Feature/session cpp ntls - #18597
Conversation
Replace official OpenSSL with Tongsuo 8.4-stable for ASF-compliant bundled libssl/libcrypto. Pin Thrift to commit 6dfb0b26 and update CI, docs, and examples to consume the bundled SSL runtime only.
…ackaging. Expose PKCS12 trust/key store configuration across Session APIs, patch Thrift for custom SSL contexts, add SSL unit tests with fixtures, and copy bundled Tongsuo runtime libraries next to test/example binaries on Windows.
Use execv with the correct openssl argv on Unix, disable LeakSanitizer for rpcSslUtilsTest, and copy libiotdb_session plus OpenSSL shared libraries next to IT binaries on Linux.
Linux rpcSslUtilsTest e2e cases need the bundled Tongsuo lib64 directory on the loader path for the child openssl process.
OpenSSL/Tongsuo reports benign allocations at process exit; ASAN_OPTIONS=detect_leaks=0 keeps address checks without failing the SSL unit tests.
Free PKCS7 safes after PKCS12_pack_authsafes, add RAII for parsed PKCS12 identities, and remove LeakSanitizer workarounds for rpcSslUtilsTest.
Session IT and plain examples run against non-encrypted IoTDB; rpc SSL tests restart IoTDB with TLS. NTLS rpc tests and TLCP handshake examples use local openssl s_server. Add focused C++/C example smoke tests and IoTDB TLS E2E coverage.
Tongsuo openssl s_server needs the bundled libssl on LD_LIBRARY_PATH; rpc tests already pass the install root but NTLS examples only set the executable path.
Git Bash MSYS perl lacks Locale::Maketext::Simple required by OpenSSL Configure. Prefer C:/Strawberry/perl/bin/perl.exe and prepend it on CI bash steps.
Locate nmake next to cl.exe and invoke it via helper batch files so MSVC tools are on PATH during the OpenSSL/Tongsuo source build.
Ship only legacy examples in the release zip; IT-only TLS/NTLS smoke examples stay in-tree. Locate nmake/vcvars64 when CMAKE_CXX_COMPILER is unset (VS2017 matrix on GHA).
Build libssl/libcrypto from Tongsuo 8.4-stable (ASF-compliant) instead of system OpenSSL, pin Thrift to 6dfb0b26, and wire SSL through RpcSslUtils with PKCS12 trust/keystore validation. Add plain/TLS/NTLS integration tests, example programs, multi-platform CI packaging, and macOS header-wrap fixes so Homebrew OpenSSL does not shadow Tongsuo NTLS APIs on CI runners.
…rify test Add IOTDB_SSL_PROVIDER (TONGSUO default, SYSTEM for host OpenSSL TLS-only), caFile/certFile/keyFile builder aliases, dual PKCS#12 validation, and fix Thrift handshake tests to complete TLS before asserting trust-store behavior.
…ssion-cpp-ntls # Conflicts: # iotdb-client/client-cpp/CMakeLists.txt # iotdb-client/client-cpp/README.md # iotdb-client/client-cpp/README_zh.md # iotdb-client/client-cpp/cmake/FetchOpenSSL.cmake # iotdb-client/client-cpp/src/assembly/package-metadata/third_party/DEPENDENCIES.md # iotdb-client/client-cpp/src/rpc/NodesSupplier.cpp # iotdb-client/client-cpp/test/CMakeLists.txt # iotdb-client/client-cpp/third-party/README.md
|
Could we consider decoupling mTLS support from TLCP support in this PR? mTLS is a standard TLS capability with broader applicability, while TLCP is a specialized requirement that could be developed and integrated independently in a follow-up PR. For the release build, I suggest keeping OpenSSL as the default provider for compatibility and maintenance simplicity, and providing TLCP support as an optional provider/package for users who specifically need it. This would reduce the scope and coupling of this change and keep the default distribution simpler. |
I will refactor this PR to keep standard TLS and mTLS support only, with OpenSSL as the default provider for release |
2 participants
Description
Support encrypted communication in the C++ client
Add TLS and TLCP support for Tree/Table sessions, session pools, and C APIs. Support server authentication and mutual
authentication through trust stores and key stores.
Support multiple NTLS providers and packaging
Use Tongsuo by default and support GmSSL as an alternative provider. Bundle the required runtime libraries and improve
Linux, macOS, and Windows packaging.
Add examples and integration tests
Add C/C++ TLS and TLCP examples. Cover plain, TLS, mutual TLS, and NTLS connections, including communication with a
real IoTDB server configured with
thrift_ssl_client_auth=true.This PR has:
Key changed/added classes (or packages if there are too many classes) in this PR
SslConfigRpcSslUtilsGmsslTlcpSocket