100100
CREATE TABLE t1(a int);
101101
INSERT INTO t1 VALUES (1), (2);
102102

‎mysql-test/r/ssl_dynamic.result

+11-2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ present
2222
################## FR 1.2: check if new sessions get the new vals
2323
# Save the defaults
2424
SET @orig_ssl_cipher = @@global.ssl_cipher;
25+
SET @orig_tls_version = @@global.tls_version;
2526
# in ssl_con
2627
# check if the session has the original values
2728
SHOW STATUS LIKE 'Ssl_cipher';
@@ -30,6 +31,7 @@ Ssl_cipher orig_cipher
3031
# in default connection
3132
# setting new values for ssl_cipher
3233
SET GLOBAL ssl_cipher = "DHE-RSA-AES256-SHA256";
34+
SET GLOBAL tls_version = "TLSv1.2";
3335
ALTER INSTANCE RELOAD TLS;
3436
# in ssl_new_con
3537
# Save the new defaults
@@ -42,6 +44,7 @@ Ssl_cipher orig_cipher;
4244
# cleanup
4345
# in default connection
4446
SET GLOBAL ssl_cipher = @orig_ssl_cipher;
47+
SET GLOBAL tls_version = @orig_tls_version;
4548
ALTER INSTANCE RELOAD TLS;
4649
################## FR 1.5: new values effective only after RELOAD TLS
4750
# Save the defaults
@@ -123,6 +126,7 @@ SET @orig_ssl_capath= @@global.ssl_capath;
123126
SET @orig_ssl_crl= @@global.ssl_crl;
124127
SET @orig_ssl_crlpath= @@global.ssl_crlpath;
125128
SET @orig_ssl_cipher= @@global.ssl_cipher;
129+
SET @orig_tls_cipher= @@global.tls_ciphersuites;
126130
SET @orig_tls_version= @@global.tls_version;
127131
# Must pass
128132
SET GLOBAL ssl_ca = 'gizmo';
@@ -132,6 +136,7 @@ SET GLOBAL ssl_capath = 'gizmo';
132136
SET GLOBAL ssl_crl = 'gizmo';
133137
SET GLOBAL ssl_crlpath = 'gizmo';
134138
SET GLOBAL ssl_cipher = 'gizmo';
139+
SET GLOBAL tls_ciphersuites = 'gizmo';
135140
SET GLOBAL tls_version = 'gizmo';
136141
# Must fail
137142
SET SESSION ssl_ca = 'gizmo';
@@ -148,21 +153,24 @@ SET SESSION ssl_crlpath = 'gizmo';
148153
ERROR HY000: Variable 'ssl_crlpath' is a GLOBAL variable and should be set with SET GLOBAL
149154
SET SESSION ssl_cipher = 'gizmo';
150155
ERROR HY000: Variable 'ssl_cipher' is a GLOBAL variable and should be set with SET GLOBAL
156+
SET SESSION tls_ciphersuites = 'gizmo';
157+
ERROR HY000: Variable 'tls_ciphersuites' is a GLOBAL variable and should be set with SET GLOBAL
151158
SET SESSION tls_version = 'gizmo';
152159
ERROR HY000: Variable 'tls_version' is a GLOBAL variable and should be set with SET GLOBAL
153-
# FR6: Must return 8
160+
# FR6: Must return 9
154161
SELECT VARIABLE_NAME FROM performance_schema.session_status WHERE
155162
VARIABLE_NAME IN
156163
('Current_tls_ca', 'Current_tls_capath', 'Current_tls_cert',
157164
'Current_tls_key', 'Current_tls_version', 'Current_tls_cipher',
158-
'Current_tls_crl', 'Current_tls_crlpath') AND
165+
'Current_tls_ciphersuites', 'Current_tls_crl', 'Current_tls_crlpath') AND
159166
VARIABLE_VALUE != 'gizmo'
160167
ORDER BY VARIABLE_NAME;
161168
VARIABLE_NAME
162169
Current_tls_ca
163170
Current_tls_capath
164171
Current_tls_cert
165172
Current_tls_cipher
173+
Current_tls_ciphersuites
166174
Current_tls_crl
167175
Current_tls_crlpath
168176
Current_tls_key
@@ -175,6 +183,7 @@ SET GLOBAL ssl_capath = @orig_ssl_capath;
175183
SET GLOBAL ssl_crl = @orig_ssl_crl;
176184
SET GLOBAL ssl_crlpath = @orig_ssl_crlpath;
177185
SET GLOBAL ssl_cipher = @orig_ssl_cipher;
186+
SET GLOBAL tls_ciphersuites = @orig_tls_ciphersuites;
178187
SET GLOBAL tls_version = @orig_tls_version;
179188
################## FR8: X plugin do not follow
180189
# Save the defaults

‎mysql-test/suite/auth_sec/r/tls.result

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Variable_name Value
99
Ssl_cipher SSL_CIPHER
1010
#T3: Setting TLS version TLSv1.2 from the client
1111
Variable_name Value
12-
Ssl_version TLS_VERSION
12+
Ssl_version TLSv1.2
1313
#T4: Setting TLS version TLSv1.1 from the client
1414
Variable_name Value
1515
Ssl_version TLSv1.1

0 commit comments

Comments
 (0)