Add facility to re-use SSL_CTX across connections

Summary:
Every connection, MySQL recreates the SSL_CTX object.  This is
bad and unnecessary.  This diff adds the ability to re-use an SSL
context object between connections.  This is roughly a 50% increase in
throughput making SSL connections.  In combination with re-using SSL
sessions, the net speedup is roughly 7-8x.

This facility can be used in one of two ways; one is to "take ownership"
of the SSL_CTX in an existing MySQL connection (simple) or to create a
context by hand, therefore bypassing many of the MySQL "options" fields
relating to verification, certs, etc.  This is not ideal but avoids a
larger refactoring and public API change to support some kind of
"initialize an OpenSSL context with these options" which would be
complicated and potentially difficult to reconcile with yassl.

Reference patch:
4c288ca

Differential Revision: D6536123

Author: lth

CMakeLists.txt

@@ -1623,6 +1623,7 @@ INCLUDE(configure.cmake)
 
 # Common defines and includes
 ADD_DEFINITIONS(-DHAVE_CONFIG_H)
+ADD_DEFINITIONS(-DHAVE_OPENSSL)            # Removed by Oracle in 8.0.20
 ADD_DEFINITIONS(-D__STDC_LIMIT_MACROS)     # Enable C99 limit macros
 ADD_DEFINITIONS(-D__STDC_FORMAT_MACROS)    # Enable C99 printf format macros
 ADD_DEFINITIONS(-D_USE_MATH_DEFINES)       # Get access to M_PI, M_E, etc. in math.h

client/mysql.cc

@@ -239,6 +239,9 @@ static char *opt_oci_config_file = nullptr;
 #include "multi_factor_passwordopt-vars.h"
 #include "sslopt-vars.h"
 
+/* The SSL context that will be reused across invocations. */
+static void *ssl_context = nullptr;
+
 const char *default_dbug_option = "d:t:o,/tmp/mysql.trace";
 static void *ssl_session_data = nullptr;
 
@@ -1511,6 +1514,9 @@ void mysql_end(int sig) {
     delete global_attrs;
     global_attrs = nullptr;
   }
+#if defined(HAVE_OPENSSL)
+  SSL_CTX_free((SSL_CTX *)ssl_context);
+#endif
   exit(status.exit_status);
 }
 
@@ -4635,6 +4641,8 @@ static int sql_real_connect(char *host, char *database, char *user, char *,
   } else {
     DBUG_PRINT("error", ("unable to save SSL session"));
   }
+  ssl_context = mysql_take_ssl_context_ownership(&mysql);
+
 #ifdef _WIN32
   /* Convert --execute buffer from UTF8MB4 to connection character set */
   if (!execute_buffer_conversion_done && status.line_buff &&
@@ -4707,6 +4715,10 @@ static bool init_connection_options(MYSQL *mysql) {
   if (ssl_session_data)
     mysql_options(mysql, MYSQL_OPT_SSL_SESSION_DATA, ssl_session_data);
 
+  if (ssl_context) {
+    mysql_options(mysql, MYSQL_OPT_SSL_CONTEXT, ssl_context);
+  }
+
   if (opt_protocol)
     mysql_options(mysql, MYSQL_OPT_PROTOCOL, (char *)&opt_protocol);
 

include/mysql.h

@@ -212,7 +212,8 @@ enum mysql_option {
   MYSQL_OPT_ZSTD_COMPRESSION_LEVEL,
   MYSQL_OPT_LOAD_DATA_LOCAL_DIR,
   MYSQL_OPT_USER_PASSWORD,
-  MYSQL_OPT_SSL_SESSION_DATA
+  MYSQL_OPT_SSL_SESSION_DATA,
+  MYSQL_OPT_SSL_CONTEXT,
 };
 
 /**
@@ -465,6 +466,17 @@ bool STDCALL mysql_get_ssl_session_reused(MYSQL *mysql);
 void *STDCALL mysql_get_ssl_session_data(MYSQL *mysql, unsigned int n_ticket,
                                          unsigned int *out_len);
 bool STDCALL mysql_free_ssl_session_data(MYSQL *mysql, void *data);
+/*
+  Take ownership of the OpenSSL SSL_CTX instance associated with this
+  connection.  In general, SSL_CTX objects should be re-used.  Either one can
+  be taken from an existing connection or created by hand (in which case the
+  mysql SSL options such as MYSQL_OPT_SSL_KEY are ignored since they
+  influence the SSL_CTX object).
+
+  The caller is responsible for freeing this via SSL_CTX_free.  Note that this
+  is a void* strictly to avoid including SSL headers in this file.
+*/
+void *STDCALL mysql_take_ssl_context_ownership(MYSQL *mysql);
 bool STDCALL mysql_change_user(MYSQL *mysql, const char *user,
                                const char *passwd, const char *db);
 MYSQL *STDCALL mysql_real_connect(MYSQL *mysql, const char *host,

include/mysql.h.pp

@@ -460,7 +460,8 @@
   MYSQL_OPT_ZSTD_COMPRESSION_LEVEL,
   MYSQL_OPT_LOAD_DATA_LOCAL_DIR,
   MYSQL_OPT_USER_PASSWORD,
-  MYSQL_OPT_SSL_SESSION_DATA
+  MYSQL_OPT_SSL_SESSION_DATA,
+  MYSQL_OPT_SSL_CONTEXT,
 };
 struct st_mysql_options_extention;
 struct st_mysql_options {
@@ -618,6 +619,7 @@
 void * mysql_get_ssl_session_data(MYSQL *mysql, unsigned int n_ticket,
                                          unsigned int *out_len);
 bool mysql_free_ssl_session_data(MYSQL *mysql, void *data);
+void * mysql_take_ssl_context_ownership(MYSQL *mysql);
 bool mysql_change_user(MYSQL *mysql, const char *user,
                                const char *passwd, const char *db);
 MYSQL * mysql_real_connect(MYSQL *mysql, const char *host,

include/sql_common.h

@@ -187,6 +187,7 @@ struct st_mysql_options_extention {
   char *load_data_dir;
   struct client_authentication_info client_auth_info[MAX_AUTHENTICATION_FACTOR];
   void *ssl_session_data; /** the session serialization to use */
+  void *ssl_context;
 };
 
 struct MYSQL_METHODS {

include/violite.h

@@ -253,13 +253,24 @@ const char *sslGetErrString(enum enum_ssl_init_error err);
 
 struct st_VioSSLFd {
   SSL_CTX *ssl_context;
+  /*
+    "owned" indicates whether SSL_CTX_free should be called on this instance
+    or not. If mysql_take_ssl_context_ownership is called, the context
+    becomes owned by the application and not by the MySQL client library (ie,
+    owned becomes false).  Likewise, if a context is supplied by
+    mysql_options(..., MYSQL_OPT_SSL_CONTEXT, ...) then it is also not owned
+    by the client library.
+  */
+  bool owned;
 };
 
 int sslaccept(struct st_VioSSLFd *, MYSQL_VIO, long timeout,
               unsigned long *errptr);
 int sslconnect(struct st_VioSSLFd *, MYSQL_VIO, long timeout,
                SSL_SESSION *session, unsigned long *errptr, SSL **ssl);
 
+struct st_VioSSLFd *new_VioSSLConnectorFdFromContext(
+    SSL_CTX *context, enum enum_ssl_init_error *error);
 struct st_VioSSLFd *new_VioSSLConnectorFd(
     const char *key_file, const char *cert_file, const char *ca_file,
     const char *ca_path, const char *cipher, const char *ciphersuites,
@@ -273,7 +284,7 @@ struct st_VioSSLFd *new_VioSSLAcceptorFd(
     const char *ca_path, const char *cipher, const char *ciphersuites,
     enum enum_ssl_init_error *error, const char *crl_file, const char *crl_path,
     const long ssl_ctx_flags);
-void free_vio_ssl_acceptor_fd(struct st_VioSSLFd *fd);
+void free_vio_ssl_fd(struct st_VioSSLFd *fd);
 
 void vio_ssl_end();
 

libmysql/CMakeLists.txt

@@ -145,6 +145,8 @@ SET(CLIENT_API_FUNCTIONS
   mysql_get_ssl_session_reused
   mysql_get_ssl_session_data
   mysql_free_ssl_session_data
+  mysql_take_ssl_context_ownership
+
   CACHE INTERNAL "Functions exported by client API"
 )
 

plugin/x/client/xconnection_impl.cc

@@ -830,7 +830,7 @@ void Connection_impl::close() {
   }
 
   if (m_vioSslFd) {
-    free_vio_ssl_acceptor_fd(m_vioSslFd);
+    free_vio_ssl_fd(m_vioSslFd);
     m_vioSslFd = nullptr;
   }
 }

plugin/x/src/ssl_context.cc

@@ -87,7 +87,7 @@ bool Ssl_context::setup(const Config &config) {
 }
 
 Ssl_context::~Ssl_context() {
-  if (m_ssl_acceptor) free_vio_ssl_acceptor_fd(m_ssl_acceptor);
+  if (m_ssl_acceptor) free_vio_ssl_fd(m_ssl_acceptor);
 }
 
 /** Start a TLS session in the connection.
@@ -107,7 +107,7 @@ bool Ssl_context::activate_tls(iface::Vio *conn,
 
 void Ssl_context::reset() {
   if (!m_config || !m_ssl_acceptor) return;
-  free_vio_ssl_acceptor_fd(m_ssl_acceptor);
+  free_vio_ssl_fd(m_ssl_acceptor);
   setup(*m_config);
 }
 

sql-common/client.cc

@@ -3462,6 +3462,7 @@ static void mysql_ssl_free(MYSQL *mysql) {
         mysql->options.extension->client_auth_info[idx].password = nullptr;
       }
     }
+    mysql->options.extension->ssl_context = nullptr;
   }
   mysql->options.ssl_key = nullptr;
   mysql->options.ssl_cert = nullptr;
@@ -3628,6 +3629,19 @@ bool STDCALL mysql_get_ssl_session_reused(MYSQL *mysql) {
   return false;
 }
 
+void *STDCALL
+mysql_take_ssl_context_ownership(MYSQL *mysql MY_ATTRIBUTE((unused))) {
+  DBUG_ENTER("mysql_take_ssl_context_ownership");
+#if defined(HAVE_OPENSSL)
+  if (mysql->connector_fd) {
+    struct st_VioSSLFd *ssl_fd = (struct st_VioSSLFd *)mysql->connector_fd;
+    ssl_fd->owned = false;
+    DBUG_RETURN(ssl_fd->ssl_context);
+  }
+#endif
+  DBUG_RETURN(nullptr);
+}
+
 /*
   Check the server's (subject) Common Name against the
   hostname we connected to
@@ -4461,22 +4475,34 @@ static int cli_establish_ssl(MYSQL *mysql) {
     MYSQL_TRACE_STAGE(mysql, SSL_NEGOTIATION);
 
     /* Create the VioSSLConnectorFd - init SSL and load certs */
-    if (!(ssl_fd = new_VioSSLConnectorFd(
-              options->ssl_key, options->ssl_cert, options->ssl_ca,
-              options->ssl_capath, options->ssl_cipher,
-              options->extension ? options->extension->tls_ciphersuites
-                                 : nullptr,
-              &ssl_init_error,
-              options->extension ? options->extension->ssl_crl : nullptr,
-              options->extension ? options->extension->ssl_crlpath : nullptr,
-              options->extension ? options->extension->ssl_ctx_flags : 0,
-              verify_identity ? mysql->host : nullptr))) {
-      set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR, unknown_sqlstate,
-                               ER_CLIENT(CR_SSL_CONNECTION_ERROR),
-                               sslGetErrString(ssl_init_error));
-      goto error;
+    if (!mysql->connector_fd) {
+      /* Create the VioSSLConnectorFd - init SSL and load certs */
+      if (options->extension && options->extension->ssl_context) {
+        ssl_fd = new_VioSSLConnectorFdFromContext(
+            (SSL_CTX *)options->extension->ssl_context, &ssl_init_error);
+      } else {
+        if (!(ssl_fd = new_VioSSLConnectorFd(
+                  options->ssl_key, options->ssl_cert, options->ssl_ca,
+                  options->ssl_capath, options->ssl_cipher,
+                  options->extension ? options->extension->tls_ciphersuites
+                                     : nullptr,
+                  &ssl_init_error,
+                  options->extension ? options->extension->ssl_crl : nullptr,
+                  options->extension ? options->extension->ssl_crlpath
+                                     : nullptr,
+                  options->extension ? options->extension->ssl_ctx_flags : 0,
+                  verify_identity ? mysql->host : nullptr))) {
+          set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
+                                   unknown_sqlstate,
+                                   ER_CLIENT(CR_SSL_CONNECTION_ERROR),
+                                   sslGetErrString(ssl_init_error));
+          goto error;
+        }
+      }
+      mysql->connector_fd = (unsigned char *)ssl_fd;
+    } else {
+      ssl_fd = (struct st_VioSSLFd *)mysql->connector_fd;
     }
-    mysql->connector_fd = (unsigned char *)ssl_fd;
     SSL_SESSION *ssl_session = ssl_session_deserialize_from_data(mysql);
 
     /* Connect to the server */
@@ -4624,20 +4650,26 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
       long flags = options->extension ? options->extension->ssl_ctx_flags : 0;
 
       /* Create the VioSSLConnectorFd - init SSL and load certs */
-      if (!(ssl_fd = new_VioSSLConnectorFd(
-                options->ssl_key, options->ssl_cert, options->ssl_ca,
-                options->ssl_capath, options->ssl_cipher,
-                options->extension ? options->extension->tls_ciphersuites
-                                   : nullptr,
-                &ssl_init_error,
-                options->extension ? options->extension->ssl_crl : nullptr,
-                options->extension ? options->extension->ssl_crlpath : nullptr,
-                flags, verify_identity ? mysql->host : nullptr))) {
-        set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
-                                 unknown_sqlstate,
-                                 ER_CLIENT(CR_SSL_CONNECTION_ERROR),
-                                 sslGetErrString(ssl_init_error));
-        goto error;
+      if (options->extension && options->extension->ssl_context) {
+        ssl_fd = new_VioSSLConnectorFdFromContext(
+            (SSL_CTX *)options->extension->ssl_context, &ssl_init_error);
+      } else {
+        if (!(ssl_fd = new_VioSSLConnectorFd(
+                  options->ssl_key, options->ssl_cert, options->ssl_ca,
+                  options->ssl_capath, options->ssl_cipher,
+                  options->extension ? options->extension->tls_ciphersuites
+                                     : nullptr,
+                  &ssl_init_error,
+                  options->extension ? options->extension->ssl_crl : nullptr,
+                  options->extension ? options->extension->ssl_crlpath
+                                     : nullptr,
+                  flags, verify_identity ? mysql->host : nullptr))) {
+          set_mysql_extended_error(mysql, CR_SSL_CONNECTION_ERROR,
+                                   unknown_sqlstate,
+                                   ER_CLIENT(CR_SSL_CONNECTION_ERROR),
+                                   sslGetErrString(ssl_init_error));
+          goto error;
+        }
       }
       mysql->connector_fd = (unsigned char *)ssl_fd;
     } else {
@@ -7461,8 +7493,7 @@ void mysql_close_free(MYSQL *mysql) {
   my_free(mysql->field_alloc);
 
   if (mysql->connector_fd)
-    free_vio_ssl_acceptor_fd(
-        reinterpret_cast<st_VioSSLFd *>(mysql->connector_fd));
+    free_vio_ssl_fd(reinterpret_cast<st_VioSSLFd *>(mysql->connector_fd));
   mysql->connector_fd = nullptr;
 
   mysql->field_alloc = nullptr;
@@ -8727,6 +8758,11 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
       EXTENSION_SET_STRING(&mysql->options, ssl_session_data,
                            static_cast<const char *>(arg));
       break;
+    case MYSQL_OPT_SSL_CONTEXT:
+      ENSURE_EXTENSIONS_PRESENT(&mysql->options);
+      mysql->options.extension->ssl_context = const_cast<void *>(arg);
+      break;
+
     default:
       return 1;
   }