diff options
Diffstat (limited to 'mysql/vio')
| -rw-r--r-- | mysql/vio/vio.c | 459 | ||||
| -rw-r--r-- | mysql/vio/vio_priv.h | 67 | ||||
| -rw-r--r-- | mysql/vio/viopipe.c | 117 | ||||
| -rw-r--r-- | mysql/vio/vioshm.c | 226 | ||||
| -rw-r--r-- | mysql/vio/viosocket.c | 1140 | ||||
| -rw-r--r-- | mysql/vio/viossl.c | 511 | ||||
| -rw-r--r-- | mysql/vio/viosslfactories.c | 729 |
7 files changed, 0 insertions, 3249 deletions
diff --git a/mysql/vio/vio.c b/mysql/vio/vio.c deleted file mode 100644 index 1be1540..0000000 --- a/mysql/vio/vio.c +++ /dev/null @@ -1,459 +0,0 @@ -/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -/* - Note that we can't have assertion on file descriptors; The reason for - this is that during mysql shutdown, another thread can close a file - we are working on. In this case we should just return read errors from - the file descriptior. -*/ - -#include "vio_priv.h" - -#ifdef HAVE_OPENSSL -PSI_memory_key key_memory_vio_ssl_fd; -#endif - -PSI_memory_key key_memory_vio; -PSI_memory_key key_memory_vio_read_buffer; - -#ifdef HAVE_PSI_INTERFACE -static PSI_memory_info all_vio_memory[]= -{ -#ifdef HAVE_OPENSSL - {&key_memory_vio_ssl_fd, "ssl_fd", 0}, -#endif - - {&key_memory_vio, "vio", 0}, - {&key_memory_vio_read_buffer, "read_buffer", 0}, -}; - -void init_vio_psi_keys() -{ - const char* category= "vio"; - int count; - - count= array_elements(all_vio_memory); - mysql_memory_register(category, all_vio_memory, count); -} -#endif - -#ifdef _WIN32 - -/** - Stub io_wait method that defaults to indicate that - requested I/O event is ready. - - Used for named pipe and shared memory VIO types. - - @param vio Unused. - @param event Unused. - @param timeout Unused. - - @retval 1 The requested I/O event has occurred. -*/ - -static int no_io_wait(Vio *vio MY_ATTRIBUTE((unused)), - enum enum_vio_io_event event MY_ATTRIBUTE((unused)), - int timeout MY_ATTRIBUTE((unused))) -{ - return 1; -} - -#endif - -static my_bool has_no_data(Vio *vio MY_ATTRIBUTE((unused))) -{ - return FALSE; -} - -/* - * Helper to fill most of the Vio* with defaults. - */ - -static void vio_init(Vio *vio, enum enum_vio_type type, - my_socket sd, uint flags) -{ - DBUG_ENTER("vio_init"); - DBUG_PRINT("enter", ("type: %d sd: %d flags: %d", type, sd, flags)); - - memset(vio, 0, sizeof(*vio)); - vio->type= type; - vio->mysql_socket= MYSQL_INVALID_SOCKET; - mysql_socket_setfd(&vio->mysql_socket, sd); - vio->localhost= flags & VIO_LOCALHOST; - vio->read_timeout= vio->write_timeout= -1; - if ((flags & VIO_BUFFERED_READ) && - !(vio->read_buffer= (char*)my_malloc(key_memory_vio_read_buffer, - VIO_READ_BUFFER_SIZE, MYF(MY_WME)))) - flags&= ~VIO_BUFFERED_READ; -#ifdef _WIN32 - if (type == VIO_TYPE_NAMEDPIPE) - { - vio->viodelete =vio_delete; - vio->vioerrno =vio_errno; - vio->read =vio_read_pipe; - vio->write =vio_write_pipe; - vio->fastsend =vio_fastsend; - vio->viokeepalive =vio_keepalive; - vio->should_retry =vio_should_retry; - vio->was_timeout =vio_was_timeout; - vio->vioshutdown =vio_shutdown_pipe; - vio->peer_addr =vio_peer_addr; - vio->io_wait =no_io_wait; - vio->is_connected =vio_is_connected_pipe; - vio->has_data =has_no_data; - DBUG_VOID_RETURN; - } -#ifndef EMBEDDED_LIBRARY - if (type == VIO_TYPE_SHARED_MEMORY) - { - vio->viodelete =vio_delete_shared_memory; - vio->vioerrno =vio_errno; - vio->read =vio_read_shared_memory; - vio->write =vio_write_shared_memory; - vio->fastsend =vio_fastsend; - vio->viokeepalive =vio_keepalive; - vio->should_retry =vio_should_retry; - vio->was_timeout =vio_was_timeout; - vio->vioshutdown =vio_shutdown_shared_memory; - vio->peer_addr =vio_peer_addr; - vio->io_wait =no_io_wait; - vio->is_connected =vio_is_connected_shared_memory; - vio->has_data =has_no_data; - DBUG_VOID_RETURN; - } -#endif /* !EMBEDDED_LIBRARY */ -#endif /* _WIN32 */ -#ifdef HAVE_OPENSSL - if (type == VIO_TYPE_SSL) - { - vio->viodelete =vio_ssl_delete; - vio->vioerrno =vio_errno; - vio->read =vio_ssl_read; - vio->write =vio_ssl_write; - vio->fastsend =vio_fastsend; - vio->viokeepalive =vio_keepalive; - vio->should_retry =vio_should_retry; - vio->was_timeout =vio_was_timeout; - vio->vioshutdown =vio_ssl_shutdown; - vio->peer_addr =vio_peer_addr; - vio->io_wait =vio_io_wait; - vio->is_connected =vio_is_connected; - vio->has_data =vio_ssl_has_data; - vio->timeout =vio_socket_timeout; - DBUG_VOID_RETURN; - } -#endif /* HAVE_OPENSSL */ - vio->viodelete =vio_delete; - vio->vioerrno =vio_errno; - vio->read= (flags & VIO_BUFFERED_READ) ? vio_read_buff : vio_read; - vio->write =vio_write; - vio->fastsend =vio_fastsend; - vio->viokeepalive =vio_keepalive; - vio->should_retry =vio_should_retry; - vio->was_timeout =vio_was_timeout; - vio->vioshutdown =vio_shutdown; - vio->peer_addr =vio_peer_addr; - vio->io_wait =vio_io_wait; - vio->is_connected =vio_is_connected; - vio->timeout =vio_socket_timeout; - vio->has_data= (flags & VIO_BUFFERED_READ) ? - vio_buff_has_data : has_no_data; - DBUG_VOID_RETURN; -} - - -/** - Reinitialize an existing Vio object. - - @remark Used to rebind an initialized socket-based Vio object - to another socket-based transport type. For example, - rebind a TCP/IP transport to SSL. - - @remark If new socket handle passed to vio_reset() is not equal - to the socket handle stored in Vio then socket handle will - be closed before storing new value. If handles are equal - then old socket is not closed. This is important for - vio_reset() usage in ssl_do(). - - @remark If any error occurs then Vio members won't be altered thus - preserving socket handle stored in Vio and not taking - ownership over socket handle passed as parameter. - - @param vio A VIO object. - @param type A socket-based transport type. - @param sd The socket. - @param ssl An optional SSL structure. - @param flags Flags passed to vio_init. - - @return Return value is zero on success. -*/ - -my_bool vio_reset(Vio* vio, enum enum_vio_type type, - my_socket sd, void *ssl MY_ATTRIBUTE((unused)), uint flags) -{ - int ret= FALSE; - Vio new_vio; - DBUG_ENTER("vio_reset"); - - /* The only supported rebind is from a socket-based transport type. */ - DBUG_ASSERT(vio->type == VIO_TYPE_TCPIP || vio->type == VIO_TYPE_SOCKET); - - vio_init(&new_vio, type, sd, flags); - - /* Preserve perfschema info for this connection */ - new_vio.mysql_socket.m_psi= vio->mysql_socket.m_psi; - -#ifdef HAVE_OPENSSL - new_vio.ssl_arg= ssl; -#endif - - /* - Propagate the timeout values. Necessary to also propagate - the underlying proprieties associated with the timeout, - such as the socket blocking mode. - */ - if (vio->read_timeout >= 0) - ret|= vio_timeout(&new_vio, 0, vio->read_timeout / 1000); - - if (vio->write_timeout >= 0) - ret|= vio_timeout(&new_vio, 1, vio->write_timeout / 1000); - - if (ret) - { - /* - vio_reset() failed - free resources allocated by vio_init - */ - my_free(new_vio.read_buffer); - } - else - { - /* - vio_reset() succeeded - free old resources and then overwrite VIO structure - */ - - /* - Close socket only when it is not equal to the new one. - */ - if (sd != mysql_socket_getfd(vio->mysql_socket)) - if (vio->inactive == FALSE) - vio->vioshutdown(vio); - - my_free(vio->read_buffer); - - *vio= new_vio; - } - - DBUG_RETURN(MY_TEST(ret)); -} - - -/* Create a new VIO for socket or TCP/IP connection. */ - -Vio *mysql_socket_vio_new(MYSQL_SOCKET mysql_socket, enum enum_vio_type type, uint flags) -{ - Vio *vio; - my_socket sd= mysql_socket_getfd(mysql_socket); - DBUG_ENTER("mysql_socket_vio_new"); - DBUG_PRINT("enter", ("sd: %d", sd)); - if ((vio = (Vio*) my_malloc(key_memory_vio, - sizeof(*vio),MYF(MY_WME)))) - { - vio_init(vio, type, sd, flags); - vio->mysql_socket= mysql_socket; - } - DBUG_RETURN(vio); -} - -/* Open the socket or TCP/IP connection and read the fnctl() status */ - -Vio *vio_new(my_socket sd, enum enum_vio_type type, uint flags) -{ - Vio *vio; - MYSQL_SOCKET mysql_socket= MYSQL_INVALID_SOCKET; - DBUG_ENTER("vio_new"); - DBUG_PRINT("enter", ("sd: %d", sd)); - - mysql_socket_setfd(&mysql_socket, sd); - vio = mysql_socket_vio_new(mysql_socket, type, flags); - - DBUG_RETURN(vio); -} - -#ifdef _WIN32 - -Vio *vio_new_win32pipe(HANDLE hPipe) -{ - Vio *vio; - DBUG_ENTER("vio_new_handle"); - if ((vio = (Vio*) my_malloc(key_memory_vio, - sizeof(Vio),MYF(MY_WME)))) - { - vio_init(vio, VIO_TYPE_NAMEDPIPE, 0, VIO_LOCALHOST); - /* Create an object for event notification. */ - vio->overlapped.hEvent= CreateEvent(NULL, FALSE, FALSE, NULL); - if (vio->overlapped.hEvent == NULL) - { - my_free(vio); - DBUG_RETURN(NULL); - } - vio->hPipe= hPipe; - my_stpcpy(vio->desc, "named pipe"); - } - DBUG_RETURN(vio); -} - -#ifndef EMBEDDED_LIBRARY -Vio *vio_new_win32shared_memory(HANDLE handle_file_map, HANDLE handle_map, - HANDLE event_server_wrote, HANDLE event_server_read, - HANDLE event_client_wrote, HANDLE event_client_read, - HANDLE event_conn_closed) -{ - Vio *vio; - DBUG_ENTER("vio_new_win32shared_memory"); - if ((vio = (Vio*) my_malloc(key_memory_vio, - sizeof(Vio),MYF(MY_WME)))) - { - vio_init(vio, VIO_TYPE_SHARED_MEMORY, 0, VIO_LOCALHOST); - vio->handle_file_map= handle_file_map; - vio->handle_map= handle_map; - vio->event_server_wrote= event_server_wrote; - vio->event_server_read= event_server_read; - vio->event_client_wrote= event_client_wrote; - vio->event_client_read= event_client_read; - vio->event_conn_closed= event_conn_closed; - vio->shared_memory_remain= 0; - vio->shared_memory_pos= handle_map; - my_stpcpy(vio->desc, "shared memory"); - } - DBUG_RETURN(vio); -} -#endif -#endif - - -/** - Set timeout for a network send or receive operation. - - @remark A non-infinite timeout causes the socket to be - set to non-blocking mode. On infinite timeouts, - the socket is set to blocking mode. - - @remark A negative timeout means an infinite timeout. - - @param vio A VIO object. - @param which Whether timeout is for send (1) or receive (0). - @param timeout Timeout interval in seconds. - - @return FALSE on success, TRUE otherwise. -*/ - -int vio_timeout(Vio *vio, uint which, int timeout_sec) -{ - int timeout_ms; - my_bool old_mode; - - /* - Vio timeouts are measured in milliseconds. Check for a possible - overflow. In case of overflow, set to infinite. - */ - if (timeout_sec > INT_MAX/1000) - timeout_ms= -1; - else - timeout_ms= (int) (timeout_sec * 1000); - - /* Deduce the current timeout status mode. */ - old_mode= vio->write_timeout < 0 && vio->read_timeout < 0; - - if (which) - vio->write_timeout= timeout_ms; - else - vio->read_timeout= timeout_ms; - - /* VIO-specific timeout handling. Might change the blocking mode. */ - return vio->timeout ? vio->timeout(vio, which, old_mode) : 0; -} - - -void vio_delete(Vio* vio) -{ - if (!vio) - return; /* It must be safe to delete null pointers. */ - - if (vio->inactive == FALSE) - vio->vioshutdown(vio); - my_free(vio->read_buffer); - my_free(vio); -} - - -/* - Cleanup memory allocated by vio or the - components below it when application finish - -*/ -void vio_end(void) -{ -#if defined(HAVE_YASSL) - yaSSL_CleanUp(); -#elif defined(HAVE_OPENSSL) - vio_ssl_end(); -#endif -} - -struct vio_string -{ - const char * m_str; - int m_len; -}; -typedef struct vio_string vio_string; - -/** - Names for each VIO TYPE. - Indexed by enum_vio_type. - If you add more, please update audit_log.cc -*/ -static const vio_string vio_type_names[] = -{ - { "", 0}, - { C_STRING_WITH_LEN("TCP/IP") }, - { C_STRING_WITH_LEN("Socket") }, - { C_STRING_WITH_LEN("Named Pipe") }, - { C_STRING_WITH_LEN("SSL/TLS") }, - { C_STRING_WITH_LEN("Shared Memory") }, - { C_STRING_WITH_LEN("Internal") }, - { C_STRING_WITH_LEN("Plugin") } -}; - -void get_vio_type_name(enum enum_vio_type vio_type, const char ** str, int * len) -{ - int index; - - if ((vio_type >= FIRST_VIO_TYPE) && (vio_type <= LAST_VIO_TYPE)) - { - index= vio_type; - } - else - { - index= 0; - } - *str= vio_type_names[index].m_str; - *len= vio_type_names[index].m_len; - return; -} - diff --git a/mysql/vio/vio_priv.h b/mysql/vio/vio_priv.h deleted file mode 100644 index 11eadbb..0000000 --- a/mysql/vio/vio_priv.h +++ /dev/null @@ -1,67 +0,0 @@ -/* Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -#ifndef VIO_PRIV_INCLUDED -#define VIO_PRIV_INCLUDED - -/* Structures and functions private to the vio package */ - -#define DONT_MAP_VIO -#include <my_global.h> -#include <mysql_com.h> -#include <my_sys.h> -#include <m_string.h> -#include <violite.h> - -#include "mysql/psi/psi_memory.h" - -extern PSI_memory_key key_memory_vio; -extern PSI_memory_key key_memory_vio_read_buffer; - -#ifdef HAVE_OPENSSL -extern PSI_memory_key key_memory_vio_ssl_fd; -#endif - - -#ifdef _WIN32 -size_t vio_read_pipe(Vio *vio, uchar * buf, size_t size); -size_t vio_write_pipe(Vio *vio, const uchar * buf, size_t size); -my_bool vio_is_connected_pipe(Vio *vio); -int vio_shutdown_pipe(Vio * vio); - -#ifndef EMBEDDED_LIBRARY -size_t vio_read_shared_memory(Vio *vio, uchar * buf, size_t size); -size_t vio_write_shared_memory(Vio *vio, const uchar * buf, size_t size); -my_bool vio_is_connected_shared_memory(Vio *vio); -int vio_shutdown_shared_memory(Vio * vio); -void vio_delete_shared_memory(Vio *vio); -#endif /* !EMBEDDED_LIBRARY */ -#endif /* _WIN32 */ - -my_bool vio_buff_has_data(Vio *vio); -int vio_socket_io_wait(Vio *vio, enum enum_vio_io_event event); -int vio_socket_timeout(Vio *vio, uint which, my_bool old_mode); - -#ifdef HAVE_OPENSSL -size_t vio_ssl_read(Vio *vio,uchar* buf, size_t size); -size_t vio_ssl_write(Vio *vio,const uchar* buf, size_t size); - -/* When the workday is over... */ -int vio_ssl_shutdown(Vio *vio); -void vio_ssl_delete(Vio *vio); -my_bool vio_ssl_has_data(Vio *vio); - -#endif /* HAVE_OPENSSL */ -#endif /* VIO_PRIV_INCLUDED */ diff --git a/mysql/vio/viopipe.c b/mysql/vio/viopipe.c deleted file mode 100644 index c2145cc..0000000 --- a/mysql/vio/viopipe.c +++ /dev/null @@ -1,117 +0,0 @@ -/* Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -#include "vio_priv.h" - -static size_t wait_overlapped_result(Vio *vio, int timeout) -{ - size_t ret= (size_t) -1; - DWORD transferred, wait_status, timeout_ms; - - timeout_ms= timeout >= 0 ? timeout : INFINITE; - - /* Wait for the overlapped operation to be completed. */ - wait_status= WaitForSingleObject(vio->overlapped.hEvent, timeout_ms); - - /* The operation might have completed, attempt to retrieve the result. */ - if (wait_status == WAIT_OBJECT_0) - { - /* If retrieval fails, a error code will have been set. */ - if (GetOverlappedResult(vio->hPipe, &vio->overlapped, &transferred, FALSE)) - ret= transferred; - } - else - { - /* Error or timeout, cancel the pending I/O operation. */ - CancelIo(vio->hPipe); - - /* - If the wait timed out, set error code to indicate a - timeout error. Otherwise, wait_status is WAIT_FAILED - and extended error information was already set. - */ - if (wait_status == WAIT_TIMEOUT) - SetLastError(SOCKET_ETIMEDOUT); - } - - return ret; -} - - -size_t vio_read_pipe(Vio *vio, uchar *buf, size_t count) -{ - DWORD transferred; - size_t ret= (size_t) -1; - DBUG_ENTER("vio_read_pipe"); - - /* Attempt to read from the pipe (overlapped I/O). */ - if (ReadFile(vio->hPipe, buf, (DWORD)count, &transferred, &vio->overlapped)) - { - /* The operation completed immediately. */ - ret= transferred; - } - /* Read operation is pending completion asynchronously? */ - else if (GetLastError() == ERROR_IO_PENDING) - ret= wait_overlapped_result(vio, vio->read_timeout); - - DBUG_RETURN(ret); -} - - -size_t vio_write_pipe(Vio *vio, const uchar *buf, size_t count) -{ - DWORD transferred; - size_t ret= (size_t) -1; - DBUG_ENTER("vio_write_pipe"); - - /* Attempt to write to the pipe (overlapped I/O). */ - if (WriteFile(vio->hPipe, buf, (DWORD)count, &transferred, &vio->overlapped)) - { - /* The operation completed immediately. */ - ret= transferred; - } - /* Write operation is pending completion asynchronously? */ - else if (GetLastError() == ERROR_IO_PENDING) - ret= wait_overlapped_result(vio, vio->write_timeout); - - DBUG_RETURN(ret); -} - - -my_bool vio_is_connected_pipe(Vio *vio) -{ - if (PeekNamedPipe(vio->hPipe, NULL, 0, NULL, NULL, NULL)) - return TRUE; - else - return (GetLastError() != ERROR_BROKEN_PIPE); -} - - -int vio_shutdown_pipe(Vio *vio) -{ - BOOL ret; - DBUG_ENTER("vio_shutdown_pipe"); - - CancelIo(vio->hPipe); - CloseHandle(vio->overlapped.hEvent); - DisconnectNamedPipe(vio->hPipe); - ret= CloseHandle(vio->hPipe); - - vio->inactive= TRUE; - vio->hPipe= NULL; - vio->mysql_socket= MYSQL_INVALID_SOCKET; - - DBUG_RETURN(ret); -} diff --git a/mysql/vio/vioshm.c b/mysql/vio/vioshm.c deleted file mode 100644 index 9bc3976..0000000 --- a/mysql/vio/vioshm.c +++ /dev/null @@ -1,226 +0,0 @@ -/* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -#include "vio_priv.h" - -#if !defined(EMBEDDED_LIBRARY) - -size_t vio_read_shared_memory(Vio *vio, uchar *buf, size_t size) -{ - size_t length; - size_t remain_local; - char *current_position; - HANDLE events[2]; - DWORD timeout; - DBUG_ENTER("vio_read_shared_memory"); - - remain_local= size; - current_position= buf; - timeout= vio->read_timeout >= 0 ? vio->read_timeout : INFINITE; - - events[0]= vio->event_server_wrote; - events[1]= vio->event_conn_closed; - - do - { - if (vio->shared_memory_remain == 0) - { - DWORD wait_status; - - wait_status= WaitForMultipleObjects(array_elements(events), events, - FALSE, timeout); - - /* - WaitForMultipleObjects can return next values: - WAIT_OBJECT_0+0 - event from vio->event_server_wrote - WAIT_OBJECT_0+1 - event from vio->event_conn_closed. - We can't read anything - WAIT_ABANDONED_0 and WAIT_TIMEOUT - fail. We can't read anything - */ - if (wait_status != WAIT_OBJECT_0) - { - /* - If wait_status is WAIT_TIMEOUT, set error code to indicate a - timeout error. If vio->event_conn_closed was set, use an EOF - condition (return value of zero) to indicate that the operation - has been aborted. - */ - if (wait_status == WAIT_TIMEOUT) - SetLastError(SOCKET_ETIMEDOUT); - else if (wait_status == (WAIT_OBJECT_0 + 1)) - DBUG_RETURN(0); - - DBUG_RETURN(-1); - } - - vio->shared_memory_pos= vio->handle_map; - vio->shared_memory_remain= uint4korr(vio->shared_memory_pos); - vio->shared_memory_pos+= 4; - } - - length= size; - - if (vio->shared_memory_remain < length) - length= vio->shared_memory_remain; - if (length > remain_local) - length= remain_local; - - memcpy(current_position, vio->shared_memory_pos, length); - - vio->shared_memory_remain-= length; - vio->shared_memory_pos+= length; - current_position+= length; - remain_local-= length; - - if (!vio->shared_memory_remain) - { - if (!SetEvent(vio->event_client_read)) - DBUG_RETURN(-1); - } - } while (remain_local); - length= size; - - DBUG_RETURN(length); -} - - -size_t vio_write_shared_memory(Vio *vio, const uchar *buf, size_t size) -{ - size_t length, remain, sz; - HANDLE pos; - const uchar *current_position; - HANDLE events[2]; - DWORD timeout; - DBUG_ENTER("vio_write_shared_memory"); - - remain= size; - current_position= buf; - timeout= vio->write_timeout >= 0 ? vio->write_timeout : INFINITE; - - events[0]= vio->event_server_read; - events[1]= vio->event_conn_closed; - - while (remain != 0) - { - DWORD wait_status; - - wait_status= WaitForMultipleObjects(array_elements(events), events, - FALSE, timeout); - - if (wait_status != WAIT_OBJECT_0) - { - /* Set error code to indicate a timeout error or disconnect. */ - if (wait_status == WAIT_TIMEOUT) - SetLastError(SOCKET_ETIMEDOUT); - else - SetLastError(ERROR_GRACEFUL_DISCONNECT); - - DBUG_RETURN((size_t) -1); - } - - sz= (remain > shared_memory_buffer_length ? shared_memory_buffer_length : - remain); - - int4store(vio->handle_map, (uint32)sz); - pos= vio->handle_map + 4; - memcpy(pos, current_position, sz); - remain-= sz; - current_position+= sz; - if (!SetEvent(vio->event_client_wrote)) - DBUG_RETURN((size_t) -1); - } - length= size; - - DBUG_RETURN(length); -} - - -my_bool vio_is_connected_shared_memory(Vio *vio) -{ - return (WaitForSingleObject(vio->event_conn_closed, 0) != WAIT_OBJECT_0); -} - - -void vio_delete_shared_memory(Vio *vio) -{ - DBUG_ENTER("vio_delete_shared_memory"); - - if (!vio) - DBUG_VOID_RETURN; - - if (vio->inactive == FALSE) - vio->vioshutdown(vio); - - /* - Close all handlers. UnmapViewOfFile and CloseHandle return non-zero - result if they are success. - */ - if (UnmapViewOfFile(vio->handle_map) == 0) - DBUG_PRINT("vio_error", ("UnmapViewOfFile() failed")); - - if (CloseHandle(vio->event_server_wrote) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->esw) failed")); - - if (CloseHandle(vio->event_server_read) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->esr) failed")); - - if (CloseHandle(vio->event_client_wrote) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->ecw) failed")); - - if (CloseHandle(vio->event_client_read) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->ecr) failed")); - - if (CloseHandle(vio->handle_file_map) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->hfm) failed")); - - if (CloseHandle(vio->event_conn_closed) == 0) - DBUG_PRINT("vio_error", ("CloseHandle(vio->ecc) failed")); - - vio_delete(vio); - - DBUG_VOID_RETURN; -} - -/* - When "kill connection xx" is executed on an arbitrary thread it calls - THD::shutdown_active_vio() on the THD referred to by xx. Since the - thread serving the connection xx might be in the middle of a vio_read - or vio_write, we cannot unmap the shared memory here. - - Therefore we here just signal the connection_closed event and give - the thread servicing connection xx a chance to gracefully exit. - All handles are closed and the VIO is cleaned up when vio_delete() is - called and this completes the vio cleanup operation in its entirety. -*/ -int vio_shutdown_shared_memory(Vio * vio) -{ - DBUG_ENTER("vio_shutdown_shared_memory"); - if (vio->inactive == FALSE) - { - /* - Set event_conn_closed for notification of both client and server that - connection is closed - */ - SetEvent(vio->event_conn_closed); - } - - vio->inactive= TRUE; - vio->mysql_socket= MYSQL_INVALID_SOCKET; - - DBUG_RETURN(0); -} - -#endif /* #if !defined(!EMBEDDED_LIBRARY) */ - diff --git a/mysql/vio/viosocket.c b/mysql/vio/viosocket.c deleted file mode 100644 index ee59292..0000000 --- a/mysql/vio/viosocket.c +++ /dev/null @@ -1,1140 +0,0 @@ -/* - Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or - modify it under the terms of the GNU General Public License - as published by the Free Software Foundation; version 2 of - the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - 02110-1301 USA */ - -/* - Note that we can't have assertion on file descriptors; The reason for - this is that during mysql shutdown, another thread can close a file - we are working on. In this case we should just return read errors from - the file descriptior. -*/ - -#include "vio_priv.h" - -#ifdef FIONREAD_IN_SYS_FILIO -# include <sys/filio.h> -#endif -#ifndef _WIN32 -# include <netinet/tcp.h> -#endif -#ifdef HAVE_POLL_H -# include <poll.h> -#endif -#ifdef HAVE_SYS_IOCTL_H -# include <sys/ioctl.h> -#endif - -int vio_errno(Vio *vio MY_ATTRIBUTE((unused))) -{ - /* These transport types are not Winsock based. */ -#ifdef _WIN32 - if (vio->type == VIO_TYPE_NAMEDPIPE || - vio->type == VIO_TYPE_SHARED_MEMORY) - return GetLastError(); -#endif - - /* Mapped to WSAGetLastError() on Win32. */ - return socket_errno; -} - - -/** - Attempt to wait for an I/O event on a socket. - - @param vio VIO object representing a connected socket. - @param event The type of I/O event (read or write) to wait for. - - @return Return value is -1 on failure, 0 on success. -*/ - -int vio_socket_io_wait(Vio *vio, enum enum_vio_io_event event) -{ - int timeout, ret; - - DBUG_ASSERT(event == VIO_IO_EVENT_READ || event == VIO_IO_EVENT_WRITE); - - /* Choose an appropriate timeout. */ - if (event == VIO_IO_EVENT_READ) - timeout= vio->read_timeout; - else - timeout= vio->write_timeout; - - /* Wait for input data to become available. */ - switch (vio_io_wait(vio, event, timeout)) - { - case -1: - /* Upon failure, vio_read/write() shall return -1. */ - ret= -1; - break; - case 0: - /* The wait timed out. */ - ret= -1; - break; - default: - /* A positive value indicates an I/O event. */ - ret= 0; - break; - } - - return ret; -} - - -/* - Define a stub MSG_DONTWAIT if unavailable. In this case, fcntl - (or a equivalent) is used to enable non-blocking operations. - The flag must be supported in both send and recv operations. -*/ -#if defined(__linux__) -#define VIO_USE_DONTWAIT 1 -#define VIO_DONTWAIT MSG_DONTWAIT -#else -#define VIO_DONTWAIT 0 -#endif - - -size_t vio_read(Vio *vio, uchar *buf, size_t size) -{ - ssize_t ret; - int flags= 0; - DBUG_ENTER("vio_read"); - - /* Ensure nobody uses vio_read_buff and vio_read simultaneously. */ - DBUG_ASSERT(vio->read_end == vio->read_pos); - - /* If timeout is enabled, do not block if data is unavailable. */ - if (vio->read_timeout >= 0) - flags= VIO_DONTWAIT; - - while ((ret= mysql_socket_recv(vio->mysql_socket, (SOCKBUF_T *)buf, size, flags)) == -1) - { - int error= socket_errno; - - /* The operation would block? */ - if (error != SOCKET_EAGAIN && error != SOCKET_EWOULDBLOCK) - break; - - /* Wait for input data to become available. */ - if ((ret= vio_socket_io_wait(vio, VIO_IO_EVENT_READ))) - break; - } - - DBUG_RETURN(ret); -} - - -/* - Buffered read: if average read size is small it may - reduce number of syscalls. -*/ - -size_t vio_read_buff(Vio *vio, uchar* buf, size_t size) -{ - size_t rc; -#define VIO_UNBUFFERED_READ_MIN_SIZE 2048 - DBUG_ENTER("vio_read_buff"); - DBUG_PRINT("enter", ("sd: %d buf: 0x%lx size: %u", - mysql_socket_getfd(vio->mysql_socket), (long)buf, (uint)size)); - - if (vio->read_pos < vio->read_end) - { - rc= MY_MIN((size_t) (vio->read_end - vio->read_pos), size); - memcpy(buf, vio->read_pos, rc); - vio->read_pos+= rc; - /* - Do not try to read from the socket now even if rc < size: - vio_read can return -1 due to an error or non-blocking mode, and - the safest way to handle it is to move to a separate branch. - */ - } - else if (size < VIO_UNBUFFERED_READ_MIN_SIZE) - { - rc= vio_read(vio, (uchar*) vio->read_buffer, VIO_READ_BUFFER_SIZE); - if (rc != 0 && rc != (size_t) -1) - { - if (rc > size) - { - vio->read_pos= vio->read_buffer + size; - vio->read_end= vio->read_buffer + rc; - rc= size; - } - memcpy(buf, vio->read_buffer, rc); - } - } - else - rc= vio_read(vio, buf, size); - DBUG_RETURN(rc); -#undef VIO_UNBUFFERED_READ_MIN_SIZE -} - - -my_bool vio_buff_has_data(Vio *vio) -{ - return (vio->read_pos != vio->read_end); -} - - -size_t vio_write(Vio *vio, const uchar* buf, size_t size) -{ - ssize_t ret; - int flags= 0; - DBUG_ENTER("vio_write"); - - /* If timeout is enabled, do not block. */ - if (vio->write_timeout >= 0) - flags= VIO_DONTWAIT; - - while ((ret= mysql_socket_send(vio->mysql_socket, (SOCKBUF_T *)buf, size, flags)) == -1) - { - int error= socket_errno; - - /* The operation would block? */ - if (error != SOCKET_EAGAIN && error != SOCKET_EWOULDBLOCK) - break; - - /* Wait for the output buffer to become writable.*/ - if ((ret= vio_socket_io_wait(vio, VIO_IO_EVENT_WRITE))) - break; - } - - DBUG_RETURN(ret); -} - -//WL#4896: Not covered -static int vio_set_blocking(Vio *vio, my_bool status) -{ - DBUG_ENTER("vio_set_blocking"); - -#ifdef _WIN32 - DBUG_ASSERT(vio->type != VIO_TYPE_NAMEDPIPE); - DBUG_ASSERT(vio->type != VIO_TYPE_SHARED_MEMORY); - { - int ret; - u_long arg= status ? 0 : 1; - ret= ioctlsocket(mysql_socket_getfd(vio->mysql_socket), FIONBIO, &arg); - DBUG_RETURN(ret); - } -#else - { - int flags; - - if ((flags= fcntl(mysql_socket_getfd(vio->mysql_socket), F_GETFL, NULL)) < 0) - DBUG_RETURN(-1); - - /* - Always set/clear the flag to avoid inheritance issues. This is - a issue mainly on Mac OS X Tiger (version 10.4) where although - the O_NONBLOCK flag is inherited from the parent socket, the - actual non-blocking behavior is not inherited. - */ - if (status) - flags&= ~O_NONBLOCK; - else - flags|= O_NONBLOCK; - - if (fcntl(mysql_socket_getfd(vio->mysql_socket), F_SETFL, flags) == -1) - DBUG_RETURN(-1); - } -#endif - - DBUG_RETURN(0); -} - - -int vio_socket_timeout(Vio *vio, - uint which MY_ATTRIBUTE((unused)), - my_bool old_mode MY_ATTRIBUTE((unused))) -{ - int ret= 0; - DBUG_ENTER("vio_socket_timeout"); - -#if defined(_WIN32) - { - int optname; - DWORD timeout= 0; - const char *optval= (const char *) &timeout; - - /* - The default socket timeout value is zero, which means an infinite - timeout. Values less than 500 milliseconds are interpreted to be of - 500 milliseconds. Hence, the VIO behavior for zero timeout, which is - intended to cause the send or receive operation to fail immediately - if no data is available, is not supported on WIN32 and neither is - necessary as it's not possible to set the VIO timeout value to zero. - - Assert that the VIO timeout is either positive or set to infinite. - */ - DBUG_ASSERT(which || vio->read_timeout); - DBUG_ASSERT(!which || vio->write_timeout); - - if (which) - { - optname= SO_SNDTIMEO; - if (vio->write_timeout > 0) - timeout= vio->write_timeout; - } - else - { - optname= SO_RCVTIMEO; - if (vio->read_timeout > 0) - timeout= vio->read_timeout; - } - - ret= mysql_socket_setsockopt(vio->mysql_socket, SOL_SOCKET, optname, - optval, sizeof(timeout)); - } -#else - /* - The MSG_DONTWAIT trick is not used with SSL sockets as the send and - receive I/O operations are wrapped through SSL-specific functions - (SSL_read and SSL_write) which are not equivalent to the standard - recv(2) and send(2) used in vio_read() and vio_write(). Hence, the - socket blocking mode is changed and vio_io_wait() is used to wait - for I/O or timeout. - */ -#ifdef VIO_USE_DONTWAIT - if (vio->type == VIO_TYPE_SSL) -#endif - { - /* Deduce what should be the new blocking mode of the socket. */ - my_bool new_mode= vio->write_timeout < 0 && vio->read_timeout < 0; - - /* If necessary, update the blocking mode. */ - if (new_mode != old_mode) - ret= vio_set_blocking(vio, new_mode); - } -#endif - - DBUG_RETURN(ret); -} - - -int vio_fastsend(Vio * vio MY_ATTRIBUTE((unused))) -{ - int r=0; - DBUG_ENTER("vio_fastsend"); - -#if defined(IPTOS_THROUGHPUT) - { - int tos = IPTOS_THROUGHPUT; - r= mysql_socket_setsockopt(vio->mysql_socket, IPPROTO_IP, IP_TOS, - (void *)&tos, sizeof(tos)); - } -#endif /* IPTOS_THROUGHPUT */ - if (!r) - { -#ifdef _WIN32 - BOOL nodelay= 1; -#else - int nodelay = 1; -#endif - - r= mysql_socket_setsockopt(vio->mysql_socket, IPPROTO_TCP, TCP_NODELAY, - IF_WIN((const char*), (void*)) &nodelay, - sizeof(nodelay)); - - } - if (r) - { - DBUG_PRINT("warning", ("Couldn't set socket option for fast send")); - r= -1; - } - DBUG_PRINT("exit", ("%d", r)); - DBUG_RETURN(r); -} - -int vio_keepalive(Vio* vio, my_bool set_keep_alive) -{ - int r=0; - uint opt = 0; - DBUG_ENTER("vio_keepalive"); - DBUG_PRINT("enter", ("sd: %d set_keep_alive: %d", - mysql_socket_getfd(vio->mysql_socket), (int)set_keep_alive)); - if (vio->type != VIO_TYPE_NAMEDPIPE) - { - if (set_keep_alive) - opt = 1; - r = mysql_socket_setsockopt(vio->mysql_socket, SOL_SOCKET, SO_KEEPALIVE, - (char *)&opt, sizeof(opt)); - } - DBUG_RETURN(r); -} - - -/** - Indicate whether a I/O operation must be retried later. - - @param vio A VIO object - - @return Whether a I/O operation should be deferred. - @retval TRUE Temporary failure, retry operation. - @retval FALSE Indeterminate failure. -*/ - -my_bool -vio_should_retry(Vio *vio) -{ - return (vio_errno(vio) == SOCKET_EINTR); -} - - -/** - Indicate whether a I/O operation timed out. - - @param vio A VIO object - - @return Whether a I/O operation timed out. - @retval TRUE Operation timed out. - @retval FALSE Not a timeout failure. -*/ - -my_bool -vio_was_timeout(Vio *vio) -{ - return (vio_errno(vio) == SOCKET_ETIMEDOUT); -} - - -int vio_shutdown(Vio * vio) -{ - int r=0; - DBUG_ENTER("vio_shutdown"); - - if (vio->inactive == FALSE) - { - DBUG_ASSERT(vio->type == VIO_TYPE_TCPIP || - vio->type == VIO_TYPE_SOCKET || - vio->type == VIO_TYPE_SSL); - - DBUG_ASSERT(mysql_socket_getfd(vio->mysql_socket) >= 0); - if (mysql_socket_shutdown(vio->mysql_socket, SHUT_RDWR)) - r= -1; - if (mysql_socket_close(vio->mysql_socket)) - r= -1; - } - if (r) - { - DBUG_PRINT("vio_error", ("close() failed, error: %d",socket_errno)); - /* FIXME: error handling (not critical for MySQL) */ - } - vio->inactive= TRUE; - vio->mysql_socket= MYSQL_INVALID_SOCKET; - DBUG_RETURN(r); -} - - -const char *vio_description(Vio * vio) -{ - if (!vio->desc[0]) - { - my_snprintf(vio->desc, VIO_DESCRIPTION_SIZE, - (vio->type == VIO_TYPE_SOCKET ? "socket (%d)" : "TCP/IP (%d)"), - mysql_socket_getfd(vio->mysql_socket)); - } - return vio->desc; -} - -enum enum_vio_type vio_type(Vio* vio) -{ - return vio->type; -} - -my_socket vio_fd(Vio* vio) -{ - return mysql_socket_getfd(vio->mysql_socket); -} - -/** - Convert a sock-address (AF_INET or AF_INET6) into the "normalized" form, - which is the IPv4 form for IPv4-mapped or IPv4-compatible IPv6 addresses. - - @note Background: when IPv4 and IPv6 are used simultaneously, IPv4 - addresses may be written in a form of IPv4-mapped or IPv4-compatible IPv6 - addresses. That means, one address (a.b.c.d) can be written in three forms: - - IPv4: a.b.c.d; - - IPv4-compatible IPv6: ::a.b.c.d; - - IPv4-mapped IPv4: ::ffff:a.b.c.d; - - Having three forms of one address makes it a little difficult to compare - addresses with each other (the IPv4-compatible IPv6-address of foo.bar - will be different from the IPv4-mapped IPv6-address of foo.bar). - - @note This function can be made public when it's needed. - - @param src [in] source IP address (AF_INET or AF_INET6). - @param src_length [in] length of the src. - @param dst [out] a buffer to store normalized IP address - (sockaddr_storage). - @param dst_length [out] actual length of the normalized IP address. -*/ -static void vio_get_normalized_ip(const struct sockaddr *src, - size_t src_length, - struct sockaddr *dst, - size_t *dst_length) -{ - switch (src->sa_family) { - case AF_INET: - memcpy(dst, src, src_length); - *dst_length= src_length; - break; - -#ifdef HAVE_IPV6 - case AF_INET6: - { - const struct sockaddr_in6 *src_addr6= (const struct sockaddr_in6 *) src; - const struct in6_addr *src_ip6= &(src_addr6->sin6_addr); - const uint32 *src_ip6_int32= (uint32 *) src_ip6->s6_addr; - - if (IN6_IS_ADDR_V4MAPPED(src_ip6) || IN6_IS_ADDR_V4COMPAT(src_ip6)) - { - struct sockaddr_in *dst_ip4= (struct sockaddr_in *) dst; - - /* - This is an IPv4-mapped or IPv4-compatible IPv6 address. It should - be converted to the IPv4 form. - */ - - *dst_length= sizeof (struct sockaddr_in); - - memset(dst_ip4, 0, *dst_length); - dst_ip4->sin_family= AF_INET; - dst_ip4->sin_port= src_addr6->sin6_port; - - /* - In an IPv4 mapped or compatible address, the last 32 bits represent - the IPv4 address. The byte orders for IPv6 and IPv4 addresses are - the same, so a simple copy is possible. - */ - dst_ip4->sin_addr.s_addr= src_ip6_int32[3]; - } - else - { - /* This is a "native" IPv6 address. */ - - memcpy(dst, src, src_length); - *dst_length= src_length; - } - - break; - } -#endif /* HAVE_IPV6 */ - } -} - - -/** - Return the normalized IP address string for a sock-address. - - The idea is to return an IPv4-address for an IPv4-mapped and - IPv4-compatible IPv6 address. - - The function writes the normalized IP address to the given buffer. - The buffer should have enough space, otherwise error flag is returned. - The system constant INET6_ADDRSTRLEN can be used to reserve buffers of - the right size. - - @param addr [in] sockaddr object (AF_INET or AF_INET6). - @param addr_length [in] length of the addr. - @param ip_string [out] buffer to write normalized IP address. - @param ip_string_size [in] size of the ip_string. - - @return Error status. - @retval TRUE in case of error (the ip_string buffer is not enough). - @retval FALSE on success. -*/ - -my_bool vio_get_normalized_ip_string(const struct sockaddr *addr, - size_t addr_length, - char *ip_string, - size_t ip_string_size) -{ - struct sockaddr_storage norm_addr_storage; - struct sockaddr *norm_addr= (struct sockaddr *) &norm_addr_storage; - size_t norm_addr_length; - int err_code; - - vio_get_normalized_ip(addr, addr_length, norm_addr, &norm_addr_length); - - err_code= vio_getnameinfo(norm_addr, ip_string, ip_string_size, NULL, 0, - NI_NUMERICHOST); - - if (!err_code) - return FALSE; - - DBUG_PRINT("error", ("getnameinfo() failed with %d (%s).", - (int) err_code, - (const char *) gai_strerror(err_code))); - return TRUE; -} - - -/** - Return IP address and port of a VIO client socket. - - The function returns an IPv4 address if IPv6 support is disabled. - - The function returns an IPv4 address if the client socket is associated - with an IPv4-compatible or IPv4-mapped IPv6 address. Otherwise, the native - IPv6 address is returned. -*/ - -my_bool vio_peer_addr(Vio *vio, char *ip_buffer, uint16 *port, - size_t ip_buffer_size) -{ - DBUG_ENTER("vio_peer_addr"); - DBUG_PRINT("enter", ("Client socked fd: %d", - (int)mysql_socket_getfd(vio->mysql_socket))); - - if (vio->localhost) - { - /* - Initialize vio->remote and vio->addLen. Set vio->remote to IPv4 loopback - address. - */ - struct in_addr *ip4= &((struct sockaddr_in *) &(vio->remote))->sin_addr; - - vio->remote.ss_family= AF_INET; - vio->addrLen= sizeof (struct sockaddr_in); - - ip4->s_addr= htonl(INADDR_LOOPBACK); - - /* Initialize ip_buffer and port. */ - - my_stpcpy(ip_buffer, "127.0.0.1"); - *port= 0; - } - else - { - int err_code; - char port_buffer[NI_MAXSERV]; - - struct sockaddr_storage addr_storage; - struct sockaddr *addr= (struct sockaddr *) &addr_storage; - socket_len_t addr_length= sizeof (addr_storage); - - /* Get sockaddr by socked fd. */ - - err_code= mysql_socket_getpeername(vio->mysql_socket, addr, &addr_length); - - if (err_code) - { - DBUG_PRINT("exit", ("getpeername() gave error: %d", socket_errno)); - DBUG_RETURN(TRUE); - } - - /* Normalize IP address. */ - - vio_get_normalized_ip(addr, addr_length, - (struct sockaddr *) &vio->remote, &vio->addrLen); - - /* Get IP address & port number. */ - - err_code= vio_getnameinfo((struct sockaddr *) &vio->remote, - ip_buffer, ip_buffer_size, - port_buffer, NI_MAXSERV, - NI_NUMERICHOST | NI_NUMERICSERV); - - if (err_code) - { - DBUG_PRINT("exit", ("getnameinfo() gave error: %s", - gai_strerror(err_code))); - DBUG_RETURN(TRUE); - } - - *port= (uint16) strtol(port_buffer, NULL, 10); - } - - DBUG_PRINT("exit", ("Client IP address: %s; port: %d", - (const char *) ip_buffer, - (int) *port)); - DBUG_RETURN(FALSE); -} - - -/** - Retrieve the amount of data that can be read from a socket. - - @param vio A VIO object. - @param bytes[out] The amount of bytes available. - - @retval FALSE Success. - @retval TRUE Failure. -*/ -// WL#4896: Not covered -static my_bool socket_peek_read(Vio *vio, uint *bytes) -{ - my_socket sd= mysql_socket_getfd(vio->mysql_socket); -#if defined(_WIN32) - int len; - if (ioctlsocket(sd, FIONREAD, &len)) - return TRUE; - *bytes= len; - return FALSE; -#elif defined(FIONREAD_IN_SYS_IOCTL) || defined(FIONREAD_IN_SYS_FILIO) - int len; - if (ioctl(sd, FIONREAD, &len) < 0) - return TRUE; - *bytes= len; - return FALSE; -#else - char buf[1024]; - ssize_t res= recv(sd, &buf, sizeof(buf), MSG_PEEK); - if (res < 0) - return TRUE; - *bytes= res; - return FALSE; -#endif -} - -#ifndef _WIN32 - -/** - Set of event flags grouped by operations. -*/ - -/* - Linux specific flag used to detect connection shutdown. The flag is - also used for half-closed notification, which here is interpreted as - if there is data available to be read from the socket. -*/ -#ifndef POLLRDHUP -#define POLLRDHUP 0 -#endif - -/* Data may be read. */ -#define MY_POLL_SET_IN (POLLIN | POLLPRI) -/* Data may be written. */ -#define MY_POLL_SET_OUT (POLLOUT) -/* An error or hangup. */ -#define MY_POLL_SET_ERR (POLLERR | POLLHUP | POLLNVAL) - -#endif - -/** - Wait for an I/O event on a VIO socket. - - @param vio VIO object representing a connected socket. - @param event The type of I/O event to wait for. - @param timeout Interval (in milliseconds) to wait for an I/O event. - A negative timeout value means an infinite timeout. - - @remark sock_errno is set to SOCKET_ETIMEDOUT on timeout. - - @return A three-state value which indicates the operation status. - @retval -1 Failure, socket_errno indicates the error. - @retval 0 The wait has timed out. - @retval 1 The requested I/O event has occurred. -*/ - -#if !defined(_WIN32) && !defined(__APPLE__) -int vio_io_wait(Vio *vio, enum enum_vio_io_event event, int timeout) -{ - int ret; -#ifndef DBUG_OFF - short revents= 0; -#endif - struct pollfd pfd; - my_socket sd= mysql_socket_getfd(vio->mysql_socket); - MYSQL_SOCKET_WAIT_VARIABLES(locker, state) /* no ';' */ - DBUG_ENTER("vio_io_wait"); - - memset(&pfd, 0, sizeof(pfd)); - - pfd.fd= sd; - - /* - Set the poll bitmask describing the type of events. - The error flags are only valid in the revents bitmask. - */ - switch (event) - { - case VIO_IO_EVENT_READ: - pfd.events= MY_POLL_SET_IN; -#ifndef DBUG_OFF - revents= MY_POLL_SET_IN | MY_POLL_SET_ERR | POLLRDHUP; -#endif - break; - case VIO_IO_EVENT_WRITE: - case VIO_IO_EVENT_CONNECT: - pfd.events= MY_POLL_SET_OUT; -#ifndef DBUG_OFF - revents= MY_POLL_SET_OUT | MY_POLL_SET_ERR; -#endif - break; - } - - MYSQL_START_SOCKET_WAIT(locker, &state, vio->mysql_socket, PSI_SOCKET_SELECT, 0); - - /* - Wait for the I/O event and return early in case of - error or timeout. - */ - switch ((ret= poll(&pfd, 1, timeout))) - { - case -1: - /* On error, -1 is returned. */ - break; - case 0: - /* - Set errno to indicate a timeout error. - (This is not compiled in on WIN32.) - */ - errno= SOCKET_ETIMEDOUT; - break; - default: - /* Ensure that the requested I/O event has completed. */ - DBUG_ASSERT(pfd.revents & revents); - break; - } - - MYSQL_END_SOCKET_WAIT(locker, 0); - DBUG_RETURN(ret); -} - -#else - -int vio_io_wait(Vio *vio, enum enum_vio_io_event event, int timeout) -{ - int ret; - struct timeval tm; - my_socket fd; - fd_set readfds, writefds, exceptfds; - MYSQL_SOCKET_WAIT_VARIABLES(locker, state) /* no ';' */ - DBUG_ENTER("vio_io_wait"); - - fd= mysql_socket_getfd(vio->mysql_socket); - - if (fd == INVALID_SOCKET) - DBUG_RETURN(-1); - -#ifdef __APPLE__ - if (fd >= FD_SETSIZE) - DBUG_RETURN(-1); -#endif - - /* Convert the timeout, in milliseconds, to seconds and microseconds. */ - if (timeout >= 0) - { - tm.tv_sec= timeout / 1000; - tm.tv_usec= (timeout % 1000) * 1000; - } - - FD_ZERO(&readfds); - FD_ZERO(&writefds); - FD_ZERO(&exceptfds); - - /* Always receive notification of exceptions. */ - FD_SET(fd, &exceptfds); - - switch (event) - { - case VIO_IO_EVENT_READ: - /* Readiness for reading. */ - FD_SET(fd, &readfds); - break; - case VIO_IO_EVENT_WRITE: - case VIO_IO_EVENT_CONNECT: - /* Readiness for writing. */ - FD_SET(fd, &writefds); - break; - } - - MYSQL_START_SOCKET_WAIT(locker, &state, vio->mysql_socket, PSI_SOCKET_SELECT, 0); - - /* The first argument is ignored on Windows. */ - ret= select((int)(fd + 1), &readfds, &writefds, &exceptfds, - (timeout >= 0) ? &tm : NULL); - - MYSQL_END_SOCKET_WAIT(locker, 0); - - /* Set error code to indicate a timeout error. */ - if (ret == 0) -#if defined(_WIN32) - WSASetLastError(SOCKET_ETIMEDOUT); -#elif defined(__APPLE__) - errno= SOCKET_ETIMEDOUT; -#else -#error Oops...Wrong OS -#endif - - /* Error or timeout? */ - if (ret <= 0) - DBUG_RETURN(ret); - - /* The requested I/O event is ready? */ - switch (event) - { - case VIO_IO_EVENT_READ: - ret= MY_TEST(FD_ISSET(fd, &readfds)); - break; - case VIO_IO_EVENT_WRITE: - case VIO_IO_EVENT_CONNECT: - ret= MY_TEST(FD_ISSET(fd, &writefds)); - break; - } - - /* Error conditions pending? */ - ret|= MY_TEST(FD_ISSET(fd, &exceptfds)); - - /* Not a timeout, ensure that a condition was met. */ - DBUG_ASSERT(ret); - - DBUG_RETURN(ret); -} - -#endif /* _WIN32 */ - - -/** - Connect to a peer address. - - @param vio A VIO object. - @param addr Socket address containing the peer address. - @param len Length of socket address. - @param timeout Interval (in milliseconds) to wait until a - connection is established. - - @retval FALSE A connection was successfully established. - @retval TRUE A fatal error. See socket_errno. -*/ - -my_bool -vio_socket_connect(Vio *vio, struct sockaddr *addr, socklen_t len, int timeout) -{ - int ret, wait; - DBUG_ENTER("vio_socket_connect"); - - /* Only for socket-based transport types. */ - DBUG_ASSERT(vio->type == VIO_TYPE_SOCKET || vio->type == VIO_TYPE_TCPIP); - - /* If timeout is not infinite, set socket to non-blocking mode. */ - if ((timeout > -1) && vio_set_blocking(vio, FALSE)) - DBUG_RETURN(TRUE); - - /* Initiate the connection. */ - ret= mysql_socket_connect(vio->mysql_socket, addr, len); - -#ifdef _WIN32 - wait= (ret == SOCKET_ERROR) && - (WSAGetLastError() == WSAEINPROGRESS || - WSAGetLastError() == WSAEWOULDBLOCK); -#else - wait= (ret == -1) && (errno == EINPROGRESS || errno == EALREADY); -#endif - - /* - The connection is in progress. The vio_io_wait() call can be used - to wait up to a specified period of time for the connection to - succeed. - - If vio_io_wait() returns 0 (after waiting however many seconds), - the socket never became writable (host is probably unreachable.) - Otherwise, if vio_io_wait() returns 1, then one of two conditions - exist: - - 1. An error occurred. Use getsockopt() to check for this. - 2. The connection was set up successfully: getsockopt() will - return 0 as an error. - */ - if (wait && (vio_io_wait(vio, VIO_IO_EVENT_CONNECT, timeout) == 1)) - { - int error; - IF_WIN(int, socklen_t) optlen= sizeof(error); - IF_WIN(char, void) *optval= (IF_WIN(char, void) *) &error; - - /* - At this point, we know that something happened on the socket. - But this does not means that everything is alright. The connect - might have failed. We need to retrieve the error code from the - socket layer. We must return success only if we are sure that - it was really a success. Otherwise we might prevent the caller - from trying another address to connect to. - */ - if (!(ret= mysql_socket_getsockopt(vio->mysql_socket, SOL_SOCKET, SO_ERROR, optval, &optlen))) - { -#ifdef _WIN32 - WSASetLastError(error); -#else - errno= error; -#endif - ret= MY_TEST(error); - } - } - - /* If necessary, restore the blocking mode, but only if connect succeeded. */ - if ((timeout > -1) && (ret == 0)) - { - if (vio_set_blocking(vio, TRUE)) - DBUG_RETURN(TRUE); - } - - DBUG_RETURN(MY_TEST(ret)); -} - - -/** - Determine if the endpoint of a connection is still available. - - @remark The socket is assumed to be disconnected if an EOF - condition is encountered. - - @param vio The VIO object. - - @retval TRUE EOF condition not found. - @retval FALSE EOF condition is signaled. -*/ - -my_bool vio_is_connected(Vio *vio) -{ - uint bytes= 0; - DBUG_ENTER("vio_is_connected"); - - /* - The first step of detecting an EOF condition is verifying - whether there is data to read. Data in this case would be - the EOF. An exceptional condition event and/or errors are - interpreted as if there is data to read. - */ - if (!vio_io_wait(vio, VIO_IO_EVENT_READ, 0)) - DBUG_RETURN(TRUE); - - /* - The second step is read() or recv() from the socket returning - 0 (EOF). Unfortunately, it's not possible to call read directly - as we could inadvertently read meaningful connection data. - Simulate a read by retrieving the number of bytes available to - read -- 0 meaning EOF. In the presence of unrecoverable errors, - the socket is assumed to be disconnected. - */ - while (socket_peek_read(vio, &bytes)) - { - if (socket_errno != SOCKET_EINTR) - DBUG_RETURN(FALSE); - } - -#ifdef HAVE_OPENSSL - /* There might be buffered data at the SSL layer. */ - if (!bytes && vio->type == VIO_TYPE_SSL) - bytes= SSL_pending((SSL*) vio->ssl_arg); -#endif - - DBUG_RETURN(bytes ? TRUE : FALSE); -} - -#ifndef DBUG_OFF - -/** - Number of bytes in the read or socket buffer - - @remark An EOF condition might count as one readable byte. - - @return number of bytes in one of the buffers or < 0 if error. -*/ - -ssize_t vio_pending(Vio *vio) -{ - uint bytes= 0; - - /* Data pending on the read buffer. */ - if (vio->read_pos < vio->read_end) - return vio->read_end - vio->read_pos; - - /* Skip non-socket based transport types. */ - if (vio->type == VIO_TYPE_TCPIP || vio->type == VIO_TYPE_SOCKET) - { - /* Obtain number of readable bytes in the socket buffer. */ - if (socket_peek_read(vio, &bytes)) - return -1; - } - - /* - SSL not checked due to a yaSSL bug in SSL_pending that - causes it to attempt to read from the socket. - */ - - return (ssize_t) bytes; -} - -#endif - -/** - Checks if the error code, returned by vio_getnameinfo(), means it was the - "No-name" error. - - Windows-specific note: getnameinfo() returns WSANO_DATA instead of - EAI_NODATA or EAI_NONAME when no reverse mapping is available at the host - (i.e. Windows can't get hostname by IP-address). This error should be - treated as EAI_NONAME. - - @return if the error code is actually EAI_NONAME. - @retval true if the error code is EAI_NONAME. - @retval false otherwise. -*/ - -my_bool vio_is_no_name_error(int err_code) -{ -#ifdef _WIN32 - - return err_code == WSANO_DATA || err_code == EAI_NONAME; - -#else - - return err_code == EAI_NONAME; - -#endif -} - - -/** - This is a wrapper for the system getnameinfo(), because different OS - differ in the getnameinfo() implementation: - - Solaris 10 requires that the 2nd argument (salen) must match the - actual size of the struct sockaddr_storage passed to it; - - Mac OS X has sockaddr_in::sin_len and sockaddr_in6::sin6_len and - requires them to be filled. -*/ - -int vio_getnameinfo(const struct sockaddr *sa, - char *hostname, size_t hostname_size, - char *port, size_t port_size, - int flags) -{ - int sa_length= 0; - - switch (sa->sa_family) { - case AF_INET: - sa_length= sizeof (struct sockaddr_in); -#ifdef HAVE_SOCKADDR_IN_SIN_LEN - ((struct sockaddr_in *) sa)->sin_len= sa_length; -#endif /* HAVE_SOCKADDR_IN_SIN_LEN */ - break; - -#ifdef HAVE_IPV6 - case AF_INET6: - sa_length= sizeof (struct sockaddr_in6); -# ifdef HAVE_SOCKADDR_IN6_SIN6_LEN - ((struct sockaddr_in6 *) sa)->sin6_len= sa_length; -# endif /* HAVE_SOCKADDR_IN6_SIN6_LEN */ - break; -#endif /* HAVE_IPV6 */ - } - - return getnameinfo(sa, sa_length, - hostname, hostname_size, - port, port_size, - flags); -} diff --git a/mysql/vio/viossl.c b/mysql/vio/viossl.c deleted file mode 100644 index 5622cb7..0000000 --- a/mysql/vio/viossl.c +++ /dev/null @@ -1,511 +0,0 @@ -/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -/* - Note that we can't have assertion on file descriptors; The reason for - this is that during mysql shutdown, another thread can close a file - we are working on. In this case we should just return read errors from - the file descriptior. -*/ - -#include "vio_priv.h" - -#ifdef HAVE_OPENSSL - -#ifndef DBUG_OFF - -static void -report_errors(SSL* ssl) -{ - unsigned long l; - const char *file; - const char *data; - int line, flags; - char buf[512]; - - DBUG_ENTER("report_errors"); - - while ((l= ERR_get_error_line_data(&file,&line,&data,&flags))) - { - DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf), - file,line,(flags&ERR_TXT_STRING)?data:"")) ; - } - - if (ssl) - DBUG_PRINT("error", ("error: %s", - ERR_error_string(SSL_get_error(ssl, l), buf))); - - DBUG_PRINT("info", ("socket_errno: %d", socket_errno)); - DBUG_VOID_RETURN; -} - -#endif - - -/** - Obtain the equivalent system error status for the last SSL I/O operation. - - @param ssl_error The result code of the failed TLS/SSL I/O operation. -*/ - -static void ssl_set_sys_error(int ssl_error) -{ - int error= 0; - - switch (ssl_error) - { - case SSL_ERROR_ZERO_RETURN: - error= SOCKET_ECONNRESET; - break; - case SSL_ERROR_WANT_READ: - case SSL_ERROR_WANT_WRITE: -#ifdef SSL_ERROR_WANT_CONNECT - case SSL_ERROR_WANT_CONNECT: -#endif -#ifdef SSL_ERROR_WANT_ACCEPT - case SSL_ERROR_WANT_ACCEPT: -#endif - error= SOCKET_EWOULDBLOCK; - break; - case SSL_ERROR_SSL: - /* Protocol error. */ -#ifdef EPROTO - error= EPROTO; -#else - error= SOCKET_ECONNRESET; -#endif - break; - case SSL_ERROR_SYSCALL: - case SSL_ERROR_NONE: - default: - break; - }; - - /* Set error status to a equivalent of the SSL error. */ - if (error) - { -#ifdef _WIN32 - WSASetLastError(error); -#else - errno= error; -#endif - } -} - - -/** - This function does two things: - - it indicates whether a SSL I/O operation must be retried later; - - it clears the OpenSSL error queue, thus the next OpenSSL-operation can be - performed even after failed OpenSSL-call. - - @param vio VIO object representing a SSL connection. - @param ret Value returned by a SSL I/O function. - @param event[out] The type of I/O event to wait/retry. - @param ssl_errno_holder[out] The SSL error code. - - @return Whether a SSL I/O operation should be deferred. - @retval TRUE Temporary failure, retry operation. - @retval FALSE Indeterminate failure. -*/ - -static my_bool ssl_should_retry(Vio *vio, int ret, - enum enum_vio_io_event *event, - unsigned long *ssl_errno_holder) -{ - int ssl_error; - SSL *ssl= vio->ssl_arg; - my_bool should_retry= TRUE; - - /* Retrieve the result for the SSL I/O operation. */ - ssl_error= SSL_get_error(ssl, ret); - - /* Retrieve the result for the SSL I/O operation. */ - switch (ssl_error) - { - case SSL_ERROR_WANT_READ: - *event= VIO_IO_EVENT_READ; - break; - case SSL_ERROR_WANT_WRITE: - *event= VIO_IO_EVENT_WRITE; - break; - default: -#ifndef DBUG_OFF /* Debug build */ - /* Note: the OpenSSL error queue gets cleared in report_errors(). */ - report_errors(ssl); -#else /* Release build */ -# ifndef HAVE_YASSL - /* OpenSSL: clear the error queue. */ - ERR_clear_error(); -# endif -#endif - should_retry= FALSE; - ssl_set_sys_error(ssl_error); - break; - } - - *ssl_errno_holder= ssl_error; - - return should_retry; -} - - -size_t vio_ssl_read(Vio *vio, uchar *buf, size_t size) -{ - int ret; - SSL *ssl= vio->ssl_arg; - unsigned long ssl_errno_not_used; - - DBUG_ENTER("vio_ssl_read"); - - while (1) - { - enum enum_vio_io_event event; - -#ifndef HAVE_YASSL - /* - OpenSSL: check that the SSL thread's error queue is cleared. Otherwise - SSL_read() returns an error from the error queue, when SSL_read() failed - because it would block. - */ - DBUG_ASSERT(ERR_peek_error() == 0); -#endif - - ret= SSL_read(ssl, buf, (int)size); - - if (ret >= 0) - break; - - /* Process the SSL I/O error. */ - if (!ssl_should_retry(vio, ret, &event, &ssl_errno_not_used)) - break; - - /* Attempt to wait for an I/O event. */ - if (vio_socket_io_wait(vio, event)) - break; - } - - DBUG_RETURN(ret < 0 ? -1 : ret); -} - - -size_t vio_ssl_write(Vio *vio, const uchar *buf, size_t size) -{ - int ret; - SSL *ssl= vio->ssl_arg; - unsigned long ssl_errno_not_used; - - DBUG_ENTER("vio_ssl_write"); - - while (1) - { - enum enum_vio_io_event event; - -#ifndef HAVE_YASSL - /* - OpenSSL: check that the SSL thread's error queue is cleared. Otherwise - SSL_write() returns an error from the error queue, when SSL_write() failed - because it would block. - */ - DBUG_ASSERT(ERR_peek_error() == 0); -#endif - - ret= SSL_write(ssl, buf, (int)size); - - if (ret >= 0) - break; - - /* Process the SSL I/O error. */ - if (!ssl_should_retry(vio, ret, &event, &ssl_errno_not_used)) - break; - - /* Attempt to wait for an I/O event. */ - if (vio_socket_io_wait(vio, event)) - break; - } - - DBUG_RETURN(ret < 0 ? -1 : ret); -} - -#ifdef HAVE_YASSL - -/* Emulate a blocking recv() call with vio_read(). */ -static long yassl_recv(void *ptr, void *buf, size_t len) -{ - return (long)vio_read(ptr, buf, len); -} - - -/* Emulate a blocking send() call with vio_write(). */ -static long yassl_send(void *ptr, const void *buf, size_t len) -{ - return (long)vio_write(ptr, buf, len); -} - -#endif - -int vio_ssl_shutdown(Vio *vio) -{ - int r= 0; - SSL *ssl= (SSL*)vio->ssl_arg; - DBUG_ENTER("vio_ssl_shutdown"); - - if (ssl) - { - /* - THE SSL standard says that SSL sockets must send and receive a close_notify - alert on socket shutdown to avoid truncation attacks. However, this can - cause problems since we often hold a lock during shutdown and this IO can - take an unbounded amount of time to complete. Since our packets are self - describing with length, we aren't vunerable to these attacks. Therefore, - we just shutdown by closing the socket (quiet shutdown). - */ - SSL_set_quiet_shutdown(ssl, 1); - - switch ((r= SSL_shutdown(ssl))) { - case 1: - /* Shutdown successful */ - break; - case 0: - /* - Shutdown not yet finished - since the socket is going to - be closed there is no need to call SSL_shutdown() a second - time to wait for the other side to respond - */ - break; - default: /* Shutdown failed */ - DBUG_PRINT("vio_error", ("SSL_shutdown() failed, error: %d", - SSL_get_error(ssl, r))); - break; - } - } - DBUG_RETURN(vio_shutdown(vio)); -} - - -void vio_ssl_delete(Vio *vio) -{ - if (!vio) - return; /* It must be safe to delete null pointer */ - - if (vio->inactive == FALSE) - vio_ssl_shutdown(vio); /* Still open, close connection first */ - - if (vio->ssl_arg) - { - SSL_free((SSL*) vio->ssl_arg); - vio->ssl_arg= 0; - } - -#ifndef HAVE_YASSL - ERR_remove_thread_state(0); -#endif - - vio_delete(vio); -} - - -/** SSL handshake handler. */ -typedef int (*ssl_handshake_func_t)(SSL*); - - -/** - Loop and wait until a SSL handshake is completed. - - @param vio VIO object representing a SSL connection. - @param ssl SSL structure for the connection. - @param func SSL handshake handler. - @param ssl_errno_holder[out] The SSL error code. - - @return Return value is 1 on success. -*/ - -static int ssl_handshake_loop(Vio *vio, SSL *ssl, - ssl_handshake_func_t func, - unsigned long *ssl_errno_holder) -{ - int ret; - - vio->ssl_arg= ssl; - - /* Initiate the SSL handshake. */ - while (1) - { - enum enum_vio_io_event event; - -#ifndef HAVE_YASSL - /* - OpenSSL: check that the SSL thread's error queue is cleared. Otherwise - SSL-handshake-function returns an error from the error queue, when the - function failed because it would block. - */ - DBUG_ASSERT(ERR_peek_error() == 0); -#endif - - ret= func(ssl); - - if (ret >= 1) - break; - - /* Process the SSL I/O error. */ - if (!ssl_should_retry(vio, ret, &event, ssl_errno_holder)) - break; - - /* Wait for I/O so that the handshake can proceed. */ - if (vio_socket_io_wait(vio, event)) - break; - } - - vio->ssl_arg= NULL; - - return ret; -} - - -static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout, - ssl_handshake_func_t func, - unsigned long *ssl_errno_holder) -{ - int r; - SSL *ssl; - my_socket sd= mysql_socket_getfd(vio->mysql_socket); - - /* Declared here to make compiler happy */ -#if !defined(HAVE_YASSL) && !defined(DBUG_OFF) - int j, n; -#endif - - DBUG_ENTER("ssl_do"); - DBUG_PRINT("enter", ("ptr: 0x%lx, sd: %d ctx: 0x%lx", - (long) ptr, sd, (long) ptr->ssl_context)); - - if (!(ssl= SSL_new(ptr->ssl_context))) - { - DBUG_PRINT("error", ("SSL_new failure")); - *ssl_errno_holder= ERR_get_error(); - DBUG_RETURN(1); - } - DBUG_PRINT("info", ("ssl: 0x%lx timeout: %ld", (long) ssl, timeout)); - SSL_clear(ssl); - SSL_SESSION_set_timeout(SSL_get_session(ssl), timeout); - SSL_set_fd(ssl, sd); -#if !defined(HAVE_YASSL) && defined(SSL_OP_NO_COMPRESSION) - SSL_set_options(ssl, SSL_OP_NO_COMPRESSION); /* OpenSSL >= 1.0 only */ -#elif OPENSSL_VERSION_NUMBER >= 0x00908000L /* workaround for OpenSSL 0.9.8 */ - sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); -#endif - -#if !defined(HAVE_YASSL) && !defined(DBUG_OFF) - { - STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; - ssl_comp_methods = SSL_COMP_get_compression_methods(); - n= sk_SSL_COMP_num(ssl_comp_methods); - DBUG_PRINT("info", ("Available compression methods:\n")); - if (n == 0) - DBUG_PRINT("info", ("NONE\n")); - else - for (j = 0; j < n; j++) - { - SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j); - DBUG_PRINT("info", (" %d: %s\n", c->id, c->name)); - } - } -#endif - - /* - Since yaSSL does not support non-blocking send operations, use - special transport functions that properly handles non-blocking - sockets. These functions emulate the behavior of blocking I/O - operations by waiting for I/O to become available. - */ -#ifdef HAVE_YASSL - /* Set first argument of the transport functions. */ - yaSSL_transport_set_ptr(ssl, vio); - /* Set functions to use in order to send and receive data. */ - yaSSL_transport_set_recv_function(ssl, yassl_recv); - yaSSL_transport_set_send_function(ssl, yassl_send); -#endif - - if ((r= ssl_handshake_loop(vio, ssl, func, ssl_errno_holder)) < 1) - { - DBUG_PRINT("error", ("SSL_connect/accept failure")); - SSL_free(ssl); - DBUG_RETURN(1); - } - - /* - Connection succeeded. Install new function handlers, - change type, set sd to the fd used when connecting - and set pointer to the SSL structure - */ - if (vio_reset(vio, VIO_TYPE_SSL, SSL_get_fd(ssl), ssl, 0)) - DBUG_RETURN(1); - -#ifndef DBUG_OFF - { - /* Print some info about the peer */ - X509 *cert; - char buf[512]; - - DBUG_PRINT("info",("SSL connection succeeded")); - DBUG_PRINT("info",("Using cipher: '%s'" , SSL_get_cipher_name(ssl))); - - if ((cert= SSL_get_peer_certificate (ssl))) - { - DBUG_PRINT("info",("Peer certificate:")); - X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf)); - DBUG_PRINT("info",("\t subject: '%s'", buf)); - X509_NAME_oneline(X509_get_issuer_name(cert), buf, sizeof(buf)); - DBUG_PRINT("info",("\t issuer: '%s'", buf)); - X509_free(cert); - } - else - DBUG_PRINT("info",("Peer does not have certificate.")); - - if (SSL_get_shared_ciphers(ssl, buf, sizeof(buf))) - { - DBUG_PRINT("info",("shared_ciphers: '%s'", buf)); - } - else - DBUG_PRINT("info",("no shared ciphers!")); - } -#endif - - DBUG_RETURN(0); -} - - -int sslaccept(struct st_VioSSLFd *ptr, Vio *vio, long timeout, - unsigned long *ssl_errno_holder) -{ - DBUG_ENTER("sslaccept"); - DBUG_RETURN(ssl_do(ptr, vio, timeout, SSL_accept, ssl_errno_holder)); -} - - -int sslconnect(struct st_VioSSLFd *ptr, Vio *vio, long timeout, - unsigned long *ssl_errno_holder) -{ - DBUG_ENTER("sslconnect"); - DBUG_RETURN(ssl_do(ptr, vio, timeout, SSL_connect, ssl_errno_holder)); -} - - -my_bool vio_ssl_has_data(Vio *vio) -{ - return SSL_pending(vio->ssl_arg) > 0 ? TRUE : FALSE; -} - -#endif /* HAVE_OPENSSL */ diff --git a/mysql/vio/viosslfactories.c b/mysql/vio/viosslfactories.c deleted file mode 100644 index da5449a..0000000 --- a/mysql/vio/viosslfactories.c +++ /dev/null @@ -1,729 +0,0 @@ -/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ - -#include "vio_priv.h" - -#ifdef HAVE_OPENSSL - -#define TLS_VERSION_OPTION_SIZE 256 -#define SSL_CIPHER_LIST_SIZE 4096 - -#ifdef HAVE_YASSL -static const char tls_ciphers_list[]="DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:" - "AES128-RMD:DES-CBC3-RMD:DHE-RSA-AES256-RMD:" - "DHE-RSA-AES128-RMD:DHE-RSA-DES-CBC3-RMD:" - "AES256-SHA:RC4-SHA:RC4-MD5:DES-CBC3-SHA:" - "DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA:" - "EDH-RSA-DES-CBC-SHA:AES128-SHA:AES256-RMD"; -static const char tls_cipher_blocked[]= "!aNULL:!eNULL:!EXPORT:!LOW:!MD5:!DES:!RC2:!RC4:!PSK:"; -#else -static const char tls_ciphers_list[]="ECDHE-ECDSA-AES128-GCM-SHA256:" - "ECDHE-ECDSA-AES256-GCM-SHA384:" - "ECDHE-RSA-AES128-GCM-SHA256:" - "ECDHE-RSA-AES256-GCM-SHA384:" - "ECDHE-ECDSA-AES128-SHA256:" - "ECDHE-RSA-AES128-SHA256:" - "ECDHE-ECDSA-AES256-SHA384:" - "ECDHE-RSA-AES256-SHA384:" - "DHE-RSA-AES128-GCM-SHA256:" - "DHE-DSS-AES128-GCM-SHA256:" - "DHE-RSA-AES128-SHA256:" - "DHE-DSS-AES128-SHA256:" - "DHE-DSS-AES256-GCM-SHA384:" - "DHE-RSA-AES256-SHA256:" - "DHE-DSS-AES256-SHA256:" - "ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:" - "ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:" - "DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:" - "TLS_DHE_DSS_WITH_AES_256_CBC_SHA:DHE-RSA-AES256-SHA:" - "AES128-GCM-SHA256:DH-DSS-AES128-GCM-SHA256:" - "ECDH-ECDSA-AES128-GCM-SHA256:AES256-GCM-SHA384:" - "DH-DSS-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:" - "AES128-SHA256:DH-DSS-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES256-SHA256:" - "DH-DSS-AES256-SHA256:ECDH-ECDSA-AES256-SHA384:AES128-SHA:" - "DH-DSS-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES256-SHA:" - "DH-DSS-AES256-SHA:ECDH-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:" - "DH-RSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:DH-RSA-AES256-GCM-SHA384:" - "ECDH-RSA-AES256-GCM-SHA384:DH-RSA-AES128-SHA256:" - "ECDH-RSA-AES128-SHA256:DH-RSA-AES256-SHA256:" - "ECDH-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:" - "ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:" - "ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:" - "TLS_DHE_DSS_WITH_AES_256_CBC_SHA:DHE-RSA-AES256-SHA:" - "AES128-SHA:DH-DSS-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES256-SHA:" - "DH-DSS-AES256-SHA:ECDH-ECDSA-AES256-SHA:DH-RSA-AES128-SHA:" - "ECDH-RSA-AES128-SHA:DH-RSA-AES256-SHA:ECDH-RSA-AES256-SHA:DES-CBC3-SHA"; -static const char tls_cipher_blocked[]= "!aNULL:!eNULL:!EXPORT:!LOW:!MD5:!DES:!RC2:!RC4:!PSK:" - "!DHE-DSS-DES-CBC3-SHA:!DHE-RSA-DES-CBC3-SHA:" - "!ECDH-RSA-DES-CBC3-SHA:!ECDH-ECDSA-DES-CBC3-SHA:" - "!ECDHE-RSA-DES-CBC3-SHA:!ECDHE-ECDSA-DES-CBC3-SHA:"; -#endif - -static my_bool ssl_initialized = FALSE; - -/* - Diffie-Hellman key. - Generated using: >openssl dhparam -5 -C 2048 - - -----BEGIN DH PARAMETERS----- - MIIBCAKCAQEAil36wGZ2TmH6ysA3V1xtP4MKofXx5n88xq/aiybmGnReZMviCPEJ - 46+7VCktl/RZ5iaDH1XNG1dVQmznt9pu2G3usU+k1/VB4bQL4ZgW4u0Wzxh9PyXD - glm99I9Xyj4Z5PVE4MyAsxCRGA1kWQpD9/zKAegUBPLNqSo886Uqg9hmn8ksyU9E - BV5eAEciCuawh6V0O+Sj/C3cSfLhgA0GcXp3OqlmcDu6jS5gWjn3LdP1U0duVxMB - h/neTSCSvtce4CAMYMjKNVh9P1nu+2d9ZH2Od2xhRIqMTfAS1KTqF3VmSWzPFCjG - mjxx/bg6bOOjpgZapvB6ABWlWmRmAAWFtwIBBQ== - -----END DH PARAMETERS----- - */ -static unsigned char dh2048_p[]= -{ - 0x8A, 0x5D, 0xFA, 0xC0, 0x66, 0x76, 0x4E, 0x61, 0xFA, 0xCA, 0xC0, 0x37, - 0x57, 0x5C, 0x6D, 0x3F, 0x83, 0x0A, 0xA1, 0xF5, 0xF1, 0xE6, 0x7F, 0x3C, - 0xC6, 0xAF, 0xDA, 0x8B, 0x26, 0xE6, 0x1A, 0x74, 0x5E, 0x64, 0xCB, 0xE2, - 0x08, 0xF1, 0x09, 0xE3, 0xAF, 0xBB, 0x54, 0x29, 0x2D, 0x97, 0xF4, 0x59, - 0xE6, 0x26, 0x83, 0x1F, 0x55, 0xCD, 0x1B, 0x57, 0x55, 0x42, 0x6C, 0xE7, - 0xB7, 0xDA, 0x6E, 0xD8, 0x6D, 0xEE, 0xB1, 0x4F, 0xA4, 0xD7, 0xF5, 0x41, - 0xE1, 0xB4, 0x0B, 0xE1, 0x98, 0x16, 0xE2, 0xED, 0x16, 0xCF, 0x18, 0x7D, - 0x3F, 0x25, 0xC3, 0x82, 0x59, 0xBD, 0xF4, 0x8F, 0x57, 0xCA, 0x3E, 0x19, - 0xE4, 0xF5, 0x44, 0xE0, 0xCC, 0x80, 0xB3, 0x10, 0x91, 0x18, 0x0D, 0x64, - 0x59, 0x0A, 0x43, 0xF7, 0xFC, 0xCA, 0x01, 0xE8, 0x14, 0x04, 0xF2, 0xCD, - 0xA9, 0x2A, 0x3C, 0xF3, 0xA5, 0x2A, 0x83, 0xD8, 0x66, 0x9F, 0xC9, 0x2C, - 0xC9, 0x4F, 0x44, 0x05, 0x5E, 0x5E, 0x00, 0x47, 0x22, 0x0A, 0xE6, 0xB0, - 0x87, 0xA5, 0x74, 0x3B, 0xE4, 0xA3, 0xFC, 0x2D, 0xDC, 0x49, 0xF2, 0xE1, - 0x80, 0x0D, 0x06, 0x71, 0x7A, 0x77, 0x3A, 0xA9, 0x66, 0x70, 0x3B, 0xBA, - 0x8D, 0x2E, 0x60, 0x5A, 0x39, 0xF7, 0x2D, 0xD3, 0xF5, 0x53, 0x47, 0x6E, - 0x57, 0x13, 0x01, 0x87, 0xF9, 0xDE, 0x4D, 0x20, 0x92, 0xBE, 0xD7, 0x1E, - 0xE0, 0x20, 0x0C, 0x60, 0xC8, 0xCA, 0x35, 0x58, 0x7D, 0x3F, 0x59, 0xEE, - 0xFB, 0x67, 0x7D, 0x64, 0x7D, 0x8E, 0x77, 0x6C, 0x61, 0x44, 0x8A, 0x8C, - 0x4D, 0xF0, 0x12, 0xD4, 0xA4, 0xEA, 0x17, 0x75, 0x66, 0x49, 0x6C, 0xCF, - 0x14, 0x28, 0xC6, 0x9A, 0x3C, 0x71, 0xFD, 0xB8, 0x3A, 0x6C, 0xE3, 0xA3, - 0xA6, 0x06, 0x5A, 0xA6, 0xF0, 0x7A, 0x00, 0x15, 0xA5, 0x5A, 0x64, 0x66, - 0x00, 0x05, 0x85, 0xB7, -}; - -static unsigned char dh2048_g[]={ - 0x05, -}; - -static DH *get_dh2048(void) -{ - DH *dh; - if ((dh=DH_new())) - { - dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL); - dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL); - if (! dh->p || ! dh->g) - { - DH_free(dh); - dh=0; - } - } - return(dh); -} - - -static void -report_errors() -{ - unsigned long l; - const char* file; - const char* data; - int line,flags; - - DBUG_ENTER("report_errors"); - - while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0) - { -#ifndef DBUG_OFF /* Avoid warning */ - char buf[200]; - DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf), - file,line,(flags & ERR_TXT_STRING) ? data : "")) ; -#endif - } - DBUG_VOID_RETURN; -} - -static const char* -ssl_error_string[] = -{ - "No error", - "Unable to get certificate", - "Unable to get private key", - "Private key does not match the certificate public key", - "SSL_CTX_set_default_verify_paths failed", - "Failed to set ciphers to use", - "SSL_CTX_new failed", - "SSL context is not usable without certificate and private key", - "SSL_CTX_set_tmp_dh failed", - "TLS version is invalid" -}; - -const char* -sslGetErrString(enum enum_ssl_init_error e) -{ - DBUG_ASSERT(SSL_INITERR_NOERROR < e && e < SSL_INITERR_LASTERR); - return ssl_error_string[e]; -} - -static int -vio_set_cert_stuff(SSL_CTX *ctx, const char *cert_file, const char *key_file, - enum enum_ssl_init_error* error) -{ - DBUG_ENTER("vio_set_cert_stuff"); - DBUG_PRINT("enter", ("ctx: 0x%lx cert_file: %s key_file: %s", - (long) ctx, cert_file, key_file)); - - if (!cert_file && key_file) - cert_file= key_file; - - if (!key_file && cert_file) - key_file= cert_file; - - if (cert_file && - SSL_CTX_use_certificate_file(ctx, cert_file, SSL_FILETYPE_PEM) <= 0) - { - *error= SSL_INITERR_CERT; - DBUG_PRINT("error",("%s from file '%s'", sslGetErrString(*error), cert_file)); - DBUG_EXECUTE("error", ERR_print_errors_fp(DBUG_FILE);); - my_message_local(ERROR_LEVEL, "SSL error: %s from '%s'", - sslGetErrString(*error), cert_file); - DBUG_RETURN(1); - } - - if (key_file && - SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) <= 0) - { - *error= SSL_INITERR_KEY; - DBUG_PRINT("error", ("%s from file '%s'", sslGetErrString(*error), key_file)); - DBUG_EXECUTE("error", ERR_print_errors_fp(DBUG_FILE);); - my_message_local(ERROR_LEVEL, "SSL error: %s from '%s'", - sslGetErrString(*error), key_file); - DBUG_RETURN(1); - } - - /* - If we are using DSA, we can copy the parameters from the private key - Now we know that a key and cert have been set against the SSL context - */ - if (cert_file && !SSL_CTX_check_private_key(ctx)) - { - *error= SSL_INITERR_NOMATCH; - DBUG_PRINT("error", ("%s",sslGetErrString(*error))); - DBUG_EXECUTE("error", ERR_print_errors_fp(DBUG_FILE);); - my_message_local(ERROR_LEVEL, "SSL error: %s", sslGetErrString(*error)); - DBUG_RETURN(1); - } - - DBUG_RETURN(0); -} - -#ifndef HAVE_YASSL -/* OpenSSL specific */ - -#ifdef HAVE_PSI_INTERFACE -static PSI_rwlock_key key_rwlock_openssl; - -static PSI_rwlock_info openssl_rwlocks[]= -{ - { &key_rwlock_openssl, "CRYPTO_dynlock_value::lock", 0} -}; -#endif - - -typedef struct CRYPTO_dynlock_value -{ - mysql_rwlock_t lock; -} openssl_lock_t; - - -/* Array of locks used by openssl internally for thread synchronization. - The number of locks is equal to CRYPTO_num_locks. -*/ -static openssl_lock_t *openssl_stdlocks; - -/*OpenSSL callback functions for multithreading. We implement all the functions - as we are using our own locking mechanism. -*/ -static void openssl_lock(int mode, openssl_lock_t *lock, - const char *file MY_ATTRIBUTE((unused)), - int line MY_ATTRIBUTE((unused))) -{ - int err; - char const *what; - - switch (mode) { - case CRYPTO_LOCK|CRYPTO_READ: - what = "read lock"; - err= mysql_rwlock_rdlock(&lock->lock); - break; - case CRYPTO_LOCK|CRYPTO_WRITE: - what = "write lock"; - err= mysql_rwlock_wrlock(&lock->lock); - break; - case CRYPTO_UNLOCK|CRYPTO_READ: - case CRYPTO_UNLOCK|CRYPTO_WRITE: - what = "unlock"; - err= mysql_rwlock_unlock(&lock->lock); - break; - default: - /* Unknown locking mode. */ - DBUG_PRINT("error", - ("Fatal OpenSSL: %s:%d: interface problem (mode=0x%x)\n", - file, line, mode)); - - fprintf(stderr, "Fatal: OpenSSL interface problem (mode=0x%x)", mode); - fflush(stderr); - abort(); - } - if (err) - { - DBUG_PRINT("error", - ("Fatal OpenSSL: %s:%d: can't %s OpenSSL lock\n", - file, line, what)); - - fprintf(stderr, "Fatal: can't %s OpenSSL lock", what); - fflush(stderr); - abort(); - } -} - -static void openssl_lock_function(int mode, int n, - const char *file MY_ATTRIBUTE((unused)), - int line MY_ATTRIBUTE((unused))) -{ - if (n < 0 || n > CRYPTO_num_locks()) - { - /* Lock number out of bounds. */ - DBUG_PRINT("error", - ("Fatal OpenSSL: %s:%d: interface problem (n = %d)", file, line, n)); - - fprintf(stderr, "Fatal: OpenSSL interface problem (n = %d)", n); - fflush(stderr); - abort(); - } - openssl_lock(mode, &openssl_stdlocks[n], file, line); -} - -static openssl_lock_t *openssl_dynlock_create(const char *file - MY_ATTRIBUTE((unused)), - int line MY_ATTRIBUTE((unused))) -{ - openssl_lock_t *lock; - - DBUG_PRINT("info", ("openssl_dynlock_create: %s:%d", file, line)); - - lock= (openssl_lock_t*) - my_malloc(PSI_NOT_INSTRUMENTED,sizeof(openssl_lock_t),MYF(0)); - -#ifdef HAVE_PSI_INTERFACE - mysql_rwlock_init(key_rwlock_openssl, &lock->lock); -#else - mysql_rwlock_init(0, &lock->lock); -#endif - return lock; -} - - -static void openssl_dynlock_destroy(openssl_lock_t *lock, - const char *file MY_ATTRIBUTE((unused)), - int line MY_ATTRIBUTE((unused))) -{ - DBUG_PRINT("info", ("openssl_dynlock_destroy: %s:%d", file, line)); - - mysql_rwlock_destroy(&lock->lock); - my_free(lock); -} - -static unsigned long openssl_id_function() -{ - return (unsigned long) my_thread_self(); -} - -//End of mutlithreading callback functions - -static void init_ssl_locks() -{ - int i= 0; -#ifdef HAVE_PSI_INTERFACE - const char* category= "sql"; - int count= array_elements(openssl_rwlocks); - mysql_rwlock_register(category, openssl_rwlocks, count); -#endif - - openssl_stdlocks= (openssl_lock_t*) OPENSSL_malloc(CRYPTO_num_locks() * - sizeof(openssl_lock_t)); - for (i= 0; i < CRYPTO_num_locks(); ++i) -#ifdef HAVE_PSI_INTERFACE - mysql_rwlock_init(key_rwlock_openssl, &openssl_stdlocks[i].lock); -#else - mysql_rwlock_init(0, &openssl_stdlocks[i].lock); -#endif -} - -static void set_lock_callback_functions(my_bool init) -{ - CRYPTO_set_locking_callback(init ? openssl_lock_function : NULL); - CRYPTO_set_id_callback(init ? openssl_id_function : NULL); - CRYPTO_set_dynlock_create_callback(init ? openssl_dynlock_create : NULL); - CRYPTO_set_dynlock_destroy_callback(init ? openssl_dynlock_destroy : NULL); - CRYPTO_set_dynlock_lock_callback(init ? openssl_lock : NULL); -} - -static void init_lock_callback_functions() -{ - set_lock_callback_functions(TRUE); -} - -static void deinit_lock_callback_functions() -{ - set_lock_callback_functions(FALSE); -} - -void vio_ssl_end() -{ - int i= 0; - - if (ssl_initialized) { - ERR_remove_state(0); - ERR_free_strings(); - EVP_cleanup(); - - CRYPTO_cleanup_all_ex_data(); - - deinit_lock_callback_functions(); - - for (; i < CRYPTO_num_locks(); ++i) - mysql_rwlock_destroy(&openssl_stdlocks[i].lock); - OPENSSL_free(openssl_stdlocks); - - ssl_initialized= FALSE; - } -} - -#endif //OpenSSL specific - -void ssl_start() -{ - if (!ssl_initialized) - { - ssl_initialized= TRUE; - - SSL_library_init(); - OpenSSL_add_all_algorithms(); - SSL_load_error_strings(); - -#ifndef HAVE_YASSL - init_ssl_locks(); - init_lock_callback_functions(); -#endif - } -} - -long process_tls_version(const char *tls_version) -{ - const char *separator= ","; - char *token, *lasts= NULL; -#ifndef HAVE_YASSL - unsigned int tls_versions_count= 3; - const char *tls_version_name_list[3]= {"TLSv1", "TLSv1.1", "TLSv1.2"}; - const char ctx_flag_default[]= "TLSv1,TLSv1.1,TLSv1.2"; - const long tls_ctx_list[3]= {SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1, SSL_OP_NO_TLSv1_2}; - long tls_ctx_flag= SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2; -#else - unsigned int tls_versions_count= 2; - const char *tls_version_name_list[2]= {"TLSv1", "TLSv1.1"}; - const long tls_ctx_list[2]= {SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1}; - const char ctx_flag_default[]= "TLSv1,TLSv1.1"; - long tls_ctx_flag= SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1; -#endif - unsigned int index= 0; - char tls_version_option[TLS_VERSION_OPTION_SIZE]= ""; - int tls_found= 0; - - if (!tls_version || !my_strcasecmp(&my_charset_latin1, tls_version, ctx_flag_default)) - return 0; - - if (strlen(tls_version)-1 > sizeof(tls_version_option)) - return -1; - - strncpy(tls_version_option, tls_version, sizeof(tls_version_option)); - token= my_strtok_r(tls_version_option, separator, &lasts); - while (token) - { - for (index=0; index < tls_versions_count; index++) - { - if (!my_strcasecmp(&my_charset_latin1, tls_version_name_list[index], token)) - { - tls_found= 1; - tls_ctx_flag= tls_ctx_flag & (~tls_ctx_list[index]); - break; - } - } - token= my_strtok_r(NULL, separator, &lasts); - } - - if (!tls_found) - return -1; - else - return tls_ctx_flag; -} - -/************************ VioSSLFd **********************************/ -static struct st_VioSSLFd * -new_VioSSLFd(const char *key_file, const char *cert_file, - const char *ca_file, const char *ca_path, - const char *cipher, my_bool is_client, - enum enum_ssl_init_error *error, - const char *crl_file, const char *crl_path, const long ssl_ctx_flags) -{ - DH *dh; - struct st_VioSSLFd *ssl_fd; - long ssl_ctx_options= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3; - int ret_set_cipherlist= 0; - char cipher_list[SSL_CIPHER_LIST_SIZE]= {0}; - DBUG_ENTER("new_VioSSLFd"); - DBUG_PRINT("enter", - ("key_file: '%s' cert_file: '%s' ca_file: '%s' ca_path: '%s' " - "cipher: '%s' crl_file: '%s' crl_path: '%s' ssl_ctx_flags: '%ld' ", - key_file ? key_file : "NULL", - cert_file ? cert_file : "NULL", - ca_file ? ca_file : "NULL", - ca_path ? ca_path : "NULL", - cipher ? cipher : "NULL", - crl_file ? crl_file : "NULL", - crl_path ? crl_path : "NULL", - ssl_ctx_flags)); - - if (ssl_ctx_flags < 0) - { - *error= SSL_TLS_VERSION_INVALID; - DBUG_PRINT("error", ("TLS version invalid : %s", sslGetErrString(*error))); - report_errors(); - DBUG_RETURN(0); - } - - ssl_ctx_options= (ssl_ctx_options | ssl_ctx_flags) & - (SSL_OP_NO_SSLv2 | - SSL_OP_NO_SSLv3 | - SSL_OP_NO_TLSv1 | - SSL_OP_NO_TLSv1_1 -#ifndef HAVE_YASSL - | SSL_OP_NO_TLSv1_2 - - -#endif - ); - if (!(ssl_fd= ((struct st_VioSSLFd*) - my_malloc(key_memory_vio_ssl_fd, - sizeof(struct st_VioSSLFd),MYF(0))))) - DBUG_RETURN(0); - - if (!(ssl_fd->ssl_context= SSL_CTX_new(is_client ? - SSLv23_client_method() : - SSLv23_server_method()))) - { - *error= SSL_INITERR_MEMFAIL; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - my_free(ssl_fd); - DBUG_RETURN(0); - } - - SSL_CTX_set_options(ssl_fd->ssl_context, ssl_ctx_options); - - /* - Set the ciphers that can be used - NOTE: SSL_CTX_set_cipher_list will return 0 if - none of the provided ciphers could be selected - */ - strcat(cipher_list, tls_cipher_blocked); - if (cipher) - strcat(cipher_list, cipher); - else - strcat(cipher_list, tls_ciphers_list); - - if (ret_set_cipherlist == SSL_CTX_set_cipher_list(ssl_fd->ssl_context, cipher_list)) - { - *error= SSL_INITERR_CIPHERS; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - - /* Load certs from the trusted ca */ - if (SSL_CTX_load_verify_locations(ssl_fd->ssl_context, ca_file, ca_path) <= 0) - { - DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed")); - if (ca_file || ca_path) - { - /* fail only if ca file or ca path were supplied and looking into - them fails. */ - *error= SSL_INITERR_BAD_PATHS; - DBUG_PRINT("error", ("SSL_CTX_load_verify_locations failed : %s", - sslGetErrString(*error))); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - - /* otherwise go use the defaults */ - if (SSL_CTX_set_default_verify_paths(ssl_fd->ssl_context) == 0) - { - *error= SSL_INITERR_BAD_PATHS; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - } - - if (crl_file || crl_path) - { -#ifdef HAVE_YASSL - DBUG_PRINT("warning", ("yaSSL doesn't support CRL")); - DBUG_ASSERT(0); -#else - X509_STORE *store= SSL_CTX_get_cert_store(ssl_fd->ssl_context); - /* Load crls from the trusted ca */ - if (X509_STORE_load_locations(store, crl_file, crl_path) == 0 || - X509_STORE_set_flags(store, - X509_V_FLAG_CRL_CHECK | - X509_V_FLAG_CRL_CHECK_ALL) == 0) - { - DBUG_PRINT("warning", ("X509_STORE_load_locations for CRL failed")); - *error= SSL_INITERR_BAD_PATHS; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } -#endif - } - - if (vio_set_cert_stuff(ssl_fd->ssl_context, cert_file, key_file, error)) - { - DBUG_PRINT("error", ("vio_set_cert_stuff failed")); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - - /* Server specific check : Must have certificate and key file */ - if (!is_client && !key_file && !cert_file) - { - *error= SSL_INITERR_NO_USABLE_CTX; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - - /* DH stuff */ - dh= get_dh2048(); - if (SSL_CTX_set_tmp_dh(ssl_fd->ssl_context, dh) == 0) - { - *error= SSL_INITERR_DHFAIL; - DBUG_PRINT("error", ("%s", sslGetErrString(*error))); - report_errors(); - DH_free(dh); - SSL_CTX_free(ssl_fd->ssl_context); - my_free(ssl_fd); - DBUG_RETURN(0); - } - DH_free(dh); - - DBUG_PRINT("exit", ("OK 1")); - - DBUG_RETURN(ssl_fd); -} - - -/************************ VioSSLConnectorFd **********************************/ -struct st_VioSSLFd * -new_VioSSLConnectorFd(const char *key_file, const char *cert_file, - const char *ca_file, const char *ca_path, - const char *cipher, enum enum_ssl_init_error* error, - const char *crl_file, const char *crl_path, const long ssl_ctx_flags) -{ - struct st_VioSSLFd *ssl_fd; - int verify= SSL_VERIFY_PEER; - - /* - Turn off verification of servers certificate if both - ca_file and ca_path is set to NULL - */ - if (ca_file == 0 && ca_path == 0) - verify= SSL_VERIFY_NONE; - - if (!(ssl_fd= new_VioSSLFd(key_file, cert_file, ca_file, - ca_path, cipher, TRUE, error, - crl_file, crl_path, ssl_ctx_flags))) - { - return 0; - } - - /* Init the VioSSLFd as a "connector" ie. the client side */ - - SSL_CTX_set_verify(ssl_fd->ssl_context, verify, NULL); - - return ssl_fd; -} - - -/************************ VioSSLAcceptorFd **********************************/ -struct st_VioSSLFd * -new_VioSSLAcceptorFd(const char *key_file, const char *cert_file, - const char *ca_file, const char *ca_path, - const char *cipher, enum enum_ssl_init_error* error, - const char *crl_file, const char * crl_path, const long ssl_ctx_flags) -{ - struct st_VioSSLFd *ssl_fd; - int verify= SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE; - if (!(ssl_fd= new_VioSSLFd(key_file, cert_file, ca_file, - ca_path, cipher, FALSE, error, - crl_file, crl_path, ssl_ctx_flags))) - { - return 0; - } - /* Init the the VioSSLFd as a "acceptor" ie. the server side */ - - /* Set max number of cached sessions, returns the previous size */ - SSL_CTX_sess_set_cache_size(ssl_fd->ssl_context, 128); - - SSL_CTX_set_verify(ssl_fd->ssl_context, verify, NULL); - - /* - Set session_id - an identifier for this server session - Use the ssl_fd pointer - */ - SSL_CTX_set_session_id_context(ssl_fd->ssl_context, - (const unsigned char *)ssl_fd, - sizeof(ssl_fd)); - - return ssl_fd; -} - -void free_vio_ssl_acceptor_fd(struct st_VioSSLFd *fd) -{ - SSL_CTX_free(fd->ssl_context); - my_free(fd); -} -#endif /* HAVE_OPENSSL */ |