Add libmysql option to specify the SNI servername for SSL connection

Summary:
This change adds an option to specify the SNI server name to be used when the client does a sslConnect .
Added a new mysql_option, MYSQL_OPT_TLS_SNI_SERVERNAME.
It can be set with :
`mysql_options(mysql, MYSQL_OPT_TLS_SNI_SERVERNAME, dbname);`

If the server rejects the request for this sni servername, clients will get the new error code 2068 (SSL_R_TLSV1_UNRECOGNIZED_NAME) instead of the general 2026(CR_SSL_CONNECTION_ERROR).

Reviewed By: lloyd

Differential Revision: D24125968

Author: aditya-jalan

include/errmsg.h

@@ -261,7 +261,8 @@ extern const char *client_errors[]; /* Error messages */
 // Facebook client errors
 #define CR_NET_READ_INTERRUPTED 2200
 #define CR_NET_WRITE_INTERRUPTED 2201
-#define CR_ERROR_LAST /*Copy last error nr:*/ 2201
+#define CR_TLS_SERVER_NOT_FOUND 2202
+#define CR_ERROR_LAST /*Copy last error nr:*/ 2202
 /* Add error numbers before CR_ERROR_LAST and change it accordingly. */
 
 #define CR_PLACEHOLDER_FIRST CR_PLACEHOLDER_2074

include/mysql.h

@@ -221,6 +221,7 @@ enum mysql_option {
   MYSQL_OPT_CONNECT_TIMEOUT_MS,
   MYSQL_OPT_READ_TIMEOUT_MS,
   MYSQL_OPT_WRITE_TIMEOUT_MS,
+  MYSQL_OPT_TLS_SNI_SERVERNAME,
 };
 
 /**

include/mysql.h.pp

@@ -414,7 +414,7 @@
          client_errno <= 2199;
 }
 static inline const char *ER_CLIENT(int client_errno) {
-  if (client_errno >= 2000 && client_errno <= 2201 &&
+  if (client_errno >= 2000 && client_errno <= 2202 &&
       !isPlaceHolder(client_errno)) {
     return client_errors[client_errno - 2000];
   }
@@ -515,6 +515,7 @@
   MYSQL_OPT_CONNECT_TIMEOUT_MS,
   MYSQL_OPT_READ_TIMEOUT_MS,
   MYSQL_OPT_WRITE_TIMEOUT_MS,
+  MYSQL_OPT_TLS_SNI_SERVERNAME,
 };
 struct st_mysql_options_extention;
 struct st_mysql_options {

include/sql_common.h

@@ -188,6 +188,7 @@ struct st_mysql_options_extention {
   bool connection_compressed;
   char *load_data_dir;
   struct client_authentication_info client_auth_info[MAX_AUTHENTICATION_FACTOR];
+  char *tls_sni_servername; /* TLS sni server name */
   void *ssl_session_data; /** the session serialization to use */
   void *ssl_context;
 };

include/violite.h

@@ -273,7 +273,8 @@ struct st_VioSSLFd {
 int sslaccept(struct st_VioSSLFd *, MYSQL_VIO, long timeout,
               unsigned long *errptr);
 int sslconnect(struct st_VioSSLFd *, MYSQL_VIO, long timeout,
-               SSL_SESSION *session, unsigned long *errptr, SSL **ssl);
+               SSL_SESSION *session, unsigned long *errptr, SSL **ssl,
+               const char *sni_servername = nullptr);
 
 struct st_VioSSLFd *new_VioSSLConnectorFdFromContext(
     SSL_CTX *context, enum enum_ssl_init_error *error);

libmysql/errmsg.cc

@@ -247,6 +247,8 @@ const char *client_errors[] = {
     "Placeholder 2199",
     "Read timeout is reached",
     "Write timeout is reached",
+    "Server rejected the ssl handshake for specified sni servername, sslerror: "
+    "%-.100s",
     ""};
 
 static const char *get_client_errmsg(int nr) {

sql-common/client.cc

@@ -3587,6 +3587,7 @@ static void mysql_ssl_free(MYSQL *mysql) {
     my_free(mysql->options.extension->ssl_crlpath);
     my_free(mysql->options.extension->tls_ciphersuites);
     my_free(mysql->options.extension->load_data_dir);
+    my_free(mysql->options.extension->tls_sni_servername);
     for (unsigned int idx = 0; idx < MAX_AUTHENTICATION_FACTOR; idx++) {
       if (mysql->options.extension->client_auth_info[idx].plugin_name) {
         my_free(mysql->options.extension->client_auth_info[idx].plugin_name);
@@ -3613,6 +3614,7 @@ static void mysql_ssl_free(MYSQL *mysql) {
     mysql->options.extension->ssl_fips_mode = SSL_FIPS_MODE_OFF;
     mysql->options.extension->tls_ciphersuites = nullptr;
     mysql->options.extension->load_data_dir = nullptr;
+    mysql->options.extension->tls_sni_servername = nullptr;
   }
   mysql->connector_fd = nullptr;
 }
@@ -4649,27 +4651,39 @@ static int cli_establish_ssl(MYSQL *mysql) {
     /* Connect to the server */
     DBUG_PRINT("info", ("IO layer change in progress..."));
     MYSQL_TRACE(SSL_CONNECT, mysql, ());
-    ssize_t ret = sslconnect(ssl_fd, net->vio,
-                             timeout_to_seconds(mysql->options.connect_timeout),
-                             ssl_session, &ssl_error, nullptr);
+    ssize_t ret = sslconnect(
+        ssl_fd, net->vio, timeout_to_seconds(mysql->options.connect_timeout),
+        ssl_session, &ssl_error, nullptr,
+        options->extension ? options->extension->tls_sni_servername : nullptr);
     if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
-    switch (ret) {
-      case VIO_SOCKET_ERROR:
-        char ssl_buf[512];
-        char buf[1025];
-        ERR_error_string_n(ssl_error, ssl_buf, 512);
-        ssl_buf[511] = 0;
-        snprintf(buf, sizeof(buf) - 1, "%s (errno %d)", ssl_buf, errno);
+    if (ret) {
+      switch (ret) {
+        case VIO_SOCKET_READ_TIMEOUT:
+          set_mysql_error(mysql, CR_NET_READ_INTERRUPTED, unknown_sqlstate);
+          goto error;
+        case VIO_SOCKET_WRITE_TIMEOUT:
+          set_mysql_error(mysql, CR_NET_WRITE_INTERRUPTED, unknown_sqlstate);
+          goto error;
+        default:
+          break;
+          /* continue for error handling */
+      }
+      char ssl_buf[512];
+      char buf[1025];
+      ERR_error_string_n(ssl_error, ssl_buf, 512);
+      ssl_buf[511] = 0;
+      snprintf(buf, sizeof(buf) - 1, "%s (errno %d)", ssl_buf, errno);
+
+      if (ERR_GET_REASON(ssl_error) == SSL_R_TLSV1_UNRECOGNIZED_NAME) {
+        set_mysql_extended_error(mysql, CR_TLS_SERVER_NOT_FOUND,
+                                 unknown_sqlstate,
+                                 ER_CLIENT(CR_TLS_SERVER_NOT_FOUND), buf);
+      } else {
         set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
                                  unknown_sqlstate,
                                  ER_CLIENT(CR_SSL_CONNECTION_ERROR), buf);
-        goto error;
-      case VIO_SOCKET_READ_TIMEOUT:
-        set_mysql_error(mysql, CR_NET_READ_INTERRUPTED, unknown_sqlstate);
-        goto error;
-      case VIO_SOCKET_WRITE_TIMEOUT:
-        set_mysql_error(mysql, CR_NET_WRITE_INTERRUPTED, unknown_sqlstate);
-        goto error;
+      }
+      goto error;
     }
     DBUG_PRINT("info", ("IO layer change done!"));
 
@@ -4834,7 +4848,10 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
     MYSQL_TRACE(SSL_CONNECT, mysql, ());
     if ((ret = sslconnect(ssl_fd, net->vio,
                           timeout_to_seconds(mysql->options.connect_timeout),
-                          ssl_session, &ssl_error, &ctx->ssl))) {
+                          ssl_session, &ssl_error, &ctx->ssl,
+                          options->extension
+                              ? options->extension->tls_sni_servername
+                              : nullptr))) {
       if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
       switch (ret) {
         case VIO_SOCKET_WANT_READ:
@@ -4859,8 +4876,17 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
       ERR_error_string_n(ssl_error, ssl_buf, 512);
       ssl_buf[511] = 0;
       snprintf(buf, sizeof(buf) - 1, "%s (errno %d)", ssl_buf, errno);
-      set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate,
-                               ER_CLIENT(CR_SSL_CONNECTION_ERROR), buf);
+
+      if (ERR_GET_REASON(ssl_error) == SSL_R_TLSV1_UNRECOGNIZED_NAME) {
+        set_mysql_extended_error(mysql, CR_TLS_SERVER_NOT_FOUND,
+                                 unknown_sqlstate,
+                                 ER_CLIENT(CR_TLS_SERVER_NOT_FOUND), buf);
+      } else {
+        set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
+                                 unknown_sqlstate,
+                                 ER_CLIENT(CR_SSL_CONNECTION_ERROR), buf);
+      }
+
       goto error;
     }
     if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
@@ -8942,6 +8968,10 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
       EXTENSION_SET_STRING(&mysql->options, tls_ciphersuites,
                            static_cast<const char *>(arg));
       break;
+    case MYSQL_OPT_TLS_SNI_SERVERNAME:
+      EXTENSION_SET_STRING(&mysql->options, tls_sni_servername,
+                           static_cast<const char *>(arg));
+      break;
     case MYSQL_OPT_SSL_CRL:
       if (mysql->options.extension)
         my_free(mysql->options.extension->ssl_crl);
@@ -9231,6 +9261,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
     MYSQL_OPT_SSL_CA, MYSQL_OPT_SSL_CAPATH, MYSQL_OPT_SSL_CIPHER,
     MYSQL_OPT_TLS_CIPHERSUITES, MYSQL_OPT_SSL_CRL, MYSQL_OPT_SSL_CRLPATH,
     MYSQL_OPT_TLS_VERSION, MYSQL_SERVER_PUBLIC_KEY, MYSQL_OPT_SSL_FIPS_MODE
+    MYSQL_OPT_TLS_SNI_SERVERNAME
 
   <none, error returned>
     MYSQL_OPT_NAMED_PIPE, MYSQL_OPT_CONNECT_ATTR_RESET,
@@ -9364,6 +9395,12 @@ int STDCALL mysql_get_option(MYSQL *mysql, enum mysql_option option,
           mysql->options.extension ? mysql->options.extension->tls_ciphersuites
                                    : nullptr;
       break;
+    case MYSQL_OPT_TLS_SNI_SERVERNAME:
+      *(static_cast<char **>(const_cast<void *>(arg))) =
+          mysql->options.extension
+              ? mysql->options.extension->tls_sni_servername
+              : nullptr;
+      break;
     case MYSQL_OPT_RETRY_COUNT:
       *(const_cast<uint *>(static_cast<const uint *>(arg))) =
           mysql->options.extension ? mysql->options.extension->retry_count : 1;

testclients/mysql_client_test.cc

@@ -19039,7 +19039,8 @@ static void test_wl6791() {
                                    MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS,
                                    MYSQL_OPT_OPTIONAL_RESULTSET_METADATA},
                     const_char_opts[] =
-  { MYSQL_READ_DEFAULT_FILE,
+  {
+    MYSQL_READ_DEFAULT_FILE,
     MYSQL_READ_DEFAULT_GROUP,
     MYSQL_SET_CHARSET_DIR,
     MYSQL_SET_CHARSET_NAME,
@@ -19056,9 +19057,11 @@ static void test_wl6791() {
     MYSQL_OPT_SSL_CAPATH,
     MYSQL_OPT_SSL_CIPHER,
     MYSQL_OPT_TLS_CIPHERSUITES,
+    MYSQL_OPT_TLS_SNI_SERVERNAME,
     MYSQL_OPT_SSL_CRL,
     MYSQL_OPT_SSL_CRLPATH,
-    MYSQL_SERVER_PUBLIC_KEY },
+    MYSQL_SERVER_PUBLIC_KEY
+  },
                     err_opts[] = {
                         MYSQL_OPT_NAMED_PIPE, MYSQL_OPT_CONNECT_ATTR_RESET,
                         MYSQL_OPT_CONNECT_ATTR_DELETE, MYSQL_INIT_COMMAND};

vio/viossl.cc

@@ -653,7 +653,8 @@ static void print_ssl_session_id(SSL_SESSION *sess, const char *action) {
 
 static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
                   SSL_SESSION *ssl_session, ssl_handshake_func_t func,
-                  unsigned long *ssl_errno_holder, SSL **sslptr) {
+                  unsigned long *ssl_errno_holder, SSL **sslptr,
+                  const char *sni_servername) {
   SSL *ssl = nullptr;
   my_socket sd = mysql_socket_getfd(vio->mysql_socket);
 
@@ -691,6 +692,17 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
       }
     }
 
+// Check if the openssl supports SNI, and only then set the tlsext_host_name
+#if OPENSSL_VERSION_NUMBER >= 0x00908070L && !defined(OPENSSL_NO_TLSEXT)
+    if (sni_servername) {
+      if (!SSL_set_tlsext_host_name(ssl, const_cast<char *>(sni_servername))) {
+        DBUG_PRINT("error", ("SSL_set_tlsext_host_name failure"));
+        *ssl_errno_holder = ERR_get_error();
+        return 1;
+      }
+    }
+#endif /* OPENSSL_VERSION_NUMBER >= 0x00908070 && !def(OPENSSL_NO_TLSEXT) */
+
     DBUG_PRINT("info", ("ssl: %p timeout: %ld", ssl, timeout));
     SSL_SESSION_set_timeout(SSL_get_session(ssl), timeout);
     SSL_set_fd(ssl, sd);
@@ -792,21 +804,21 @@ int sslaccept(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
               unsigned long *ssl_errno_holder) {
   DBUG_TRACE;
   vio_set_blocking(vio, false);
-  int ret =
-      ssl_do(ptr, vio, timeout, nullptr, SSL_accept, ssl_errno_holder, nullptr);
+  int ret = ssl_do(ptr, vio, timeout, nullptr, SSL_accept, ssl_errno_holder,
+                   nullptr, nullptr);
   return ret;
 }
 
 int sslconnect(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
-               SSL_SESSION *session, unsigned long *ssl_errno_holder,
-               SSL **ssl) {
+               SSL_SESSION *session, unsigned long *ssl_errno_holder, SSL **ssl,
+               const char *sni_servername) {
   DBUG_TRACE;
   // Setting non blocking mode since openssl/boringssl does not support
   // timeout with blocking mode on handshake
   vio_set_blocking(vio, false);
 
-  int ret =
-      ssl_do(ptr, vio, timeout, session, SSL_connect, ssl_errno_holder, ssl);
+  int ret = ssl_do(ptr, vio, timeout, session, SSL_connect, ssl_errno_holder,
+                   ssl, sni_servername);
   return ret;
 }