hcq/oceanbase
hcq/oceanbase
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

[FEAT MERGE]SQL SSL support specify the minimum TLS version number

Browse Source
This commit is contained in:
496148326@qq.com 2023-08-25 03:40:26 +00:00 committed by ob-robot
parent 5eb8d4f090
commit 5cfc4e7073
15 changed files with 80 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
deps/easy/src/io/easy_connection.c vendored
View File

@ -2543,6 +2543,7 @@ static easy_connection_t *easy_connection_new()
c->write = easy_socket_write;
c->fd = -1;
c->armed_ack_timeout = -1;
c->tls_version_option = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
easy_list_init(&c->message_list);
easy_list_init(&c->server_session_list);

1
deps/easy/src/io/easy_io_struct.h vendored
View File

@ -417,6 +417,7 @@ struct easy_connection_t {
int64_t keepalive_enabled;
int64_t tx_keepalive_cnt;
int64_t rx_keepalive_cnt;
uint64_t tls_version_option;
ev_tstamp last_tx_tstamp;
ev_tstamp last_rx_tstamp;
uint8_t local_magic_ver;

6
deps/easy/src/io/easy_ssl.c vendored
View File

@ -233,7 +233,7 @@ int easy_ssl_connection_create(easy_ssl_ctx_t *ssl, easy_connection_t *c)
easy_error_log("SSL_set_ex_data() failed");
return EASY_ERROR;
}
SSL_set_options(sc->connection, c->tls_version_option);
sc->session_reuse = ssl->conf.session_reuse;
c->sc = sc;
@ -1614,9 +1614,7 @@ static int easy_ssl_ctx_create_for_mysql(easy_ssl_ctx_t *ssl, int is_babassl)
/* server side options */
SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
#endif
/* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);

7
deps/oblib/src/lib/ssl/ob_ssl_config.cpp vendored
View File

@ -399,9 +399,7 @@ static SSL_CTX* ob_ssl_create_ssl_ctx(const ObSSLConfig& ssl_config)
/* server side options */
SSL_CTX_set_options(ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
SSL_CTX_set_options(ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_3);
#endif
/* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
SSL_CTX_set_options(ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
@ -484,7 +482,7 @@ int ob_ssl_load_config(int ctx_id, const ObSSLConfig& ssl_config)
return ret;
}
int ob_fd_enable_ssl_for_server(int fd, int ctx_id)
int ob_fd_enable_ssl_for_server(int fd, int ctx_id, uint64_t tls_option)
{
int ret = OB_SUCCESS;
SSL_CTX *ctx = NULL;
@ -504,6 +502,7 @@ int ob_fd_enable_ssl_for_server(int fd, int ctx_id)
ret = OB_ERR_UNEXPECTED;
COMMON_LOG(WARN, "SSL_set_fd failed", K(ret), K(fd), K(ctx_id));
} else {
SSL_set_options(ssl, tls_option);
SSL_set_accept_state(ssl);
ATOMIC_STORE(&(gs_ssl_array[fd].ssl), ssl);
}

2
deps/oblib/src/lib/ssl/ob_ssl_config.h vendored
View File

@ -33,7 +33,7 @@ enum OB_SSL_ROLE {
};
int ob_ssl_load_config(int ctx_id, const ObSSLConfig& ssl_config);
int ob_fd_enable_ssl_for_server(int fd, int ctx_id);
int ob_fd_enable_ssl_for_server(int fd, int ctx_id, uint64_t tls_option);
int ob_fd_enable_ssl_for_client(int fd, int ctx_id);
void ob_fd_disable_ssl(int fd);
SSL* ob_fd_get_ssl_st(int fd);

13
deps/oblib/src/rpc/obmysql/ob_sql_nio.cpp vendored
View File

@ -344,7 +344,7 @@ public:
ObSqlSock(ObSqlNioImpl *nio, int fd): dlink_(), all_list_link_(), write_task_link_(), nio_impl_(nio),
fd_(fd), err_(0), read_buffer_(fd), need_epoll_trigger_write_(false), may_handling_(true),
handler_close_flag_(false), need_shutdown_(false), last_decode_time_(0), last_write_time_(0),
sql_session_info_(NULL) {
sql_session_info_(NULL), tls_verion_option_(SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3) {
memset(sess_, 0, sizeof(sess_));
}
~ObSqlSock() {}
@ -443,6 +443,7 @@ public:
void shutdown() { ::shutdown(fd_, SHUT_RD); }
int set_ssl_enabled();
SSL* get_ssl_st();
void set_tls_version_option(uint64_t tls_option) { tls_verion_option_ = tls_option; }
int write_handshake_packet(const char* buf, int64_t sz);
public:
ObDLink dlink_;
@ -463,6 +464,7 @@ private:
int64_t last_decode_time_;
int64_t last_write_time_;
void* sql_session_info_;
uint64_t tls_verion_option_;
private:
const rpc::TraceId* get_trace_id() const {
ObSqlSockSession* sess = (ObSqlSockSession *)sess_;
@ -476,6 +478,7 @@ private:
ObSqlSockSession* sess = (ObSqlSockSession *)sess_;
return sess->sql_session_id_;
}
public:
char sess_[3000] __attribute__((aligned(16)));
};
@ -488,7 +491,7 @@ static ObSqlSock *sess2sock(void *sess)
int ObSqlSock::set_ssl_enabled()
{
int ret = OB_SUCCESS;
if (OB_FAIL(ob_fd_enable_ssl_for_server(fd_, OB_SSL_CTX_ID_SQL_NIO))) {
if (OB_FAIL(ob_fd_enable_ssl_for_server(fd_, OB_SSL_CTX_ID_SQL_NIO, tls_verion_option_))) {
LOG_WARN("sqlnio enable ssl for server failed", K(ret), K(fd_));
}
return ret;
@ -1231,5 +1234,11 @@ int ObSqlNio::write_handshake_packet(void* sess, const char* buf, int64_t sz)
{
return sess2sock(sess)->write_handshake_packet(buf, sz);
}
void ObSqlNio::set_tls_version_option(void* sess, uint64_t tls_option)
{
sess2sock(sess)->set_tls_version_option(tls_option);
}
}; // end namespace obmysql
}; // end namespace oceanbase

1
deps/oblib/src/rpc/obmysql/ob_sql_nio.h vendored
View File

@ -59,6 +59,7 @@ public:
}
void update_tcp_keepalive_params(int keepalive_enabled, uint32_t tcp_keepidle, uint32_t tcp_keepintvl, uint32_t tcp_keepcnt);
int write_handshake_packet(void* sess, const char* buf, int64_t sz);
void set_tls_version_option(void* sess, uint64_t tls_option);
private:
void run(int64_t idx);
private:

5
deps/oblib/src/rpc/obmysql/ob_sql_sock_session.cpp vendored
View File

@ -178,5 +178,10 @@ int ObSqlSockSession::write_hanshake_packet(const char *buf, int64_t sz)
return nio_->write_handshake_packet((void *)this, buf, sz);
}
void ObSqlSockSession::set_tls_version_option(uint64_t tls_option)
{
nio_->set_tls_version_option((void *)this, tls_option);
}
}; // end namespace obmysql
}; // end namespace oceanbase

1
deps/oblib/src/rpc/obmysql/ob_sql_sock_session.h vendored
View File

@ -63,6 +63,7 @@ public:
SSL* get_ssl_st();
bool is_inited() const { return is_inited_; }
int write_hanshake_packet(const char *buf, int64_t sz);
void set_tls_version_option(uint64_t tls_option);
ObSqlNio* nio_;
ObISMConnectionCallback& sm_conn_cb_;
rpc::ObRequest sql_req_;

20
src/observer/mysql/obsm_conn_callback.cpp
View File

@ -11,6 +11,7 @@
*/
#define USING_LOG_PREFIX RPC_OBMYSQL
#include <openssl/ssl.h>
#include "observer/mysql/obsm_conn_callback.h"
#include "rpc/obmysql/ob_sql_sock_session.h"
#include "rpc/obmysql/obsm_struct.h"
@ -29,6 +30,22 @@ using namespace observer;
namespace obmysql
{
uint64_t ob_calculate_tls_version_option(const ObString &tls_min_version)
{
uint64_t tls_option = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
if (0 == tls_min_version.case_compare("NONE")) {
} else if (0 == tls_min_version.case_compare("TLSV1")) {
//no need to set because OPENSSL support all protocol by default
} else if (0 == tls_min_version.case_compare("TLSV1.1")) {
tls_option |= SSL_OP_NO_TLSv1;
} else if (0 == tls_min_version.case_compare("TLSV1.2")) {
tls_option |= (SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
} else if (0 == tls_min_version.case_compare("TLSV1.3")) {
tls_option |= (SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
}
return tls_option;
}
static int create_scramble_string(char *scramble_buf, const int64_t buf_len, common::ObMysqlRandom &thread_rand)
{
int ret = OB_SUCCESS;
@ -118,6 +135,9 @@ int ObSMConnectionCallback::init(ObSqlSockSession& sess, ObSMConnection& conn)
LOG_WARN("send handshake fail", K(ret), K(sess.client_addr_));
} else {
sess.sql_session_id_ = conn.sessid_;
uint64_t tls_version_option = ob_calculate_tls_version_option(
GCONF.sql_protocol_min_tls_version.str());
sess.set_tls_version_option(tls_version_option);
LOG_INFO("sm conn init succ", K(conn.sessid_), K(sess.client_addr_));
}

6
src/observer/mysql/obsm_handler.cpp
View File

@ -30,6 +30,9 @@ namespace oceanbase
using namespace rpc;
using namespace common;
using namespace name;
namespace obmysql {
extern uint64_t ob_calculate_tls_version_option(const ObString &tls_min_version);
}
namespace observer
{
bool enable_proto_dia()
@ -113,6 +116,9 @@ int ObSMHandler::on_connect(easy_connection_t *c)
eret = EASY_ERROR;
LOG_WARN_RET(tmp_ret, "send handshake packet failed", K(tmp_ret), K(eret));
} else {
uint64_t tls_version_option = obmysql::ob_calculate_tls_version_option(
GCONF.sql_protocol_min_tls_version.str());
c->tls_version_option = tls_version_option;
LOG_INFO("new mysql sessid created", K(easy_connection_str(c)), K(sessid), K(crt_id_ret));
}
}

11
src/share/config/ob_config_helper.cpp
View File

@ -857,5 +857,16 @@ bool ObConfigRuntimeFilterChecker::check(const ObConfigItem &t) const
int64_t rf_type = get_runtime_filter_type(t.str(), len);
return rf_type >= 0;
}
bool ObConfigSQLTlsVersionChecker::check(const ObConfigItem &t) const
{
const ObString tmp_str(t.str());
return 0 == tmp_str.case_compare("NONE") ||
0 == tmp_str.case_compare("TLSV1") ||
0 == tmp_str.case_compare("TLSV1.1") ||
0 == tmp_str.case_compare("TLSV1.2") ||
0 == tmp_str.case_compare("TLSV1.3");
}
} // end of namepace common
} // end of namespace oceanbase

10
src/share/config/ob_config_helper.h
View File

@ -614,6 +614,16 @@ private:
DISALLOW_COPY_AND_ASSIGN(ObRpcServerAuthMethodChecker);
};
class ObConfigSQLTlsVersionChecker
: public ObConfigChecker
{
public:
ObConfigSQLTlsVersionChecker() {}
virtual ~ObConfigSQLTlsVersionChecker() {}
bool check(const ObConfigItem &t) const;
private:
DISALLOW_COPY_AND_ASSIGN(ObConfigSQLTlsVersionChecker);
};
typedef __ObConfigContainer<ObConfigStringKey,
ObConfigItem, OB_MAX_CONFIG_NUMBER> ObConfigContainer;
} // namespace common

7
src/share/parameter/ob_parameter_seed.ipp
View File

@ -1575,4 +1575,9 @@ ERRSIM_DEF_STR_LIST(errsim_module_types, OB_TENANT_PARAMETER, "",
ERRSIM_DEF_DBL(errsim_module_error_percentage, OB_TENANT_PARAMETER, "0", "[0,100]",
"the percentage of the error happened to errsim module. "
"Range: [0, 100] in percentage",
ObParameterAttr(Section::TENANT, Source::DEFAULT, EditLevel::DYNAMIC_EFFECTIVE))
ObParameterAttr(Section::TENANT, Source::DEFAULT, EditLevel::DYNAMIC_EFFECTIVE));
DEF_STR_WITH_CHECKER(sql_protocol_min_tls_version, OB_CLUSTER_PARAMETER, "none",
common::ObConfigSQLTlsVersionChecker,
"SQL SSL control options, used to specify the minimum SSL/TLS version number. "
"values: none, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3",
ObParameterAttr(Section::OBSERVER, Source::DEFAULT, EditLevel::DYNAMIC_EFFECTIVE));

1
tools/deploy/mysql_test/test_suite/inner_table/r/mysql/all_virtual_sys_parameter_stat.result
View File

@ -196,6 +196,7 @@ server_cpu_quota_min
server_permanent_offline_time
sql_login_thread_count
sql_net_thread_count
sql_protocol_min_tls_version
sql_work_area
ssl_client_authentication
ssl_external_kms_info