viosslfactories.cc File Reference

#include <assert.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/opensslv.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <stdio.h>
#include <string.h>
#include <string>
#include "m_string.h"
#include "my_dbug.h"
#include "my_inttypes.h"
#include "my_sys.h"
#include "my_thread.h"
#include "mysql/my_loglevel.h"
#include "mysql/psi/mysql_rwlock.h"
#include "mysql/service_mysql_alloc.h"
#include "mysql/strings/m_ctype.h"
#include "mysys_err.h"
#include "template_utils.h"
#include "vio/vio_priv.h"
#include <dh_ecdh_config.h>
#include <tls_ciphers.h>
#include "my_openssl_fips.h"

Macros
#define	TLS_VERSION_OPTION_SIZE   256
#define	TLS_SIGALGS_COMMON_LIST
#define	TLS_SIGALGS_NON_FIPS_EXTRA   ":ed25519:ECDSA+SHA224:RSA+SHA224"
#define	TLS_SIGALGS_PQC_EXTRA   "ML-DSA-44:ML-DSA-65:ML-DSA-87:"

Functions
static void	report_errors ()
const char *	sslGetErrString (enum enum_ssl_init_error e)
static const char *	get_sigalgs_list (bool tls_use_pqc_sign)
static int	vio_set_cert_stuff (SSL_CTX *ctx, const char *cert_file, const char *key_file, enum enum_ssl_init_error *error)
void	vio_ssl_end ()
void	ssl_start ()
long	process_tls_version (const char *tls_version)
static int	get_min_tls_version (long ssl_ctx_flags)
static int	get_max_tls_version (long ssl_ctx_flags)
static struct st_VioSSLFd *	new_VioSSLFd (const char *key_file, const char *cert_file, const char *ca_file, const char *ca_path, const char *cipher, const char *ciphersuites, bool is_client, enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path, const long ssl_ctx_flags, bool tls_force_pqc, bool tls_use_pqc_sign, const char *tls_kex, const char *server_host)
struct st_VioSSLFd *	new_VioSSLConnectorFd (const char *key_file, const char *cert_file, const char *ca_file, const char *ca_path, const char *cipher, const char *ciphersuites, enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path, const long ssl_ctx_flags, bool tls_force_pqc, bool tls_use_pqc_sign, const char *tls_kex, const char *server_host)
struct st_VioSSLFd *	new_VioSSLAcceptorFd (const char *key_file, const char *cert_file, const char *ca_file, const char *ca_path, const char *cipher, const char *ciphersuites, enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path, const long ssl_ctx_flags, bool tls_force_pqc, bool tls_use_pqc_sign, const char *tls_kex)
void	free_vio_ssl_acceptor_fd (struct st_VioSSLFd *fd)

Variables
static bool	ssl_initialized = false
static const char *	ssl_error_string []
static const char	tls_sigalgs_fips [] = TLS_SIGALGS_COMMON_LIST
static const char	tls_sigalgs_non_fips []

Macro Definition Documentation

TLS_SIGALGS_COMMON_LIST

#define TLS_SIGALGS_COMMON_LIST

Value:

  "ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_"      \
  "pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_" \
  "sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512"

TLS_SIGALGS_NON_FIPS_EXTRA

#define TLS_SIGALGS_NON_FIPS_EXTRA   ":ed25519:ECDSA+SHA224:RSA+SHA224"

TLS_SIGALGS_PQC_EXTRA

#define TLS_SIGALGS_PQC_EXTRA   "ML-DSA-44:ML-DSA-65:ML-DSA-87:"

TLS_VERSION_OPTION_SIZE

#define TLS_VERSION_OPTION_SIZE   256

Function Documentation

free_vio_ssl_acceptor_fd()

void free_vio_ssl_acceptor_fd

(

struct st_VioSSLFd *

fd

)

get_max_tls_version()

static int get_max_tls_version ( long  ssl_ctx_flags )

static

get_min_tls_version()

static int get_min_tls_version ( long  ssl_ctx_flags )

static

get_sigalgs_list()

static const char * get_sigalgs_list ( bool  tls_use_pqc_sign )

static

new_VioSSLAcceptorFd()

struct st_VioSSLFd * new_VioSSLAcceptorFd	(	const char *	key_file,
		const char *	cert_file,
		const char *	ca_file,
		const char *	ca_path,
		const char *	cipher,
		const char *	ciphersuites,
		enum enum_ssl_init_error *	error,
		const char *	crl_file,
		const char *	crl_path,
		const long	ssl_ctx_flags,
		bool	tls_force_pqc,
		bool	tls_use_pqc_sign,
		const char *	tls_kex
	)

new_VioSSLConnectorFd()

struct st_VioSSLFd * new_VioSSLConnectorFd	(	const char *	key_file,
		const char *	cert_file,
		const char *	ca_file,
		const char *	ca_path,
		const char *	cipher,
		const char *	ciphersuites,
		enum enum_ssl_init_error *	error,
		const char *	crl_file,
		const char *	crl_path,
		const long	ssl_ctx_flags,
		bool	tls_force_pqc,
		bool	tls_use_pqc_sign,
		const char *	tls_kex,
		const char *	server_host
	)

new_VioSSLFd()

static struct st_VioSSLFd * new_VioSSLFd ( const char *  key_file, const char *  cert_file, const char *  ca_file, const char *  ca_path, const char *  cipher, const char *  ciphersuites, bool  is_client, enum enum_ssl_init_error *  error, const char *  crl_file, const char *  crl_path, const long  ssl_ctx_flags, bool  tls_force_pqc, bool  tls_use_pqc_sign, const char *  tls_kex, const char *  server_host  )

static

process_tls_version()

long process_tls_version

(

const char *

tls_version

)

report_errors()

static void report_errors ( )

static

ssl_start()

void ssl_start

(

void

)

sslGetErrString()

const char * sslGetErrString

(

enum enum_ssl_init_error

e

)

vio_set_cert_stuff()

static int vio_set_cert_stuff ( SSL_CTX *  ctx, const char *  cert_file, const char *  key_file, enum enum_ssl_init_error *  error  )

static

vio_ssl_end()

void vio_ssl_end

(

)

Variable Documentation

ssl_error_string

const char* ssl_error_string[]

static

Initial value:

= {
    "No error",
    "Unable to get certificate",
    "Unable to get private key",
    "Private key does not match the certificate public key",
    "SSL_CTX_set_default_verify_paths failed",
    "Failed to set ciphers to use",
    "SSL_CTX_new failed",
    "SSL context is not usable without certificate and private key",
    "SSL_CTX_set_tmp_dh failed",
    "TLS version is invalid",
    "FIPS mode invalid",
    "FIPS mode failed",
    "Failed to set ecdh information",
    "Failed to set TLS key exchange groups",
    "force_pqc requires TLSv1.3 with OpenSSL 3.5.0 or newer",
    "Failed to set X509 verification parameter",
    "Invalid certificates",
    "Failed to set TLS signature algorithms",
    "Failed to set TLS session id context"}

ssl_initialized

bool ssl_initialized = false

static

tls_sigalgs_fips

const char tls_sigalgs_fips[] = TLS_SIGALGS_COMMON_LIST

static

tls_sigalgs_non_fips

const char tls_sigalgs_non_fips[]

static

Initial value:

=
    TLS_SIGALGS_COMMON_LIST TLS_SIGALGS_NON_FIPS_EXTRA