Hongzhi Gao created THRIFT-6073:
-----------------------------------
Summary: Add optional TLCP/NTLS support to C++ TSSLSocket
Key: THRIFT-6073
URL: https://issues.apache.org/jira/browse/THRIFT-6073
Project: Thrift
Issue Type: New Feature
Components: C++ - Library
Affects Versions: 0.24.0
Environment: * OS: Linux (Ubuntu 24.04 / WSL2)
* Compiler: GCC 13
* CMake: 3.28+
* Boost: 1.83 (for unit tests)
* Tongsuo: 8.5.x, built with ./config enable-ntls, installed to <prefix>
* Thrift: feature/cpp-tongsuo-ntls
Build:
{code}
cmake .. -DWITH_TONGSUO=ON -DTONGSUO_ROOT_DIR=<prefix> \
-DBUILD_TESTING=ON -DBUILD_COMPILER=ON \
-DWITH_LIBEVENT=OFF -DWITH_ZLIB=OFF
make TNTLSSocketTest
{code}
Test:
{code}
ctest -R TNTLSSocketTest
{code}
Note: Tongsuo must be built with enable-ntls. Standard OpenSSL build is
unaffected.
Reporter: Hongzhi Gao
Fix For: 0.24.0
h2. Problem
Thrift C++ provides SSL/TLS via TSSLSocket/TSSLSocketFactory (OpenSSL).
Deployments that require TLCP (Transport Layer Cryptography Protocol), commonly
implemented as NTLS in Tongsuo/BabaSSL, cannot use the existing API as-is:
* TLCP requires dual certificates (signing + encryption), while
TSSLSocketFactory only exposes single cert/key loading
(loadCertificate/loadPrivateKey).
* TLCP uses SM2/SM3/SM4 cipher suites and a different handshake path than
standard TLS.
Today, teams must maintain private forks or replace the transport layer to run
Thrift over TLCP.
h2. Proposed solution
Add an opt-in build path and API extensions:
* CMake: -DWITH_TONGSUO=ON and -DTONGSUO_ROOT_DIR=... to link libthrift against
Tongsuo (OpenSSL-compatible).
* Runtime feature detection: THRIFT_HAVE_NTLS when NTLS APIs are available.
* TSSLSocketFactory: SSLProtocol::NTLS and dual-certificate APIs (loadSign* /
loadEnc*, including buffer variants).
* Unit tests: TNTLSSocketTest with SM2 dual-cert fixtures under test/keys/ntls/.
Default OpenSSL builds and standard TLS behavior remain unchanged when
-DWITH_TONGSUO is not enabled.
h2. Scope
* Client: cpp
* In scope: lib/cpp TSSLSocket, CMake, tests
* Out of scope: Ruby/Java/other language bindings; non-blocking server changes
h2. Pull request
GitHub PR: https://github.com/apache/thrift/pull/3606
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
