MySQL 8.4.3
Source Code Documentation
ssl_init_callback.h
Go to the documentation of this file.
1/* Copyright (c) 2020, 2024, Oracle and/or its affiliates.
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License, version 2.0,
5 as published by the Free Software Foundation.
6
7 This program is designed to work with certain software (including
8 but not limited to OpenSSL) that is licensed under separate terms,
9 as designated in a particular file or component or in included license
10 documentation. The authors of MySQL hereby grant you an additional
11 permission to link the program and your derivative works with the
12 separately licensed software that they have either included with
13 the program or referenced in the documentation.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License, version 2.0, for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
23
24#ifndef SSL_INIT_CALLBACK_INCLUDED
25#define SSL_INIT_CALLBACK_INCLUDED
26
27#include <atomic>
28#include <string>
29
30#include <sql/auth/auth_common.h> /* ssl_artifacts_status */
31
32/** The runtime value of whether admin TLS used different config or not */
33extern std::atomic_bool g_admin_ssl_configured;
34/**
35 The configure time value of whether admin TLS used different config or not.
36 The value for this is determined during system variable update.
37 True means that the ADMIN channel is using its own TLS configuration.
38 False means that the ADMIN channel is reusing the main channel's
39 TLS configuration.
40 To put this value into effect (and update @ref g_admin_ssl_configured)
41 one needs to execute the "ALTER INSTANCE RELOAD TLS" SQL command.
42*/
43extern bool opt_admin_ssl_configured;
44
45extern std::string mysql_main_channel;
46extern std::string mysql_admin_channel;
48
49/** helper class to deal with optionally empty strings */
51 public:
53 OptionalString(const char *s) : value_(s ? s : ""), empty_(!s) {}
54 ~OptionalString() = default;
55 OptionalString(const OptionalString &) = default;
56
57 const char *c_str() const { return empty_ ? nullptr : value_.c_str(); }
58 OptionalString &assign(const char *s) {
59 value_.assign(s ? s : "");
60 empty_ = !s;
61 return *this;
62 }
63
64 private:
65 std::string value_;
66 bool empty_;
67};
68
69/* Class to encasulate callbacks for init/reinit */
71 public:
74 OptionalString *cipher,
75 OptionalString *ciphersuites,
77 OptionalString *crl_path,
79 long *session_cache_timeout) = 0;
80
81 virtual bool provision_certs() = 0;
82
83 virtual bool warn_self_signed_ca() = 0;
84
85 virtual ~Ssl_init_callback() = default;
86};
87
88/**
89 Class to encasulate callbacks for init/reinit
90 for client server connection port
91*/
93 public:
96 OptionalString *cipher, OptionalString *ciphersuites,
98 OptionalString *crl_path, bool *session_cache_mode,
99 long *session_cache_timeout) override;
100
101 bool provision_certs() override;
102
103 bool warn_self_signed_ca() override;
104
105 ~Ssl_init_callback_server_main() override = default;
106
107 private:
109};
110
111/**
112 Class to encasulate callbacks for init/reinit
113 for admin connection port
114*/
116 public:
119 OptionalString *cipher, OptionalString *ciphersuites,
121 OptionalString *crl_path, bool *session_cache_mode,
122 long *session_cache_timeout) override;
123
124 bool provision_certs() override {
125 /*
126 No automatic provisioning. Always return
127 success to fallback to system variables.
128 */
129 return false;
130 }
131
132 bool warn_self_signed_ca() override;
133
135};
136
139
140/**
141 Helper method to validate values of --tls-version and --admin-tls-version
142*/
143bool validate_tls_version(const char *val);
144
145enum class TLS_version { TLSv12 = 0, TLSv13 };
146/**
147 Helper method to validate values of --ssl-cipher and --admin-ssl-cipher
148*/
149bool validate_ciphers(const char *option, const char *val, TLS_version version);
150#endif // !SSL_INIT_CALLBACK_INCLUDED
ssl_artifacts_status
Definition: auth_common.h:899
Kerberos Client Authentication nullptr
Definition: auth_kerberos_client_plugin.cc:251
helper class to deal with optionally empty strings
Definition: ssl_init_callback.h:50
OptionalString & assign(const char *s)
Definition: ssl_init_callback.h:58
~OptionalString()=default
OptionalString(const char *s)
Definition: ssl_init_callback.h:53
std::string value_
Definition: ssl_init_callback.h:65
OptionalString(const OptionalString &)=default
bool empty_
Definition: ssl_init_callback.h:66
OptionalString()
Definition: ssl_init_callback.h:52
const char * c_str() const
Definition: ssl_init_callback.h:57
Class to encasulate callbacks for init/reinit for admin connection port.
Definition: ssl_init_callback.h:115
bool warn_self_signed_ca() override
Definition: ssl_init_callback.cc:500
~Ssl_init_callback_server_admin() override=default
void read_parameters(OptionalString *ca, OptionalString *capath, OptionalString *version, OptionalString *cert, OptionalString *cipher, OptionalString *ciphersuites, OptionalString *key, OptionalString *crl, OptionalString *crl_path, bool *session_cache_mode, long *session_cache_timeout) override
Definition: ssl_init_callback.cc:478
bool provision_certs() override
Definition: ssl_init_callback.h:124
Class to encasulate callbacks for init/reinit for client server connection port.
Definition: ssl_init_callback.h:92
bool provision_certs() override
Definition: ssl_init_callback.cc:459
bool warn_self_signed_ca() override
Definition: ssl_init_callback.cc:471
~Ssl_init_callback_server_main() override=default
void read_parameters(OptionalString *ca, OptionalString *capath, OptionalString *version, OptionalString *cert, OptionalString *cipher, OptionalString *ciphersuites, OptionalString *key, OptionalString *crl, OptionalString *crl_path, bool *session_cache_mode, long *session_cache_timeout) override
Definition: ssl_init_callback.cc:400
ssl_artifacts_status auto_detect_ssl()
Definition: ssl_init_callback.cc:420
Definition: ssl_init_callback.h:70
virtual void read_parameters(OptionalString *ca, OptionalString *capath, OptionalString *version, OptionalString *cert, OptionalString *cipher, OptionalString *ciphersuites, OptionalString *key, OptionalString *crl, OptionalString *crl_path, bool *session_cache_mode, long *session_cache_timeout)=0
virtual bool warn_self_signed_ca()=0
virtual bool provision_certs()=0
virtual ~Ssl_init_callback()=default
required string key
Definition: replication_asynchronous_connection_failover.proto:60
required uint64 version
Definition: replication_group_member_actions.proto:41
std::string mysql_admin_channel
std::string mysql_main_channel
Ssl_init_callback_server_admin server_admin_callback
Definition: ssl_init_callback.cc:506
bool opt_admin_ssl_configured
The configure time value of whether admin TLS used different config or not.
Definition: ssl_init_callback.cc:70
bool opt_tls_certificates_enforced_validation
SSL context options.
Definition: ssl_init_callback.cc:43
bool validate_ciphers(const char *option, const char *val, TLS_version version)
Helper method to validate values of –ssl-cipher and –admin-ssl-cipher.
Definition: ssl_init_callback.cc:100
TLS_version
Definition: ssl_init_callback.h:145
bool validate_tls_version(const char *val)
Helper method to validate values of –tls-version and –admin-tls-version.
Definition: ssl_init_callback.cc:74
std::atomic_bool g_admin_ssl_configured
The runtime value of whether admin TLS used different config or not.
Ssl_init_callback_server_main server_main_callback
Definition: ssl_init_callback.cc:505