Add functions to retrieve and set SSL sessions for connections

Summary:
Port forward the ssl_session feature to 8.0.28. While similar
functionality via ssl_session_data is provided, it is more difficult to
integrate due to management of the ssl_session_data memory since
existing APIs call SESSION_SSL_free directly.

Most of the code has already been added by the ssl_session_data
codepath. This adds the API to fetch and set the ssl_session parameter.
During connection setup, ssl_session is used before ssl_session_data.

Reference patch: 2e261e6

Differential Revision: D57133792

fbshipit-source-id: d030b2e

Author: hermanlee

include/mysql.h

@@ -225,6 +225,7 @@ enum mysql_option {
   MYSQL_OPT_TLS_CERT_CALLBACK,
   MYSQL_OPT_TLS_CERT_CALLBACK_CONTEXT,
   MYSQL_OPT_TOS,
+  MYSQL_OPT_SSL_SESSION,
 };
 
 /**
@@ -482,6 +483,7 @@ bool STDCALL mysql_get_ssl_session_reused(MYSQL *mysql);
 void *STDCALL mysql_get_ssl_session_data(MYSQL *mysql, unsigned int n_ticket,
                                          unsigned int *out_len);
 bool STDCALL mysql_free_ssl_session_data(MYSQL *mysql, void *data);
+void *STDCALL mysql_get_ssl_session(MYSQL *mysql);
 /*
   Take ownership of the OpenSSL SSL_CTX instance associated with this
   connection.  In general, SSL_CTX objects should be re-used.  Either one can

include/mysql.h.pp

@@ -523,6 +523,7 @@
   MYSQL_OPT_TLS_CERT_CALLBACK,
   MYSQL_OPT_TLS_CERT_CALLBACK_CONTEXT,
   MYSQL_OPT_TOS,
+  MYSQL_OPT_SSL_SESSION,
 };
 struct st_mysql_options_extention;
 struct st_mysql_options {
@@ -683,6 +684,7 @@
 void * mysql_get_ssl_session_data(MYSQL *mysql, unsigned int n_ticket,
                                          unsigned int *out_len);
 bool mysql_free_ssl_session_data(MYSQL *mysql, void *data);
+void * mysql_get_ssl_session(MYSQL *mysql);
 void * mysql_take_ssl_context_ownership(MYSQL *mysql);
 bool mysql_change_user(MYSQL *mysql, const char *user,
                                const char *passwd, const char *db);

include/sql_common.h

@@ -221,6 +221,7 @@ struct st_mysql_options_extention {
   const void *server_cert_validator_context;
 #endif
   unsigned int tos;
+  void *ssl_session;
 };
 
 struct MYSQL_METHODS {

libmysql/CMakeLists.txt

@@ -158,6 +158,7 @@ SET(CLIENT_API_FUNCTIONS
   net_clear
   my_net_write
   mysql_get_ssl_version
+  mysql_get_ssl_session
 
   CACHE INTERNAL "Functions exported by client API"
 )

sql-common/client.cc

@@ -3620,6 +3620,10 @@ static void mysql_ssl_free(MYSQL *mysql) {
     mysql->options.extension->tls_ciphersuites = nullptr;
     mysql->options.extension->load_data_dir = nullptr;
     mysql->options.extension->tls_sni_servername = nullptr;
+    if (mysql->options.extension->ssl_session) {
+      SSL_SESSION_free((SSL_SESSION *)mysql->options.extension->ssl_session);
+      mysql->options.extension->ssl_session = nullptr;
+    }
   }
   mysql->connector_fd = nullptr;
 }
@@ -3770,6 +3774,21 @@ bool STDCALL mysql_free_ssl_session_data(MYSQL *mysql, void *data) {
     return true;
 }
 
+/**
+  Returns the current ssl_session and increment its reference count.
+  The caller is responsible for freeing it.
+
+  @param mysql pointer to the mysql connection
+  @retval pointer to the SSL_SESSION
+*/
+void *STDCALL mysql_get_ssl_session(MYSQL *mysql) {
+  DBUG_TRACE;
+  if (mysql->net.vio && mysql->net.vio->ssl_arg) {
+    return SSL_get1_session((SSL *)mysql->net.vio->ssl_arg);
+  }
+  return nullptr;
+}
+
 /**
   Check if the current ssl session is reused
 
@@ -4853,7 +4872,17 @@ static int cli_establish_ssl(MYSQL *mysql) {
     } else {
       ssl_fd = (struct st_VioSSLFd *)mysql->connector_fd;
     }
-    SSL_SESSION *ssl_session = ssl_session_deserialize_from_data(mysql);
+
+    /* Prioritize ssl_session over ssl_session_data if both are set */
+    bool is_ssl_session_data;
+    SSL_SESSION *ssl_session;
+    if (options->extension && options->extension->ssl_session != nullptr) {
+      ssl_session = (SSL_SESSION *)options->extension->ssl_session;
+      is_ssl_session_data = false;
+    } else {
+      ssl_session = ssl_session_deserialize_from_data(mysql);
+      is_ssl_session_data = true;
+    }
 
     /* Connect to the server */
     DBUG_PRINT("info", ("IO layer change in progress..."));
@@ -4867,7 +4896,9 @@ static int cli_establish_ssl(MYSQL *mysql) {
         const_cast<void *>(static_cast<const void *>(mysql)),
         options->extension->server_cert_validator ? ssl_get_ex_data_index()
                                                   : -1);
-    if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
+    if (is_ssl_session_data && ssl_session != nullptr) {
+      SSL_SESSION_free(ssl_session);
+    }
     if (ret) {
       switch (ret) {
         case VIO_SOCKET_READ_TIMEOUT:
@@ -4897,6 +4928,11 @@ static int cli_establish_ssl(MYSQL *mysql) {
       }
       goto error;
     }
+    /* Free the SSL session early */
+    if (!is_ssl_session_data && options->extension->ssl_session != nullptr) {
+      SSL_SESSION_free((SSL_SESSION *)options->extension->ssl_session);
+      options->extension->ssl_session = nullptr;
+    }
     DBUG_PRINT("info", ("IO layer change done!"));
 
     /* Verify server cert */
@@ -5053,7 +5089,16 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
     } else {
       ssl_fd = (struct st_VioSSLFd *)mysql->connector_fd;
     }
-    SSL_SESSION *ssl_session = ssl_session_deserialize_from_data(mysql);
+    /* Prioritize ssl_session over ssl_session_data if both are set */
+    bool is_ssl_session_data;
+    SSL_SESSION *ssl_session;
+    if (options->extension && options->extension->ssl_session != nullptr) {
+      ssl_session = (SSL_SESSION *)options->extension->ssl_session;
+      is_ssl_session_data = false;
+    } else {
+      ssl_session = ssl_session_deserialize_from_data(mysql);
+      is_ssl_session_data = true;
+    }
 
     /* Connect to the server */
     DBUG_PRINT("info", ("IO layer change in progress..."));
@@ -5069,7 +5114,9 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
              const_cast<void *>(static_cast<const void *>(mysql)),
              options->extension->server_cert_validator ? ssl_get_ex_data_index()
                                                        : -1))) {
-      if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
+      if (is_ssl_session_data && ssl_session != nullptr) {
+        SSL_SESSION_free(ssl_session);
+      }
       switch (ret) {
         case VIO_SOCKET_WANT_READ:
           net_async->async_blocking_state = NET_NONBLOCKING_READ;
@@ -5107,6 +5154,8 @@ static net_async_status cli_establish_ssl_nonblocking(MYSQL *mysql, int *res) {
       goto error;
     }
     if (ssl_session != nullptr) SSL_SESSION_free(ssl_session);
+    /* Free the SSL session early */
+    if (!is_ssl_session_data) options->extension->ssl_session = nullptr;
     DBUG_PRINT("info", ("IO layer change done!"));
 
     /* sslconnect creates a new vio, so update it. */
@@ -9968,6 +10017,32 @@ int STDCALL mysql_options4(MYSQL *mysql, enum mysql_option option,
       }
       break;
     }
+    case MYSQL_OPT_SSL_SESSION: {
+      /*
+        Set the SSL session to be used during sslconnect. The client will hold
+        a reference to the session until the connection is closed.
+
+        @param take_ownership if true, the client will assume the caller's
+        reference count to session.
+      */
+      ENSURE_EXTENSIONS_PRESENT(&mysql->options);
+      SSL_SESSION *ssl_session = (SSL_SESSION *)const_cast<void *>(arg1);
+      bool take_ownership = (bool)arg2;
+
+      /* Increment the reference count */
+      if (!take_ownership && ssl_session != nullptr)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+        SSL_SESSION_up_ref(ssl_session);
+#else
+        CRYPTO_add(&ssl_session->references, 1, CRYPTO_LOCK_SSL_SESSION);
+#endif
+
+      if (mysql->options.extension->ssl_session)
+        SSL_SESSION_free((SSL_SESSION *)mysql->options.extension->ssl_session);
+
+      mysql->options.extension->ssl_session = (void *)ssl_session;
+      break;
+    }
     default:
       return 1;
   }