WL#13075: Support TLS session reuse in the C API

RB#27093

Author: gkodinov

client/base/mysql_connection_options.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2014, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2014, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -214,6 +214,11 @@ MYSQL *Mysql_connection_options::create_connection() {
     return nullptr;
   }
 
+  if (this->m_ssl_options_provider.check_connection(connection)) {
+    mysql_close(connection);
+    return nullptr;
+  }
+
   /* Reset auto-commit to the default */
   if (mysql_autocommit(connection, true)) {
     this->db_error(connection, "while resetting auto-commit");

client/base/mysql_connection_options.h

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2014, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2014, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -63,6 +63,11 @@ class Mysql_connection_options : public Composite_options_provider,
      */
     bool apply_for_connection(MYSQL *connection);
 
+    /**
+      Checks the connection for SSL validity
+    */
+    bool check_connection(MYSQL *connection);
+
    private:
     std::optional<std::string> m_ssl_mode_string;
     std::optional<std::string> m_ssl_fips_mode_string;

client/base/ssl_options.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2014, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2014, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -69,6 +69,13 @@ void Mysql_connection_options::Ssl_options::create_options() {
       ->add_callback(new std::function<void(char *)>(std::bind(
           &Mysql_connection_options::Ssl_options::fips_mode_option_callback,
           this, _1)));
+  this->create_new_option(
+      &::opt_ssl_session_data, "ssl-session-data",
+      "Session data file to use to enable ssl session reuse");
+  this->create_new_option(&::opt_ssl_session_data_continue_on_failed_reuse,
+                          "ssl-session-data-continue-on-failed-reuse",
+                          "If set to ON, this option will allow connection to "
+                          "succeed even if session data cannot be reused.");
 }
 
 void Mysql_connection_options::Ssl_options::ca_option_callback(char *argument [
@@ -96,3 +103,9 @@ bool Mysql_connection_options::Ssl_options::apply_for_connection(
   }
   return false;
 }
+
+bool Mysql_connection_options::Ssl_options::check_connection(
+    MYSQL *connection) {
+  return ssl_client_check_post_connect_ssl_setup(
+      connection, [](const char *err) { std::cerr << err << std::endl; });
+}

���client/client_priv.h

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2001, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2001, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -180,6 +180,8 @@ enum options_client {
   OPT_DELETE_MASTER_LOGS_DEPRECATED,
   OPT_MYSQLDUMP_SLAVE_DATA_DEPRECATED,
   OPT_MYSQLDUMP_INCLUDE_MASTER_HOST_PORT_DEPRECATED,
+  OPT_SSL_SESSION_DATA,
+  OPT_SSL_SESSION_DATA_CONTINUE_ON_FAILED_REUSE,
   /* Add new option above this */
   OPT_MAX_CLIENT_OPTION
 };

client/migrate_keyring/options.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2021, Oracle and/or its affiliates.
+   Copyright (c) 2021, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -42,6 +42,9 @@
 #include "options.h"
 #include "utilities.h"
 
+/* TLS variables */
+#include "sslopt-vars.h"
+
 namespace options {
 
 /** MEM_ROOT for arguments */
@@ -66,6 +69,8 @@ enum migration_options {
   OPT_SSL_FIPS_MODE,
   OPT_TLS_CIPHERSUITES,
   OPT_SERVER_PUBLIC_KEY,
+  OPT_SSL_SESSION_DATA,
+  OPT_SSL_SESSION_DATA_CONTINUE_ON_FAILED_REUSE,
   /* Add new value above this */
   OPT_LAST
 };
@@ -85,8 +90,6 @@ char *Options::s_password = nullptr;
 char *Options::s_socket = nullptr;
 bool Options::s_tty_password = false;
 
-/* TLS variables */
-#include "sslopt-vars.h"
 /* Caching sha2 password variables */
 #include "caching_sha2_passwordopt-vars.h"
 
@@ -333,6 +336,10 @@ Mysql_connection::Mysql_connection(bool connect) : ok_(false), mysql(nullptr) {
               << mysql_error(mysql) << std::endl;
     return;
   }
+  if (ssl_client_check_post_connect_ssl_setup(
+          mysql, [](const char *err) { log_error << err << std::endl; }))
+    return;
+
   log_info << "Successfully connected to MySQL server" << std::endl;
 
   ok_ = true;

client/mysql.cc

@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+Copyright (c) 2000, 2022, Oracle and/or its affiliates.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License, version 2.0,
@@ -237,6 +237,7 @@ static char *opt_oci_config_file = nullptr;
 #include "sslopt-vars.h"
 
 const char *default_dbug_option = "d:t:o,/tmp/mysql.trace";
+static void *ssl_session_data = nullptr;
 
 /*
   completion_hash is an auxiliary feature for mysql client to complete
@@ -313,7 +314,8 @@ static int com_quit(String *str, char *), com_go(String *str, char *),
     com_prompt(String *str, char *), com_delimiter(String *str, char *),
     com_warnings(String *str, char *), com_nowarnings(String *str, char *),
     com_resetconnection(String *str, char *),
-    com_query_attributes(String *str, char *);
+    com_query_attributes(String *str, char *),
+    com_ssl_session_data_print(String *str, char *);
 static int com_shell(String *str, char *);
 
 #ifdef USE_POPEN
@@ -328,6 +330,7 @@ static const char *server_version_string(MYSQL *mysql);
 static int put_info(const char *str, INFO_TYPE info, uint error = 0,
                     const char *sql_state = nullptr);
 static int put_error(MYSQL *mysql);
+static void put_error_if_any(MYSQL *mysql);
 static void safe_put_field(const char *pos, ulong length);
 static void xmlencode_print(const char *src, uint length);
 static void init_pager();
@@ -409,6 +412,8 @@ static COMMANDS commands[] = {
     {"query_attributes", 0, com_query_attributes, true,
      "Sets string parameters (name1 value1 name2 value2 ...) for the next "
      "query to pick up."},
+    {"ssl_session_data_print", 0, com_ssl_session_data_print, true,
+     "Serializes the current SSL session data to stdout or file"},
     /* Get bash-like expansion for some commands */
     {"create table", 0, nullptr, false, ""},
     {"create database", 0, nullptr, false, ""},
@@ -1456,6 +1461,7 @@ void mysql_end(int sig) {
   signal(SIGHUP, SIG_IGN);
 #endif
 
+  if (ssl_session_data) mysql_free_ssl_session_data(&mysql, ssl_session_data);
   mysql_close(&mysql);
 #ifdef HAVE_READLINE
   if (!status.batch && !quick && histfile && histfile[0]) {
@@ -4410,6 +4416,43 @@ static int com_query_attributes(String *buffer [[maybe_unused]], char *line) {
   return 0;
 }
 
+static int com_ssl_session_data_print(String *buffer [[maybe_unused]],
+                                      char *line) {
+  char msgbuf[256];
+  char *param = get_arg(line, false);
+  const char *err_text = nullptr;
+  FILE *fo = nullptr;
+  void *data = nullptr;
+
+  if (param) {
+    if (nullptr == (fo = fopen(param, "w"))) {
+      err_text = "Failed to open the output file";
+      goto end;
+    }
+  } else
+    fo = stdout;
+
+  data = mysql_get_ssl_session_data(&mysql, 0, nullptr);
+  if (!data) {
+    err_text = nullptr;
+    put_error(&mysql);
+    goto end;
+  }
+  if (0 > fputs(reinterpret_cast<char *>(data), fo)) {
+    snprintf(msgbuf, sizeof(msgbuf), "Write of session data failed: %d (%s)",
+             errno, strerror(errno));
+    err_text = &msgbuf[0];
+    goto end;
+  }
+  if (fo == stdout) fputs("\n", fo);
+
+end:
+  if (data) mysql_free_ssl_session_data(&mysql, data);
+  if (fo && fo != stdout) fclose(fo);
+  if (err_text) return put_info(err_text, INFO_ERROR);
+  return 0;
+}
+
 /*
   Gets argument from a command on the command line. If get_next_arg is
   not defined, skips the command and returns the first argument. The
@@ -4488,7 +4531,7 @@ static int sql_real_connect(char *host, char *database, char *user, char *,
 
   mysql_init(&mysql);
   if (init_connection_options(&mysql)) {
-    (void)put_error(&mysql);
+    put_error_if_any(&mysql);
     (void)fflush(stdout);
     return ignore_errors ? -1 : 1;
   }
@@ -4573,6 +4616,18 @@ static int sql_real_connect(char *host, char *database, char *user, char *,
   }
 #endif
 
+  if (ssl_client_check_post_connect_ssl_setup(
+          &mysql, [](const char *err) { put_info(err, INFO_ERROR); }))
+    return 1;
+
+  void *new_ssl_session_data = mysql_get_ssl_session_data(&mysql, 0, nullptr);
+  if (new_ssl_session_data != nullptr) {
+    if (ssl_session_data != nullptr)
+      mysql_free_ssl_session_data(&mysql, ssl_session_data);
+    ssl_session_data = new_ssl_session_data;
+  } else {
+    DBUG_PRINT("error", ("unable to save SSL session"));
+  }
 #ifdef _WIN32
   /* Convert --execute buffer from UTF8MB4 to connection character set */
   if (!execute_buffer_conversion_done && status.line_buff &&
@@ -4642,6 +4697,10 @@ static bool init_connection_options(MYSQL *mysql) {
     tee_fprintf(stdout, "%s", SSL_SET_OPTIONS_ERROR);
     return true;
   }
+
+  if (ssl_session_data)
+    mysql_options(mysql, MYSQL_OPT_SSL_SESSION_DATA, ssl_session_data);
+
   if (opt_protocol)
     mysql_options(mysql, MYSQL_OPT_PROTOCOL, (char *)&opt_protocol);
 
@@ -4815,6 +4874,8 @@ static int com_status(String *buffer [[maybe_unused]],
     tee_fprintf(stdout, "UNIX socket:\t\t%s\n", mysql.unix_socket);
   if (mysql.net.compress) tee_fprintf(stdout, "Protocol:\t\tCompressed\n");
   if (opt_binhex) tee_fprintf(stdout, "Binary data as:\t\tHexadecimal\n");
+  if (mysql_get_ssl_session_reused(&mysql))
+    tee_fprintf(stdout, "SSL session reused:\ttrue\n");
 
   if ((status_str = mysql_stat(&mysql)) && !mysql_error(&mysql)[0]) {
     ulong sec;
@@ -4934,6 +4995,19 @@ static int put_error(MYSQL *con) {
                   mysql_sqlstate(con));
 }
 
+/**
+ Prints the SQL error, if any
+
+ Similar to @ref put_error, but prints the error only if there is any.
+
+ @param con the connection to check for errors
+*/
+static void put_error_if_any(MYSQL *con) {
+  const char *err = mysql_error(con);
+  if (err && *err)
+    put_info(err, INFO_ERROR, mysql_errno(con), mysql_sqlstate(con));
+}
+
 static void remove_cntrl(String *buffer) {
   const char *start = buffer->ptr();
   const char *end = start + buffer->length();

client/mysqladmin.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2000, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -582,6 +582,10 @@ static bool sql_connect(MYSQL *mysql, uint wait) {
   for (;;) {
     if (mysql_real_connect(mysql, host, user, nullptr, NullS, tcp_port,
                            unix_port, CLIENT_REMEMBER_OPTIONS)) {
+      if (ssl_client_check_post_connect_ssl_setup(
+              mysql, [](const char *err) { fprintf(stderr, "%s\n", err); }))
+        return true;
+
       mysql->reconnect = true;
       if (info) {
         fputs("\n", stderr);

client/mysqlbinlog.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2000, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -2364,6 +2364,10 @@ static Exit_status safe_connect() {
     error("Failed on connect: %s", mysql_error(mysql));
     return ERROR_STOP;
   }
+
+  if (ssl_client_check_post_connect_ssl_setup(
+          mysql, [](const char *err) { error("%s", err); }))
+    return ERROR_STOP;
   mysql->reconnect = true;
   return OK_CONTINUE;
 }

client/mysqldump.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2000, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -1601,6 +1601,10 @@ static int connect_to_db(char *host, char *user) {
     DB_error(&mysql_connection, "when trying to connect");
     return 1;
   }
+
+  if (ssl_client_check_post_connect_ssl_setup(
+          mysql, [](const char *err) { fprintf(stderr, "%s\n", err); }))
+    return 1;
   if (mysql_get_server_version(&mysql_connection) < 40100) {
     /* Don't dump SET NAMES with a pre-4.1 server (bug#7997).  */
     opt_set_charset = false;

client/mysqlimport.cc

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2000, 2021, Oracle and/or its affiliates.
+   Copyright (c) 2000, 2022, Oracle and/or its affiliates.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -472,6 +472,11 @@ static MYSQL *db_connect(char *host, char *database, char *user, char *) {
     if (mysql) mysql_close(mysql);
     return nullptr;
   }
+  if (ssl_client_check_post_connect_ssl_setup(
+          mysql, [](const char *err) { fprintf(stderr, "%s\n", err); })) {
+    if (mysql) mysql_close(mysql);
+    return nullptr;
+  }
   mysql->reconnect = false;
   if (verbose) fprintf(stdout, "Selecting database %s\n", database);
   if (mysql_select_db(mysql, database)) {