MySQL 8.0.29
Source Code Documentation
tls_server_context.h
Go to the documentation of this file.
1/*
2 Copyright (c) 2018, 2021, Oracle and/or its affiliates.
3
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License, version 2.0,
6 as published by the Free Software Foundation.
7
8 This program is also distributed with certain software (including
9 but not limited to OpenSSL) that is licensed under separate terms,
10 as designated in a particular file or component or in included license
11 documentation. The authors of MySQL hereby grant you an additional
12 permission to link the program and your derivative works with the
13 separately licensed software that they have included with MySQL.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23*/
24
25#ifndef MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
26#define MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
27
28#include <array>
29#include <bitset>
30#include <string>
31#include <vector>
32
36
37namespace TlsVerifyOpts {
38constexpr size_t kFailIfNoPeerCert = 1 << 0;
39constexpr size_t kClientOnce = 1 << 1;
40} // namespace TlsVerifyOpts
41
42/**
43 * TLS Context for the server side.
44 */
46 public:
47 /**
48 * unacceptable ciphers.
49 *
50 * they are filtered out if set through cipher_list()
51 */
52 static constexpr std::array<const char *, 9> unacceptable_cipher_spec{
53 "!aNULL", "!eNULL", "!EXPORT", "!MD5", "!DES",
54 "!RC2", "!RC4", "!PSK", "!SSLv3"};
55
56 /**
57 * construct a TLS Context for server-side.
58 */
60 TlsVersion max_version = TlsVersion::AUTO);
61
62 /**
63 * load key and cert.
64 *
65 * cerifiticate is verified against the key
66 *
67 * @param cert_chain_file filename of a PEM file containing a certificate
68 * @param private_key_file filename of a PEM file containing a key
69 */
71 const std::string &cert_chain_file, const std::string &private_key_file);
72
73 /**
74 * init temporary DH parameters.
75 *
76 * @param dh_params filename of a PEM file with DH parameters
77 */
79 const std::string &dh_params);
80
81 /**
82 * set cipher-list.
83 *
84 * list is filtered for unacceptable_cipher_spec
85 *
86 * @param ciphers colon separated list of ciphers
87 *
88 * @see openssl ciphers
89 */
90 stdx::expected<void, std::error_code> cipher_list(const std::string &ciphers);
91
92 /**
93 * set how cerifiticates should be verified.
94 *
95 * @param verify NONE or PEER
96 * @param tls_opts extra options for PEER
97 * @throws std::illegal_argument if verify is NONE and tls_opts is != 0
98 */
100 std::bitset<2> tls_opts = 0);
101
102 /**
103 * default ciphers.
104 */
105 static std::vector<std::string> default_ciphers();
106};
107
108#endif
wraps SSL_CTX.
Definition: tls_context.h:85
std::vector< std::string > cipher_list() const
get current cipher-list.
Definition: tls_context.cc:356
TLS Context for the server side.
Definition: tls_server_context.h:45
Definition: expected.h:936
Definition: tls_server_context.h:37
constexpr size_t kClientOnce
Definition: tls_server_context.h:39
constexpr size_t kFailIfNoPeerCert
Definition: tls_server_context.h:38
bool verify(const std::string &digest, const std::string &message, const std::string &public_key_content)
Verify a message signed by the private key pair of the provided public key.
Definition: ssl.cc:114
TlsVerify
Verification of Cerifiticates.
Definition: tls_context.h:61
TlsVersion
TLS Versions.
Definition: tls_context.h:53
#define HARNESS_TLS_EXPORT
Definition: tls_export.h:15