MySQL 8.1.0
Source Code Documentation
tls_server_context.h
Go to the documentation of this file.
1/*
2 Copyright (c) 2018, 2023, Oracle and/or its affiliates.
3
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License, version 2.0,
6 as published by the Free Software Foundation.
7
8 This program is also distributed with certain software (including
9 but not limited to OpenSSL) that is licensed under separate terms,
10 as designated in a particular file or component or in included license
11 documentation. The authors of MySQL hereby grant you an additional
12 permission to link the program and your derivative works with the
13 separately licensed software that they have included with MySQL.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23*/
24
25#ifndef MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
26#define MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
27
28#include <array>
29#include <bitset>
30#include <string>
31#include <vector>
32
36
37namespace TlsVerifyOpts {
38constexpr size_t kFailIfNoPeerCert = 1 << 0;
39constexpr size_t kClientOnce = 1 << 1;
40} // namespace TlsVerifyOpts
41
42/**
43 * TLS Context for the server side.
44 */
46 public:
47 /**
48 * unacceptable ciphers.
49 *
50 * they are filtered out if set through cipher_list()
51 */
52 static constexpr std::array<const char *, 12> unacceptable_cipher_spec{
53 "!aNULL", "!eNULL", "!EXPORT", "!LOW", "!MD5", "!DES",
54 "!3DES", "!RC2", "!RC4", "!PSK", "!kDH", "!SSLv3"};
55
56 /**
57 * construct a TLS Context for server-side.
58 */
60 TlsVersion max_version = TlsVersion::AUTO,
61 bool session_cache_mode = false,
62 size_t session_cache_size = 0,
63 unsigned int session_cache_timeout = 0);
64
65 /**
66 * load key and cert.
67 *
68 * cerifiticate is verified against the key
69 *
70 * @param private_key_file filename of a PEM file containing a key
71 * @param cert_chain_file filename of a PEM file containing a certificate
72 */
74 const std::string &private_key_file, const std::string &cert_chain_file);
75
76 /**
77 * init temporary DH parameters.
78 *
79 * @param dh_params filename of a PEM file with DH parameters
80 */
82 const std::string &dh_params);
83
84 /**
85 * set cipher-list.
86 *
87 * list is filtered for unacceptable_cipher_spec
88 *
89 * @param ciphers colon separated list of ciphers
90 *
91 * @see openssl ciphers
92 */
93 stdx::expected<void, std::error_code> cipher_list(const std::string &ciphers);
94
95 /**
96 * set how cerifiticates should be verified.
97 *
98 * @param verify NONE or PEER
99 * @param tls_opts extra options for PEER
100 * @throws std::illegal_argument if verify is NONE and tls_opts is != 0
101 */
103 std::bitset<2> tls_opts = 0);
104
105 /**
106 * get the security level.
107 *
108 * | sec-level | RSA-min-key-size |
109 * +-----------+------------------+
110 * | 1 | 1024 |
111 * | 2 | 2048 |
112 * | 3 | 3072 |
113 * | 4 | 7680 |
114 * | 5 | 15360 |
115 *
116 * @see SSL_CTX_get_security_level()
117 *
118 * @returns the security level of the ssl-ctx.
119 */
120 int security_level() const;
121
122 /**
123 * default ciphers.
124 */
125 static std::vector<std::string> default_ciphers();
126
127 /**
128 * set the session-id context for ssl-context reuse.
129 *
130 * unique identifier of the ssl-ctx.
131 *
132 * @param sid_ctx opaque string of size sid_ctx_len
133 * @param sid_ctx_len length of sid_ctx_len
134 */
135 stdx::expected<void, std::error_code> session_id_context(
136 const unsigned char *sid_ctx, unsigned int sid_ctx_len);
137};
138
139#endif
wraps SSL_CTX.
Definition: tls_context.h:84
std::vector< std::string > cipher_list() const
get current cipher-list.
Definition: tls_context.cc:356
int security_level() const
get security_level.
Definition: tls_context.cc:384
TLS Context for the server side.
Definition: tls_server_context.h:45
Definition: expected.h:943
Definition: tls_server_context.h:37
constexpr size_t kClientOnce
Definition: tls_server_context.h:39
constexpr size_t kFailIfNoPeerCert
Definition: tls_server_context.h:38
bool verify(const std::string &digest, const std::string &message, const std::string &public_key_content)
Verify a message signed by the private key pair of the provided public key.
Definition: ssl.cc:114
TlsVerify
Verification of Cerifiticates.
Definition: tls_context.h:61
TlsVersion
TLS Versions.
Definition: tls_context.h:53
#define HARNESS_TLS_EXPORT
Definition: tls_export.h:15