Add TLS/TLCP SSL support to the C++ client with bundled Tongsuo#18130
Add TLS/TLCP SSL support to the C++ client with bundled Tongsuo#18130hongzhi-gao wants to merge 28 commits into
Conversation
Replace official OpenSSL with Tongsuo 8.4-stable for ASF-compliant bundled libssl/libcrypto. Pin Thrift to commit 6dfb0b26 and update CI, docs, and examples to consume the bundled SSL runtime only.
…ackaging. Expose PKCS12 trust/key store configuration across Session APIs, patch Thrift for custom SSL contexts, add SSL unit tests with fixtures, and copy bundled Tongsuo runtime libraries next to test/example binaries on Windows.
Use execv with the correct openssl argv on Unix, disable LeakSanitizer for rpcSslUtilsTest, and copy libiotdb_session plus OpenSSL shared libraries next to IT binaries on Linux.
Linux rpcSslUtilsTest e2e cases need the bundled Tongsuo lib64 directory on the loader path for the child openssl process.
OpenSSL/Tongsuo reports benign allocations at process exit; ASAN_OPTIONS=detect_leaks=0 keeps address checks without failing the SSL unit tests.
Free PKCS7 safes after PKCS12_pack_authsafes, add RAII for parsed PKCS12 identities, and remove LeakSanitizer workarounds for rpcSslUtilsTest.
Session IT and plain examples run against non-encrypted IoTDB; rpc SSL tests restart IoTDB with TLS. NTLS rpc tests and TLCP handshake examples use local openssl s_server. Add focused C++/C example smoke tests and IoTDB TLS E2E coverage.
Tongsuo openssl s_server needs the bundled libssl on LD_LIBRARY_PATH; rpc tests already pass the install root but NTLS examples only set the executable path.
Git Bash MSYS perl lacks Locale::Maketext::Simple required by OpenSSL Configure. Prefer C:/Strawberry/perl/bin/perl.exe and prepend it on CI bash steps.
Locate nmake next to cl.exe and invoke it via helper batch files so MSVC tools are on PATH during the OpenSSL/Tongsuo source build.
Ship only legacy examples in the release zip; IT-only TLS/NTLS smoke examples stay in-tree. Locate nmake/vcvars64 when CMAKE_CXX_COMPILER is unset (VS2017 matrix on GHA).
Pass no-asm when configuring Tongsuo on Apple platforms, use brew Perl explicitly, and default empty Windows verify matrix entries to VS 2022 x64.
Homebrew headers on GitHub macOS runners shadow the bundled Tongsuo install and hide NTLS APIs required by RpcSslUtils.
Clear CPATH-style include env vars on macOS CI and prepend the Tongsuo install include tree before linking iotdb_session.
Avoid Xcode SDK OpenSSL shadowing NTLS APIs by generating absolute-path wrapper headers and linking imported Tongsuo libraries directly.
Place wrapper headers under openssl/ so angle-bracket includes resolve to Tongsuo before the macOS SDK, and avoid pulling Thrift SSL headers into RpcSslUtils.h.
Windows: use find_package(OpenSSL) so MSVC gets proper IMPORTED_IMPLIB targets. macOS: apply openssl wrapper include dir directly on iotdb_session BEFORE PUBLIC.
Partial wrappers let nested <openssl/ossl_typ.h> resolve to Homebrew and break Tongsuo-only types such as DELEGATED_CREDENTIAL in x509.h.
Set OPENSSL_SSL_LIBRARY on the macOS manual-find path so iotdb_install_openssl_runtime copies libssl/libcrypto into lib/.
Fix multi-language-client Spotless check failures on Linux and Windows.
Generated PEM/P12 material under client-cpp/test/fixtures is test data, not licensable source; unblocks multi-language-client server build.
Use client-cpp/test/fixtures/** relative to iotdb-client module. Watch root pom.xml in multi-language-client and client-cpp-package.
On Linux/Windows find_package path has no iotdb_tongsuo_openssl_wrap; unconditional link made ld search for -liotdb_tongsuo_openssl_wrap.
SslTestFixtures.cpp uses NTLS APIs; test binaries need the same BEFORE wrap include path as iotdb_session on Homebrew macOS runners.
Route NTLS enablement through RpcSslUtils, set DYLD_LIBRARY_PATH for forked Tongsuo openssl, fix macOS executableDir in SSL fixtures, and apply the Tongsuo openssl header wrap to test targets.
|
I reviewed this PR locally against head
|
|
One more API/UX note about the new It is reasonable to align the C++ Session API with the Java Session API, but in the C/C++ ecosystem this naming can be ambiguous. Some C/C++ clients use similar names, but often with different semantics. For example, Paho MQTT C has So if this PR keeps the Java-style names, please make the boundary explicit in docs and errors: JKS is not supported by the C++ client; |
…nd packaging Enforce Thrift peer verification when a trust store is configured, pin Tongsuo 8.4.0 with tarball SHA256 verification, package TLS/NTLS examples in the SDK, and document PKCS#12/PEM/JKS boundaries with Thrift-level negative tests.
hongzhi-gao
force-pushed
the
feature/session-cpp-ntls
branch
from
47b645d to
dabb5bb
Compare
2 participants
Add NTLS (TLCP) support to the C++ client. Tongsuo is chosen because it is Apache-2.0 licensed and provides both standard TLS and NTLS in one OpenSSL-compatible stack; it is built from source by default and bundled into the SDK.
Description
NTLS / TLCP client support
sslProtocol(TLS/TLCP), PKCS12trustStore/keyStore, mirroring the Java Session API.RpcSslUtilswires ThriftTSSLSocketfor TLS and TLCP (including dual SM2 PKCS12 for mutual auth).Why Tongsuo
8.4-stableat configure time (WITH_SSL=ON, default);libssl/libcryptoshipped in the SDK package.Tests & CI
plain→ssl(IoTDB TLS) →ntls(openssl s_server).This PR has:
Key changed/added classes
RpcSslUtils.{h,cpp}— TLS/TLCP SSL context and Thrift factorySessionBuilder.h,SessionC.{h,cpp}— client SSL configuration APIcmake/FetchOpenSSL.cmake— Tongsuo source build and SDK bundlingtest/scripts/run_cpp_it_phases.py— plain / TLS / NTLS IT phases