60 lines
1.4 KiB
Diff
60 lines
1.4 KiB
Diff
--- /dev/null
|
|
+++ b/docs/configuration/inbound/mysql.md
|
|
@@ -0,0 +1,56 @@
|
|
+// OMV
|
|
+
|
|
+### Structure
|
|
+
|
|
+```json
|
|
+{
|
|
+ "type": "mysql",
|
|
+ "tag": "mysql-in",
|
|
+
|
|
+ ... // Listen Fields
|
|
+
|
|
+ "users": [
|
|
+ {
|
|
+ "user": "root",
|
|
+ "password": "my_password"
|
|
+ }
|
|
+ ],
|
|
+ "tls": {},
|
|
+ "multiplex": {}
|
|
+}
|
|
+```
|
|
+
|
|
+### Listen Fields
|
|
+
|
|
+See [Listen Fields](/configuration/shared/listen/) for details.
|
|
+
|
|
+### Fields
|
|
+
|
|
+#### users
|
|
+
|
|
+MySQL users for authentication during the handshake.
|
|
+
|
|
+#### tls
|
|
+
|
|
+==Required==
|
|
+
|
|
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
|
|
+
|
|
+TLS must be enabled because the MySQL protocol uses TLS negotiation during the handshake phase.
|
|
+
|
|
+#### multiplex
|
|
+
|
|
+See [Multiplex](/configuration/shared/multiplex#inbound) for details.
|
|
+
|
|
+### Description
|
|
+
|
|
+The MySQL inbound uses the MySQL protocol handshake for TLS negotiation, then runs smux multiplexing over the encrypted connection.
|
|
+
|
|
+The connection flow is:
|
|
+
|
|
+1. Client connects and performs a standard MySQL handshake (using [go-mysql](https://github.com/go-mysql-org/go-mysql))
|
|
+2. TLS is negotiated as part of the MySQL handshake
|
|
+3. After handshake, smux sessions are multiplexed over the TLS connection
|
|
+4. Each smux stream carries a 1-byte command (`0x01` for TCP, `0x03` for UDP) followed by a SOCKS address header
|
|
+
|
|
+This makes the traffic appear as a normal MySQL TLS connection to network observers.
|