PBS-31 Implement support for SSL/TLS for the listener - #161
Open
kamil-holubicki wants to merge 3 commits into
Open
PBS-31 Implement support for SSL/TLS for the listener#161kamil-holubicki wants to merge 3 commits into
kamil-holubicki wants to merge 3 commits into
Conversation
https://perconadev.atlassian.net/browse/PBS-32 Implement AuthSwitchRequest handling when the client replies with an authentication plugin that differs from the server account plugin. The server now sends the switch request, reads the client auth switch response, updates the connection context, and continues normal authentication. Format the auth switch plugin data through a helper so caching_sha2_password keeps the historical trailing NULL filler expected by MySQL clients, while leaving future plugins free to define their own payload shape.
https://perconadev.atlassian.net/browse/PBS-33 Added: Encapsulate caching_sha2_password in caching_sha2_password_authenticator (scramble verify, AuthSwitch data, 0x03/0x04, PEM, RSA decrypt, cleartext stub for future TLS). Auth loop in network_service stays auth-method agnostic: optional AuthSwitch on plugin mismatch, then begin_authentication / outbound frames / client frames until done. Fast auth when the handshake scramble matches the configured password; otherwise full auth (0x04) with RSA on plain TCP (0x02 + PEM or ciphertext via --server-public-key-path). Wire AuthMoreData (0x01 || plugin data) for 0x03, 0x04, and PEM, matching Percona Server/MySql mpvio wrapping. Thread server_rsa_public/private_key_path from minimysql_app through network_service -> connection_context -> authenticator (empty = embedded defaults; one-sided config fails hard). Random 20-byte greeting salt; unit tests for fast path, RSA path, and key path validation. How this differs from Percona Server/MySql: No SHA2 digest cache: every successful scramble is treated as a cache hit, including the first connection. PS does full auth (RSA on plain TCP / cleartext on SSL) on cache miss, then caches for later fast auth. No TLS yet: connection_is_secure() is always false; cleartext-after-0x04 is stubbed only. PS accepts cleartext password over SSL/socket after 0x04. Single configured user/password and optional key paths (or embedded MTR keys), not ACL / auto-generated server RSA keys from config.
https://perconadev.atlassian.net/browse/PBS-31 Problem: minimysql_server accepted only plaintext client connections. It did not advertise CLIENT_SSL, so mysql clients running with --ssl-mode=REQUIRED could not connect and every authentication ran in the clear. The "cleartext password after 0x04 is safe only on a secure transport" invariant of caching_sha2_password kept the fast path disabled unconditionally, diverging from Percona Server behaviour. Solution: Add optional per-listener TLS to minimysql_server, matching a TLS-configured Percona Server node with require_secure_transport=OFF. The listener is TLS-enabled when both --ssl-cert and --ssl-key are supplied. TLS configuration is captured in a shared acceptor context owned by the network layer; it advertises CLIENT_SSL in the greeting only when configured. TLSv1.2 and TLSv1.3 are the accepted protocol versions; older SSL/TLS versions are explicitly disabled. Client-certificate verification is disabled (server-cert only), matching the mysql CLI default. Per session, the transport starts on the raw TCP socket, and the first client greeting drives the branch. A Protocol::SSLRequest against a TLS-configured listener triggers a TLS handshake and switches all subsequent I/O to the encrypted stream; the same intent against a plaintext-only listener drops the connection with a diagnostic and no error frame, matching Percona Server's "if (!context.have_ssl()) return packet_error;" in sql/auth/sql_authentication.cc. Once TLS is established the connection is treated as secure, which unlocks the caching_sha2_password cleartext-after-0x04 fast path for TLS clients as in Percona Server. The MySQL frame I/O helpers and the post-greeting session are generic over the socket type so plaintext and TLS-upgraded sessions share one authentication and command-loop implementation. Build wiring adds explicit OpenSSL and links OpenSSL::SSL; Boost's asio ssl headers are already available. New unit tests cover the connection_context predicates and the TLS acceptor construction; handshake success over TLSv1.2 and TLSv1.3, and the Percona-style rejection of SSL-requesting clients against a plaintext listener, were verified end-to-end.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.