MDEV-40445 TLS 1.3 early data

Author: vuvova

include/ma_tls.h

@@ -43,6 +43,8 @@ typedef struct st_ma_pvio_tls {
   MARIADB_PVIO *pvio;
   void *ssl;
   MARIADB_X509_INFO cert_info;
+  const uchar *early_data; /* TLS 1.3 early data */
+  size_t early_data_len;
 } MARIADB_TLS;
 
 /* Function prototypes */
@@ -186,7 +188,8 @@ my_bool ma_pvio_tls_close(MARIADB_TLS *ctls);
 int ma_pvio_tls_verify_server_cert(MARIADB_TLS *ctls, unsigned int flags);
 const char *ma_pvio_tls_cipher(MARIADB_TLS *ctls);
 my_bool ma_pvio_tls_check_fp(MARIADB_TLS *ctls, const char *fp, const char *fp_list);
-my_bool ma_pvio_start_ssl(MARIADB_PVIO *pvio);
+my_bool ma_pvio_start_ssl(MARIADB_PVIO *pvio, const uchar *early_data,
+                          size_t early_data_len);
 void ma_pvio_tls_set_connection(MYSQL *mysql);
 void ma_pvio_tls_end();
 unsigned int ma_pvio_tls_get_peer_cert_info(MARIADB_TLS *ctls, unsigned int size);
@@ -219,4 +222,9 @@ int ma_tls_session_received(MARIADB_TLS *ctls, SSL_SESSION *session,
 void ma_pvio_cache_tls_session(MYSQL *mysql);
 
 
+/* Whether the early data was sent and accepted. When it was not -
+   the caller must send the packet again the ordinary way. */
+my_bool ma_tls_early_data_accepted(MARIADB_TLS *ctls);
+
+
 #endif /* _ma_tls_h_ */

libmariadb/ma_pvio.c

@@ -401,7 +401,11 @@ my_bool ma_pvio_has_data(MARIADB_PVIO *pvio, ssize_t *data_len)
 #ifdef HAVE_TLS
 
 /* {{{ my_bool ma_pvio_start_ssl */
-my_bool ma_pvio_start_ssl(MARIADB_PVIO *pvio)
+/*
+  Start TLS handshake, optionally sending TLS 1.3 early data
+*/
+my_bool ma_pvio_start_ssl(MARIADB_PVIO *pvio, const uchar *early_data,
+                          size_t early_data_len)
 {
   if (!pvio || !pvio->mysql)
     return 1;
@@ -410,6 +414,8 @@ my_bool ma_pvio_start_ssl(MARIADB_PVIO *pvio)
   {
     return 1;
   }
+  pvio->ctls->early_data= early_data;
+  pvio->ctls->early_data_len= early_data_len;
   if (ma_pvio_tls_connect(pvio->ctls))
   {
     free(pvio->ctls);

libmariadb/ma_tls.c

@@ -308,6 +308,9 @@ int ma_tls_session_received(MARIADB_TLS *ctls, SSL_SESSION *session,
   memcpy(entry->key, rs->key, MA_SHA256_HASH_SIZE);
 
   rs->session[rs->session_count++]= entry;
+
+  if (ctls->early_data) /* in this case the session comes after auth: safe to cache */
+    ma_pvio_cache_tls_session(ctls->pvio->mysql);
   return 0;
 }
 

libmariadb/secure/gnutls.c

@@ -1144,6 +1144,12 @@ void ma_tls_session_free(SSL_SESSION *session)
   free(session);
 }
 
+/* 0-RTT is not implemented for GnuTLS yet */
+my_bool ma_tls_early_data_accepted(MARIADB_TLS *ctls __attribute__((unused)))
+{
+  return 0;
+}
+
 static void ma_tls_session_keep(MARIADB_TLS *ctls, gnutls_session_t ssl)
 {
   SSL_SESSION *session;

libmariadb/secure/openssl.c

@@ -742,6 +742,8 @@ my_bool ma_tls_connect(MARIADB_TLS *ctls)
 
   if ((session= ma_tls_session_cache_get(ctls)))
     SSL_set_session(ssl, session);
+  else
+    ctls->early_data= NULL;   /* nothing to resume, so no early data either */
 
   /* Route all TLS I/O through the pvio read/write methods (and thus through
      the always non-blocking socket with poll()/select() based timeouts)
@@ -757,6 +759,19 @@ my_bool ma_tls_connect(MARIADB_TLS *ctls)
   /* CONC-732: Always set verification callback to avoid OpenSSL output */
   SSL_set_verify(ssl, SSL_VERIFY_PEER, ma_verification_callback);
 
+#ifdef TLS1_3_VERSION
+  if (ctls->early_data)
+  {
+    size_t written;
+    if (SSL_SESSION_get_max_early_data(session) < ctls->early_data_len ||
+        !SSL_write_early_data(ssl, ctls->early_data, ctls->early_data_len,
+                              &written))
+      ctls->early_data= NULL;
+  }
+#else
+  ctls->early_data= NULL;
+#endif
+
   /* The BIO blocks (poll() in sync, fiber yield in async), so SSL_connect()
      normally completes in one shot. The loop is kept defensive: should the
      BIO ever report WANT_READ/WANT_WRITE, wait the requested direction
@@ -801,6 +816,17 @@ my_bool ma_tls_connect(MARIADB_TLS *ctls)
   return 0;
 }
 
+
+my_bool ma_tls_early_data_accepted(MARIADB_TLS *ctls)
+{
+#ifdef TLS1_3_VERSION
+  return ctls->early_data &&
+         SSL_get_early_data_status((SSL *)ctls->ssl) == SSL_EARLY_DATA_ACCEPTED;
+#else
+  return 0;
+#endif
+}
+
 ssize_t ma_tls_read(MARIADB_TLS *ctls, const uchar* buffer, size_t length)
 {
   /* The custom BIO blocks (via poll()) in synchronous mode and performs

libmariadb/secure/schannel.c

@@ -250,6 +250,12 @@ void ma_tls_session_free(MA_SSL_SESSION *session __attribute__((unused)))
 {
 }
 
+/* 0-RTT is not implemented for Schannel yet */
+my_bool ma_tls_early_data_accepted(MARIADB_TLS *ctls __attribute__((unused)))
+{
+  return 0;
+}
+
 /* {{{ void *ma_tls_init(MARIADB_TLS *ctls, MYSQL *mysql) */
 void *ma_tls_init(MYSQL *mysql, MARIADB_TLS *ctls __attribute__((unused)))
 {

plugins/auth/my_auth.c

@@ -287,8 +287,9 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
 {
   MYSQL *mysql= mpvio->mysql;
   NET *net= &mysql->net;
-  char *buff, *end;
-  size_t conn_attr_len= (mysql->options.extension) ? 
+  char *buff, *end, *pre_ssl_end, *early_data= NULL;
+  size_t early_data_len;
+  size_t conn_attr_len= (mysql->options.extension) ?
                          mysql->options.extension->connect_attrs_len : 0;
   size_t proxy_header_len= 0;
   char *proxy_header=
@@ -415,6 +416,73 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
     int3store(buff+2, net->max_packet_size);
     end= buff+5;
   }
+  /* The rest of the packet is built before the TLS handshake starts,
+     so that it can be sent as early data in ma_pvio_start_ssl() */
+  pre_ssl_end= end;
+
+  if (mysql->user && mysql->user[0])
+    ma_strmake(end, mysql->user, USERNAME_LENGTH);
+  else
+    read_user_name(end);
+
+  /* We have to handle different version of handshake here */
+  end+= strlen(end) + 1;
+  if (data_len)
+  {
+    if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
+    {
+      if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA)
+      {
+        end= (char *)mysql_net_store_length((uchar *)end, data_len);
+      }
+      else {
+        /* Without CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA capability password
+           length is limited up to 255 chars */
+        if (data_len > 0xFF)
+          goto error;
+        *end++= data_len;
+      }
+      memcpy(end, data, data_len);
+      end+= data_len;
+    }
+    else
+    {
+      DBUG_ASSERT(data_len == SCRAMBLE_LENGTH_323 + 1); /* incl. \0 at the end */
+      memcpy(end, data, data_len);
+      end+= data_len;
+    }
+  }
+  else
+    *end++= 0;
+
+  /* Add database if needed */
+  if (mpvio->db && (mysql->server_capabilities & CLIENT_CONNECT_WITH_DB))
+  {
+    end= ma_strmake(end, mpvio->db, NAME_LEN) + 1;
+    mysql->db= strdup(mpvio->db);
+  }
+
+  if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH)
+    end= ma_strmake(end, mpvio->plugin->name, NAME_LEN) + 1;
+
+  end= ma_send_connect_attr(mysql, (unsigned char *)end);
+
+  /* MySQL 8.0:
+     If zstd compresson was specified, the server expects
+     1 byte for compression level
+  */
+  if (mysql->client_flag & CLIENT_ZSTD_COMPRESSION)
+  {
+    uchar compression_level= 3;
+    if (mysql->options.extension &&
+        mysql->options.extension->zstd_compression_level >= 1 &&
+        mysql->options.extension->zstd_compression_level <= 20)
+    {
+        compression_level= mysql->options.extension->zstd_compression_level;
+    }
+    *end++= compression_level;
+  }
+
 #ifdef HAVE_TLS
   if (mysql->options.ssl_key ||
       mysql->options.ssl_cert ||
@@ -428,8 +496,7 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
 #endif
       )
     mysql->options.use_ssl= 1;
-  if (mysql->options.use_ssl &&
-      (mysql->client_flag & CLIENT_SSL))
+  if (mysql->options.use_ssl && (mysql->client_flag & CLIENT_SSL))
   {
     unsigned int verify_flags= 0;
     /*
@@ -444,7 +511,8 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
       proxy_header= NULL;
     }
 
-    if (ma_net_write(net, (unsigned char *)buff, (size_t) (end-buff)) || ma_net_flush(net))
+    if (ma_net_write(net, (uchar *)buff, (size_t) (pre_ssl_end - buff))
+        || ma_net_flush(net))
     {
       my_set_error(mysql, CR_SERVER_LOST, SQLSTATE_UNKNOWN,
                           ER(CR_SERVER_LOST_EXTENDED),
@@ -453,7 +521,16 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
       goto error;
     }
     mysql->net.tls_verify_status = 0;
-    if (ma_pvio_start_ssl(mysql->net.pvio))
+
+    /* Early data aren't fully protected by TLS, so only used with
+       password_and_hashing() plugins. */
+    if (password_and_hashing(mysql, mpvio->plugin))
+    {
+      early_data= buff;
+      early_data_len= end - buff;
+    }
+
+    if (ma_pvio_start_ssl(mysql->net.pvio, (uchar*)early_data, early_data_len))
       goto error;
 
     verify_flags= MARIADB_TLS_VERIFY_PERIOD;
@@ -487,83 +564,26 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
       if (!password_and_hashing(mysql, mpvio->plugin))
         goto error;
     }
+    /* Need to resent if early data wasn't accepted */
+    if (!ma_tls_early_data_accepted(mysql->net.pvio->ctls))
+      early_data= NULL;
   }
 #endif /* HAVE_TLS */
 
-  /* This needs to be changed as it's not useful with big packets */
-  if (mysql->user && mysql->user[0])
-    ma_strmake(end, mysql->user, USERNAME_LENGTH);
-  else
-    read_user_name(end);
-
-  /* We have to handle different version of handshake here */
-  end+= strlen(end) + 1;
-  if (data_len)
-  {
-    if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
-    {
-      if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA)
-      {
-        end= (char *)mysql_net_store_length((uchar *)end, data_len);
-      }
-      else {
-        /* Without CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA capability password
-           length is limited up to 255 chars */
-        if (data_len > 0xFF)
-          goto error;
-        *end++= data_len;
-      }
-      memcpy(end, data, data_len);
-      end+= data_len;
-    }
-    else
-    {
-      DBUG_ASSERT(data_len == SCRAMBLE_LENGTH_323 + 1); /* incl. \0 at the end */
-      memcpy(end, data, data_len);
-      end+= data_len;
-    }
-  }
-  else
-    *end++= 0;
-
-  /* Add database if needed */
-  if (mpvio->db && (mysql->server_capabilities & CLIENT_CONNECT_WITH_DB))
-  {
-    end= ma_strmake(end, mpvio->db, NAME_LEN) + 1;
-    mysql->db= strdup(mpvio->db);
-  }
-
-  if (mysql->server_capabilities & CLIENT_PLUGIN_AUTH)
-    end= ma_strmake(end, mpvio->plugin->name, NAME_LEN) + 1;
-
-  end= ma_send_connect_attr(mysql, (unsigned char *)end);
-
-  /* MySQL 8.0: 
-     If zstd compresson was specified, the server expects
-     1 byte for compression level
-  */
-  if (mysql->client_flag & CLIENT_ZSTD_COMPRESSION)
+  if (!early_data)
   {
-    uchar compression_level= 3;
-    if (mysql->options.extension &&
-        mysql->options.extension->zstd_compression_level >= 1 &&
-        mysql->options.extension->zstd_compression_level <= 20)
+    if (proxy_header_len)
+      ma_net_write_buff(net, proxy_header, proxy_header_len);
+    /* Write authentication package */
+    if (ma_net_write(net, (uchar *)buff, (size_t) (end - buff))
+        || ma_net_flush(net))
     {
-        compression_level= mysql->options.extension->zstd_compression_level;
+      my_set_error(mysql, CR_SERVER_LOST, SQLSTATE_UNKNOWN,
+                          ER(CR_SERVER_LOST_EXTENDED),
+                          "sending authentication information",
+                          errno);
+      goto error;
     }
-    *end++= compression_level;
-  }
-
-  if (proxy_header_len)
-    ma_net_write_buff(net, proxy_header, proxy_header_len);
-  /* Write authentication package */
-  if (ma_net_write(net, (unsigned char *)buff, (size_t) (end-buff)) || ma_net_flush(net))
-  {
-    my_set_error(mysql, CR_SERVER_LOST, SQLSTATE_UNKNOWN,
-                        ER(CR_SERVER_LOST_EXTENDED),
-                        "sending authentication information",
-                        errno);
-    goto error;
   }
   free(buff);
   return 0;