Skip to content

Commit 0b33f3e

Browse files
silvakidsilvakid
committed
WL14846: Align TLS option checking across connectors
1 parent 33f2a72 commit 0b33f3e

File tree

4 files changed

+142
-35
lines changed

4 files changed

+142
-35
lines changed

‎cppconn/connection.h

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -68,16 +68,16 @@
6868
/*
6969
SSL related
7070
*/
71-
#define OPT_SSL_MODE "OPT_SSL_MODE"
72-
#define OPT_SSL_KEY "sslKey"
73-
#define OPT_SSL_CERT "sslCert"
74-
#define OPT_SSL_CA "sslCA"
75-
#define OPT_SSL_CAPATH "sslCAPath"
76-
#define OPT_SSL_CIPHER "sslCipher"
77-
#define OPT_SSL_CRL "sslCRL"
78-
#define OPT_SSL_CRLPATH "sslCRLPath"
71+
#define OPT_SSL_MODE "ssl-mode"
72+
#define OPT_SSL_KEY "ssl-key"
73+
#define OPT_SSL_CERT "ssl-cert"
74+
#define OPT_SSL_CA "ssl-ca"
75+
#define OPT_SSL_CAPATH "ssl-capath"
76+
#define OPT_SSL_CIPHER "ssl-cipher"
77+
#define OPT_SSL_CRL "ssl-crl"
78+
#define OPT_SSL_CRLPATH "ssl-crlpath"
7979
#define OPT_SERVER_PUBLIC_KEY "rsaKey"
80-
#define OPT_TLS_VERSION "OPT_TLS_VERSION"
80+
#define OPT_TLS_VERSION "tls-version"
8181

8282
/*
8383
Connection related

‎driver/mysql_connection.cpp

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ static const String2IntMap intOptions[]=
277277
{OPT_NET_BUFFER_LENGTH, MYSQL_OPT_NET_BUFFER_LENGTH, false},
278278
#endif
279279
{OPT_SSL_MODE, MYSQL_OPT_SSL_MODE , false},
280+
{"OPT_SSL_MODE", MYSQL_OPT_SSL_MODE , false},
280281
#if MYCPPCONN_STATIC_MYSQL_VERSION_ID >= 80000
281282
{OPT_RETRY_COUNT, MYSQL_OPT_RETRY_COUNT, false},
282283
#endif
@@ -291,7 +292,9 @@ static const String2IntMap stringOptions[]=
291292
{OPT_SSL_CAPATH, MYSQL_OPT_SSL_CAPATH, true},
292293
{OPT_SSL_CIPHER, MYSQL_OPT_SSL_CIPHER, true},
293294
{OPT_SSL_CRL, MYSQL_OPT_SSL_CRL, false},
295+
{"sslCRL", MYSQL_OPT_SSL_CRL, false},
294296
{OPT_SSL_CRLPATH, MYSQL_OPT_SSL_CRLPATH, false},
297+
{"sslCRLPath", MYSQL_OPT_SSL_CRLPATH, false},
295298
{OPT_SERVER_PUBLIC_KEY, MYSQL_SERVER_PUBLIC_KEY, false},
296299
{OPT_SET_CHARSET_DIR, MYSQL_SET_CHARSET_DIR, false},
297300
{OPT_PLUGIN_DIR, MYSQL_PLUGIN_DIR, false},
@@ -302,6 +305,7 @@ static const String2IntMap stringOptions[]=
302305
{OPT_CHARSET_NAME, MYSQL_SET_CHARSET_NAME, true},
303306
#if MYCPPCONN_STATIC_MYSQL_VERSION_ID >= 50700
304307
{OPT_TLS_VERSION, MYSQL_OPT_TLS_VERSION, true},
308+
{"OPT_TLS_VERSION", MYSQL_OPT_TLS_VERSION, true},
305309
#endif
306310
{OPT_LOAD_DATA_LOCAL_DIR, MYSQL_OPT_LOAD_DATA_LOCAL_DIR, false}
307311
};
@@ -695,67 +699,67 @@ void MySQL_Connection::init(ConnectOptionsMap & properties)
695699
} else {
696700
throw sql::InvalidArgumentException("No string value passed for characterSetResults");
697701
}
698-
} else if (!it->first.compare(OPT_SSL_KEY)) {
702+
} else if (!it->first.compare(OPT_SSL_KEY) || !it->first.compare("sslKey")) {
699703
try {
700704
p_s = (it->second).get< sql::SQLString >();
701705
} catch (sql::InvalidArgumentException&) {
702-
throw sql::InvalidArgumentException("Wrong type passed for sslKey expected sql::SQLString");
706+
throw sql::InvalidArgumentException("Wrong type passed for ssl-key expected sql::SQLString");
703707
}
704708
if (p_s) {
705709
sslKey = *p_s;
706710
} else {
707-
throw sql::InvalidArgumentException("No string value passed for sslKey");
711+
throw sql::InvalidArgumentException("No string value passed for ssl-key");
708712
}
709713
ssl_used = true;
710-
} else if (!it->first.compare(OPT_SSL_CERT)) {
714+
} else if (!it->first.compare(OPT_SSL_CERT) || !it->first.compare("sslCert")) {
711715
try {
712716
p_s = (it->second).get< sql::SQLString >();
713717
} catch (sql::InvalidArgumentException&) {
714-
throw sql::InvalidArgumentException("Wrong type passed for sslCert expected sql::SQLString");
718+
throw sql::InvalidArgumentException("Wrong type passed for ssl-cert expected sql::SQLString");
715719
}
716720
if (p_s) {
717721
sslCert = *p_s;
718722
} else {
719-
throw sql::InvalidArgumentException("No string value passed for sslCert");
723+
throw sql::InvalidArgumentException("No string value passed for ssl-cert");
720724
}
721725
ssl_used = true;
722-
} else if (!it->first.compare(OPT_SSL_CA)) {
726+
} else if (!it->first.compare(OPT_SSL_CA) || !it->first.compare("sslCA") ) {
723727
try {
724728
p_s = (it->second).get< sql::SQLString >();
725729
} catch (sql::InvalidArgumentException&) {
726-
throw sql::InvalidArgumentException("Wrong type passed for sslCA expected sql::SQLString");
730+
throw sql::InvalidArgumentException("Wrong type passed for ssl-ca expected sql::SQLString");
727731
}
728732
if (p_s) {
729733
sslCA = *p_s;
730734
} else {
731-
throw sql::InvalidArgumentException("No string value passed for sslCA");
735+
throw sql::InvalidArgumentException("No string value passed for ssl-ca");
732736
}
733737
ssl_used = true;
734-
} else if (!it->first.compare(OPT_SSL_CAPATH)) {
738+
} else if (!it->first.compare(OPT_SSL_CAPATH) || !it->first.compare("sslCAPath")) {
735739
try {
736740
p_s = (it->second).get< sql::SQLString >();
737741
} catch (sql::InvalidArgumentException&) {
738-
throw sql::InvalidArgumentException("Wrong type passed for sslCAPath expected sql::SQLString");
742+
throw sql::InvalidArgumentException("Wrong type passed for ssl-capath expected sql::SQLString");
739743
}
740744
if (p_s) {
741745
sslCAPath = *p_s;
742746
} else {
743-
throw sql::InvalidArgumentException("No string value passed for sslCAPath");
747+
throw sql::InvalidArgumentException("No string value passed for ssl-capath");
744748
}
745749
ssl_used = true;
746-
} else if (!it->first.compare(OPT_SSL_CIPHER)) {
750+
} else if (!it->first.compare(OPT_SSL_CIPHER) || !it->first.compare("sslCipher")) {
747751
try {
748752
p_s = (it->second).get< sql::SQLString >();
749753
} catch (sql::InvalidArgumentException&) {
750-
throw sql::InvalidArgumentException("Wrong type passed for sslCipher expected sql::SQLString");
754+
throw sql::InvalidArgumentException("Wrong type passed for ssl-cipher expected sql::SQLString");
751755
}
752756
if (p_s) {
753757
sslCipher = *p_s;
754758
} else {
755-
throw sql::InvalidArgumentException("No string value passed for sslCipher");
759+
throw sql::InvalidArgumentException("No string value passed for ssl-cipher");
756760
}
757761
ssl_used = true;
758-
} else if (!it->first.compare(OPT_TLS_VERSION)) {
762+
} else if (!it->first.compare(OPT_TLS_VERSION) || !it->first.compare("OPT_TLS_VERSION")) {
759763
try {
760764
p_s = (it->second).get< sql::SQLString >();
761765
} catch (sql::InvalidArgumentException&) {
@@ -1064,6 +1068,10 @@ void MySQL_Connection::init(ConnectOptionsMap & properties)
10641068

10651069
it = properties.find(OPT_SSL_MODE);
10661070

1071+
//Use legacy option
1072+
if(it == properties.end())
1073+
it = properties.find("OPT_SSL_MODE");
1074+
10671075
if (it != properties.end())
10681076
{
10691077
PROCESS_CONN_OPTION(int, intOptions);

‎test/unit/classes/connection.cpp

Lines changed: 103 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3455,7 +3455,7 @@ void connection::ssl_mode()
34553455
connection_properties["userName"]=user;
34563456
connection_properties["password"]=passwd;
34573457

3458-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_DISABLED;
3458+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
34593459

34603460
created_objects.clear();
34613461
con.reset(driver->connect(connection_properties));
@@ -3482,7 +3482,7 @@ void connection::ssl_mode()
34823482

34833483
ASSERT_EQUALS(0, static_cast<int>(res->getString(2).length()));
34843484

3485-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_REQUIRED;
3485+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_REQUIRED;
34863486

34873487
try
34883488
{
@@ -3510,12 +3510,12 @@ void connection::ssl_mode()
35103510
connection_properties["userName"]="ssluser";
35113511
connection_properties["password"]="sslpass";
35123512

3513-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_REQUIRED;
3513+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_REQUIRED;
35143514

35153515
created_objects.clear();
35163516
con.reset(driver->connect(connection_properties));
35173517

3518-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_DISABLED;
3518+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
35193519

35203520
//only to trigger setssl which changes SSL_MODE
35213521
connection_properties["sslCA"] = "invalid_path";
@@ -3543,7 +3543,7 @@ void connection::tls_version()
35433543
connection_properties["userName"]=user;
35443544
connection_properties["password"]=passwd;
35453545

3546-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_DISABLED;
3546+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
35473547

35483548
created_objects.clear();
35493549
con.reset(driver->connect(connection_properties));
@@ -3570,10 +3570,10 @@ void connection::tls_version()
35703570
tls_versions.push_back(tls_available.substr(begin_pos, end_pos-begin_pos));
35713571
}
35723572

3573-
connection_properties["OPT_SSL_MODE"] = sql::SSL_MODE_REQUIRED;
3573+
connection_properties[OPT_SSL_MODE] = sql::SSL_MODE_REQUIRED;
35743574

35753575
// Using ALL TLS version... should connect
3576-
connection_properties["OPT_TLS_VERSION"] = tls_available;
3576+
connection_properties[OPT_TLS_VERSION] = tls_available;
35773577

35783578
created_objects.clear();
35793579
try
@@ -3588,7 +3588,7 @@ void connection::tls_version()
35883588

35893589

35903590
// Using wrong TLS version... should fail to connect
3591-
connection_properties["OPT_TLS_VERSION"] = sql::SQLString("TLSv999");
3591+
connection_properties[OPT_TLS_VERSION] = sql::SQLString("TLSv999");
35923592

35933593
created_objects.clear();
35943594
try
@@ -3608,7 +3608,7 @@ void connection::tls_version()
36083608
version != tls_versions.end();
36093609
++version)
36103610
{
3611-
connection_properties["OPT_TLS_VERSION"] = sql::SQLString(*version);
3611+
connection_properties[OPT_TLS_VERSION] = sql::SQLString(*version);
36123612

36133613
created_objects.clear();
36143614
try
@@ -3656,7 +3656,7 @@ void connection::cached_sha2_auth()
36563656
opts["userName"] = "doomuser";
36573657
opts["password"] = "!sha2user_pass";
36583658
opts["OPT_GET_SERVER_PUBLIC_KEY"] = false;
3659-
opts["OPT_SSL_MODE"] = sql::SSL_MODE_DISABLED;
3659+
opts[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
36603660

36613661
try {
36623662

@@ -3953,5 +3953,98 @@ void connection::tls_deprecation()
39533953

39543954
}
39553955

3956+
3957+
//Test if ssl is enabled using cipher
3958+
auto check_ssl_impl = [](std::shared_ptr<sql::Connection> sess, bool enable, int line)
3959+
{
3960+
std::unique_ptr<sql::Statement> stmt(sess->createStatement());
3961+
std::unique_ptr<sql::ResultSet> res(stmt->executeQuery("SHOW STATUS LIKE 'Ssl_cipher'"));
3962+
3963+
res->next();
3964+
std::cout << "Line "<< line << ": " << res->getString(1) << ":" << res->getString(2) << std::endl;
3965+
3966+
std::string cipher = res->getString(2);
3967+
3968+
ASSERT_EQUALS(enable, !cipher.empty());
3969+
};
3970+
3971+
#define check_ssl(x,y) check_ssl_impl(x, y, __LINE__)
3972+
3973+
3974+
void connection::normalize_ssl_options()
3975+
{
3976+
3977+
std::vector<std::string> options =
3978+
{
3979+
OPT_SSL_MODE,
3980+
OPT_SSL_CA,
3981+
OPT_SSL_CAPATH,
3982+
OPT_SSL_CRL,
3983+
OPT_SSL_CRLPATH,
3984+
OPT_TLS_VERSION,
3985+
"sslKey",
3986+
"sslCert",
3987+
"sslCA",
3988+
"sslCAPath",
3989+
"sslCipher",
3990+
"sslCRL",
3991+
"sslCRLPath",
3992+
"rsaKey",
3993+
"OPT_SSL_MODE",
3994+
"OPT_TLS_VERSION"
3995+
};
3996+
3997+
for(auto &opt : options)
3998+
{
3999+
{
4000+
std::cout << "Option: " << opt << std::endl;
4001+
4002+
sql::ConnectOptionsMap sess_opt;
4003+
4004+
if(opt == "OPT_SSL_MODE" || opt == OPT_SSL_MODE)
4005+
{
4006+
sess_opt[opt]=sql::SSL_MODE_DISABLED;
4007+
}
4008+
else
4009+
{
4010+
sess_opt[opt] ="BAD";
4011+
sess_opt[opt] ="GOOD";
4012+
sess_opt[OPT_SSL_MODE]=sql::SSL_MODE_DISABLED;
4013+
}
4014+
4015+
4016+
std::shared_ptr<sql::Connection> s(getConnection(&sess_opt));
4017+
check_ssl(s, false);
4018+
4019+
if(opt != "OPT_SSL_MODE" && opt != OPT_SSL_MODE)
4020+
ASSERT_EQUALS("GOOD", sess_opt[opt].get<std::string>());
4021+
}
4022+
4023+
}
4024+
4025+
//Defined Twice. Last one wins
4026+
{
4027+
sql::ConnectOptionsMap sess_opt;
4028+
4029+
sess_opt[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
4030+
sess_opt[OPT_SSL_MODE] = sql::SSL_MODE_REQUIRED;
4031+
4032+
std::shared_ptr<sql::Connection> s(getConnection(&sess_opt));
4033+
check_ssl(s, true);
4034+
}
4035+
{
4036+
sql::ConnectOptionsMap sess_opt;
4037+
4038+
sess_opt[OPT_SSL_MODE] = sql::SSL_MODE_REQUIRED;
4039+
sess_opt[OPT_SSL_MODE] = sql::SSL_MODE_DISABLED;
4040+
4041+
std::shared_ptr<sql::Connection> s(getConnection(&sess_opt));
4042+
check_ssl(s, false);
4043+
}
4044+
4045+
}
4046+
4047+
4048+
39564049
} /* namespace connection */
39574050
} /* namespace testsuite */

‎test/unit/classes/connection.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ class connection : public unit_fixture
9393
TEST_CASE(dns_srv);
9494
TEST_CASE(mfa);
9595
TEST_CASE(tls_deprecation);
96+
TEST_CASE(normalize_ssl_options);
9697
}
9798

9899
/**
@@ -297,6 +298,11 @@ class connection : public unit_fixture
297298
*/
298299
void tls_deprecation();
299300

301+
/*
302+
* Test of MySQL_Connection::normalize_ssl_options()
303+
*
304+
*/
305+
void normalize_ssl_options();
300306

301307
};
302308

0 commit comments

Comments
 (0)