mysql2 3.24.3 → 3.24.4-canary.9178c82

package/lib/base/connection.js

@@ -27,6 +27,7 @@ const PacketParser = require('../packet_parser.js');
 const Packets = require('../packets/index.js');
 const Commands = require('../commands/index.js');
 const ConnectionConfig = require('../connection_config.js');
+const TlsSessionSlot = require('../tls_session_cache.js');
 const CharsetToEncoding = require('../constants/charset_encodings.js');
 const {
   traceCallback,
@@ -396,7 +397,16 @@ class BaseConnection extends EventEmitter {
       ? undefined
       : this.config.host;
 
+    const sessionSlot = new TlsSessionSlot(
+      this.config.ssl,
+      this.config.host,
+      this.config.port,
+      rejectUnauthorized,
+      verifyIdentity
+    );
     let secureEstablished = false;
+    let peerAccepted = false;
+    let issuedSession = null;
     this.stream.removeAllListeners('data');
     const secureSocket = Tls.connect(
       {
@@ -408,13 +418,14 @@ class BaseConnection extends EventEmitter {
               return undefined;
             },
         secureContext,
+        session: sessionSlot.get(),
         isServer: false,
         socket: this.stream,
         servername,
       },
       () => {
         secureEstablished = true;
-        if (rejectUnauthorized) {
+        if (rejectUnauthorized && !secureSocket.isSessionReused()) {
           if (typeof servername === 'string' && verifyIdentity) {
             const cert = secureSocket.getPeerCertificate(true);
             const serverIdentityCheckError = Tls.checkServerIdentity(
@@ -422,19 +433,32 @@ class BaseConnection extends EventEmitter {
               cert
             );
             if (serverIdentityCheckError) {
+              sessionSlot.delete();
               onSecure(serverIdentityCheckError);
               return;
             }
           }
         }
+        peerAccepted = true;
+        if (issuedSession !== null) {
+          sessionSlot.set(issuedSession);
+        }
         onSecure();
       }
     );
+    secureSocket.on('session', (session) => {
+      if (peerAccepted) {
+        sessionSlot.set(session);
+      } else {
+        issuedSession = session;
+      }
+    });
     // error handler for secure socket
     secureSocket.on('error', (err) => {
       if (secureEstablished) {
         this._handleNetworkError(err);
       } else {
+        sessionSlot.delete();
         onSecure(err);
       }
     });

package/lib/tls_session_cache.js

@@ -0,0 +1,73 @@
+'use strict';
+
+const { createLRU } = require('lru.min');
+
+const MAX_PEERS_PER_SSL_CONFIG = 100;
+
+const caches = new WeakMap();
+
+function snapshotMaterial(ssl) {
+  return {
+    ca: ssl.ca,
+    cert: ssl.cert,
+    ciphers: ssl.ciphers,
+    key: ssl.key,
+    passphrase: ssl.passphrase,
+    minVersion: ssl.minVersion,
+    maxVersion: ssl.maxVersion,
+  };
+}
+
+function sameMaterial(a, b) {
+  return (
+    a.ca === b.ca &&
+    a.cert === b.cert &&
+    a.ciphers === b.ciphers &&
+    a.key === b.key &&
+    a.passphrase === b.passphrase &&
+    a.minVersion === b.minVersion &&
+    a.maxVersion === b.maxVersion
+  );
+}
+
+class TlsSessionSlot {
+  constructor(ssl, host, port, rejectUnauthorized, verifyIdentity) {
+    this.ssl = ssl;
+    this.material = snapshotMaterial(ssl);
+    this.key = `${host}:${port}:${Boolean(rejectUnauthorized)}:${Boolean(verifyIdentity)}`;
+  }
+
+  _sessions() {
+    const cache = caches.get(this.ssl);
+    if (cache !== undefined && sameMaterial(cache.material, this.material)) {
+      return cache.sessions;
+    }
+    return undefined;
+  }
+
+  get() {
+    const sessions = this._sessions();
+    return sessions === undefined ? undefined : sessions.get(this.key);
+  }
+
+  set(session) {
+    let sessions = this._sessions();
+    if (sessions === undefined) {
+      if (!sameMaterial(this.material, snapshotMaterial(this.ssl))) {
+        return;
+      }
+      sessions = createLRU({ max: MAX_PEERS_PER_SSL_CONFIG });
+      caches.set(this.ssl, { material: this.material, sessions });
+    }
+    sessions.set(this.key, session);
+  }
+
+  delete() {
+    const sessions = this._sessions();
+    if (sessions !== undefined) {
+      sessions.delete(this.key);
+    }
+  }
+}
+
+module.exports = TlsSessionSlot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mysql2",
-  "version": "3.24.3",
+  "version": "3.24.4-canary.9178c82",
   "description": "fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS",
   "main": "index.js",
   "typings": "typings/mysql/index",