MySQL 8.3.0
Source Code Documentation
tls_server_context.h
Go to the documentation of this file.
1/*
2 Copyright (c) 2018, 2023, Oracle and/or its affiliates.
3
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License, version 2.0,
6 as published by the Free Software Foundation.
7
8 This program is also distributed with certain software (including
9 but not limited to OpenSSL) that is licensed under separate terms,
10 as designated in a particular file or component or in included license
11 documentation. The authors of MySQL hereby grant you an additional
12 permission to link the program and your derivative works with the
13 separately licensed software that they have included with MySQL.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23*/
24
25#ifndef MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
26#define MYSQL_HARNESS_TLS_SERVER_CONTEXT_INCLUDED
27
28#include <array>
29#include <string>
30#include <vector>
31
36
37enum class TlsVerifyOpts {
39 kClientOnce = 1,
40};
41
42namespace stdx {
43template <>
44struct is_flags<TlsVerifyOpts> : std::true_type {};
45} // namespace stdx
46
47/**
48 * TLS Context for the server side.
49 */
51 public:
52 /**
53 * unacceptable ciphers.
54 *
55 * they are filtered out if set through cipher_list()
56 */
57 static constexpr std::array<const char *, 12> unacceptable_cipher_spec{
58 "!aNULL", "!eNULL", "!EXPORT", "!LOW", "!MD5", "!DES",
59 "!3DES", "!RC2", "!RC4", "!PSK", "!kDH", "!SSLv3"};
60
61 /**
62 * construct a TLS Context for server-side.
63 */
65 TlsVersion max_version = TlsVersion::AUTO,
66 bool session_cache_mode = false,
67 size_t session_cache_size = 0,
68 unsigned int session_cache_timeout = 0);
69
70 /**
71 * init temporary DH parameters.
72 *
73 * @param dh_params filename of a PEM file with DH parameters
74 */
76 const std::string &dh_params);
77
78 /**
79 * set cipher-list.
80 *
81 * list is filtered for unacceptable_cipher_spec
82 *
83 * @param ciphers colon separated list of ciphers
84 *
85 * @see openssl ciphers
86 */
87 stdx::expected<void, std::error_code> cipher_list(const std::string &ciphers);
88
89 /**
90 * set how cerifiticates should be verified.
91 *
92 * @param verify NONE or PEER
93 * @param tls_opts extra options for PEER
94 * @throws std::illegal_argument if verify is NONE and tls_opts is != 0
95 */
98
99 /**
100 * get the security level.
101 *
102 * | sec-level | RSA-min-key-size |
103 * +-----------+------------------+
104 * | 1 | 1024 |
105 * | 2 | 2048 |
106 * | 3 | 3072 |
107 * | 4 | 7680 |
108 * | 5 | 15360 |
109 *
110 * @see SSL_CTX_get_security_level()
111 *
112 * @returns the security level of the ssl-ctx.
113 */
114 int security_level() const;
115
116 /**
117 * default ciphers.
118 */
119 static std::vector<std::string> default_ciphers();
120
121 /**
122 * set the session-id context for ssl-context reuse.
123 *
124 * unique identifier of the ssl-ctx.
125 *
126 * @param sid_ctx opaque string of size sid_ctx_len
127 * @param sid_ctx_len length of sid_ctx_len
128 */
129 stdx::expected<void, std::error_code> session_id_context(
130 const unsigned char *sid_ctx, unsigned int sid_ctx_len);
131};
132
133#endif
wraps SSL_CTX.
Definition: tls_context.h:84
std::vector< std::string > cipher_list() const
get current cipher-list.
Definition: tls_context.cc:392
int security_level() const
get security_level.
Definition: tls_context.cc:516
TLS Context for the server side.
Definition: tls_server_context.h:50
Definition: expected.h:943
a type-safe flags type.
Definition: flags.h:114
bool verify(const std::string &digest, const std::string &message, const std::string &public_key_content)
Verify a message signed by the private key pair of the provided public key.
Definition: ssl.cc:114
Definition: bit.h:33
Definition: flags.h:37
TlsVerify
Verification of Cerifiticates.
Definition: tls_context.h:61
TlsVersion
TLS Versions.
Definition: tls_context.h:53
#define HARNESS_TLS_EXPORT
Definition: tls_export.h:15
TlsVerifyOpts
Definition: tls_server_context.h:37