You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
181 lines
6.9 KiB
181 lines
6.9 KiB
#if MYSQL_6_10
|
|
|
|
// Copyright © 2004, 2017 Oracle and/or its affiliates. All rights reserved.
|
|
//
|
|
// MySQL Connector/NET is licensed under the terms of the GPLv2
|
|
// <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most
|
|
// MySQL Connectors. There are special exceptions to the terms and
|
|
// conditions of the GPLv2 as it is applied to this software, see the
|
|
// FLOSS License Exception
|
|
// <http://www.mysql.com/about/legal/licensing/foss-exception.html>.
|
|
//
|
|
// This program is free software; you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published
|
|
// by the Free Software Foundation; version 2 of the License.
|
|
//
|
|
// This program is distributed in the hope that it will be useful, but
|
|
// WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
// or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
// for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License along
|
|
// with this program; if not, write to the Free Software Foundation, Inc.,
|
|
// 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
|
|
|
|
using Externals.MySql.Data.MySqlClient;
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Diagnostics;
|
|
using System.IO;
|
|
using System.Net.Security;
|
|
using System.Security.Authentication;
|
|
using System.Security.Cryptography.X509Certificates;
|
|
using System.Text;
|
|
|
|
namespace Externals.MySql.Data.Common
|
|
{
|
|
internal class Ssl
|
|
{
|
|
private MySqlConnectionStringBuilder settings;
|
|
private static Dictionary<string, SslProtocols> tlsConnectionRef = new Dictionary<string, SslProtocols>();
|
|
private static Dictionary<string, int> tlsRetry = new Dictionary<string, int>();
|
|
private static SslProtocols[] tlsProtocols = new SslProtocols[] { SslProtocols.Tls12, SslProtocols.Tls11 };
|
|
private static Object thisLock = new Object();
|
|
|
|
public Ssl(MySqlConnectionStringBuilder settings)
|
|
{
|
|
this.settings = settings;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Retrieve client SSL certificates. Dependent on connection string
|
|
/// settings we use either file or store based certificates.
|
|
/// </summary>
|
|
private X509CertificateCollection GetClientCertificates()
|
|
{
|
|
X509CertificateCollection certs = new X509CertificateCollection();
|
|
|
|
// Check for file-based certificate
|
|
if (settings.CertificateFile != null)
|
|
{
|
|
X509Certificate2 clientCert = new X509Certificate2(settings.CertificateFile,
|
|
settings.CertificatePassword);
|
|
certs.Add(clientCert);
|
|
return certs;
|
|
}
|
|
|
|
if (settings.CertificateStoreLocation == MySqlCertificateStoreLocation.None)
|
|
return certs;
|
|
|
|
StoreLocation location =
|
|
(settings.CertificateStoreLocation == MySqlCertificateStoreLocation.CurrentUser) ?
|
|
StoreLocation.CurrentUser : StoreLocation.LocalMachine;
|
|
|
|
// Check for store-based certificate
|
|
X509Store store = new X509Store(StoreName.My, location);
|
|
store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
|
|
|
|
|
|
if (settings.CertificateThumbprint == null)
|
|
{
|
|
// Return all certificates from the store.
|
|
certs.AddRange(store.Certificates);
|
|
return certs;
|
|
}
|
|
|
|
// Find certificate with given thumbprint
|
|
certs.AddRange(store.Certificates.Find(X509FindType.FindByThumbprint,
|
|
settings.CertificateThumbprint, true));
|
|
|
|
if (certs.Count == 0)
|
|
{
|
|
throw new MySqlException("Certificate with Thumbprint " +
|
|
settings.CertificateThumbprint + " not found");
|
|
}
|
|
return certs;
|
|
}
|
|
|
|
|
|
public MySqlStream StartSSL(ref Stream baseStream, Encoding encoding, string connectionString)
|
|
{
|
|
RemoteCertificateValidationCallback sslValidateCallback =
|
|
new RemoteCertificateValidationCallback(ServerCheckValidation);
|
|
SslStream ss = new SslStream(baseStream, false, sslValidateCallback, null);
|
|
X509CertificateCollection certs = GetClientCertificates();
|
|
|
|
string connectionId = connectionString.GetHashCode().ToString();
|
|
SslProtocols tlsProtocol = SslProtocols.Tls;
|
|
|
|
lock (thisLock)
|
|
{
|
|
if (tlsConnectionRef.ContainsKey(connectionId))
|
|
{
|
|
tlsProtocol = tlsConnectionRef[connectionId];
|
|
}
|
|
else
|
|
{
|
|
if (!tlsRetry.ContainsKey(connectionId))
|
|
{
|
|
tlsRetry[connectionId] = 0;
|
|
}
|
|
for (int i = tlsRetry[connectionId]; i < tlsProtocols.Length; i++)
|
|
{
|
|
tlsProtocol |= tlsProtocols[i];
|
|
}
|
|
}
|
|
try
|
|
{
|
|
ss.AuthenticateAsClientAsync(settings.Server, certs, tlsProtocol, false).Wait();
|
|
tlsConnectionRef[connectionId] = tlsProtocol;
|
|
tlsRetry.Remove(connectionId);
|
|
}
|
|
catch (AggregateException ex)
|
|
{
|
|
if (ex.GetBaseException() is IOException)
|
|
{
|
|
tlsConnectionRef.Remove(connectionId);
|
|
if (tlsRetry.ContainsKey(connectionId))
|
|
{
|
|
if (tlsRetry[connectionId] > tlsProtocols.Length)
|
|
throw new MySqlException(Resources.SslConnectionError, ex);
|
|
tlsRetry[connectionId] += 1;
|
|
}
|
|
}
|
|
throw ex.GetBaseException();
|
|
}
|
|
}
|
|
|
|
baseStream = ss;
|
|
MySqlStream stream = new MySqlStream(ss, encoding, false);
|
|
stream.SequenceByte = 2;
|
|
|
|
return stream;
|
|
}
|
|
|
|
private bool ServerCheckValidation(object sender, X509Certificate certificate,
|
|
X509Chain chain, SslPolicyErrors sslPolicyErrors)
|
|
{
|
|
if (sslPolicyErrors == SslPolicyErrors.None)
|
|
return true;
|
|
|
|
if (settings.SslMode == MySqlSslMode.Preferred ||
|
|
settings.SslMode == MySqlSslMode.Required)
|
|
{
|
|
//Tolerate all certificate errors.
|
|
return true;
|
|
}
|
|
|
|
if (settings.SslMode == MySqlSslMode.VerifyCA &&
|
|
sslPolicyErrors == SslPolicyErrors.RemoteCertificateNameMismatch)
|
|
{
|
|
// Tolerate name mismatch in certificate, if full validation is not requested.
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|