[
https://issues.apache.org/jira/browse/THRIFT-6073?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Hongzhi Gao updated THRIFT-6073:
--------------------------------
Description:
h2. Summary
Add a backend-neutral extension point to the C++ TSSLSocket stack: applications
can inject a pre-configured OpenSSL SSL_CTX through the existing
SSLContextFactory / TSSLSocketFactory hook.
This makes it easier for applications to supply a fully configured TLS
context—protocol options, cipher suites, certificate loading, and other OpenSSL
settings—in application code, without patching libthrift or replacing the
transport layer.
h2. Problem
Thrift C++ provides SSL/TLS via TSSLSocket / TSSLSocketFactory
(OpenSSL-backed). TSSLSocketFactory already accepts a custom SSLContextFactory,
but SSLContext could only be constructed from SSLProtocol.
Applications that need TLS setup beyond the default helpers cannot supply an
externally configured SSL_CTX without patching Thrift locally.
Specific gaps today:
* loadCertificate() / loadPrivateKey() cover the common single cert/key case;
multi-step or non-standard certificate loading has no injection point at the
SSLContext level.
* Protocol methods, cipher configuration, and other OpenSSL options not
exposed by TSSLSocketFactory cannot be applied to a Thrift-managed context
without forking.
h2. Proposed solution
Add explicit SSLContext(SSL_CTX* ctx, bool takeOwnership = true) to wrap an
application-owned SSL_CTX. Applications configure the context with OpenSSL (or
an OpenSSL-compatible library) in application code, then pass it through the
existing SSLContextFactory hook. Thrift continues to handle handshake, I/O, and
certificate verification policy via TSSLSocketFactory.
No provider-specific build options, protocol enums, or certificate-loading APIs
in libthrift.
h2. Scope
*In scope:*
* SSLContext wrapper constructor and ownership-aware destructor
* Documentation in lib/cpp/README.md
* SecurityTest coverage for wrapped and null contexts
*Out of scope / removed from earlier draft:*
* Provider-specific build flags (e.g. WITH_TONGSUO)
* Protocol enums or dual-certificate helper APIs in libthrift
* Optional local integration tests tied to a specific TLS provider
h2. Acceptance criteria
* SSLContext can be constructed from an application-provided SSL_CTX*
* takeOwnership=true frees the context on destruction; takeOwnership=false
leaves ownership with the caller
* Null SSL_CTX is rejected with a clear error
* Existing default OpenSSL / SSLProtocol code path is unchanged
* SecurityTest passes on standard OpenSSL CI builds (wrapped_ssl_context,
wrapped_ssl_context_null)
h2. References
* GitHub PR: [https://github.com/apache/thrift/pull/3606]
* Motivation: enable advanced TLS configuration in application code without
maintaining a private transport fork
was:
h2. Summary
Extend the C++ TSSLSocket stack with a backend-neutral hook so applications can
inject a pre-configured OpenSSL SSL_CTX through the existing SSLContextFactory
/ TSSLSocketFactory path.
h2. Problem
Thrift C++ provides SSL/TLS via TSSLSocket / TSSLSocketFactory
(OpenSSL-backed). TSSLSocketFactory already accepts a custom SSLContextFactory,
but SSLContext could only be constructed from SSLProtocol. Applications that
need non-default TLS setup — including TLCP/NTLS dual-certificate configuration
via an OpenSSL-compatible library such as Tongsuo — cannot supply an externally
configured SSL_CTX without patching Thrift locally.
Specific gaps today:
* loadCertificate() / loadPrivateKey() assume a single cert/key pair; TLCP uses
separate signing and encryption credentials.
* Provider-specific protocol and cipher setup (e.g. NTLS_method(), dual-cert
APIs) has no injection point at the SSLContext level.
h2. Proposed solution
Add SSLContext(SSL_CTX* ctx, bool takeOwnership = true) to wrap an
application-owned SSL_CTX. Applications configure the context with their chosen
TLS provider, then pass it through the existing SSLContextFactory hook. Thrift
continues to handle handshake, I/O, and certificate verification policy via
TSSLSocketFactory.
No Tongsuo-specific build options, protocol enums, or dual-certificate APIs in
libthrift.
h2. Scope
*In scope:*
* SSLContext wrapper constructor and ownership-aware destructor
* Documentation in lib/cpp/README.md
* SecurityTest coverage for wrapped and null contexts
h2. Acceptance criteria
* SSLContext can be constructed from an application-provided SSL_CTX*
* takeOwnership=true frees the context on destruction; takeOwnership=false
leaves ownership with the caller
* Existing default OpenSSL / SSLProtocol code path is unchanged
* SecurityTest passes on standard OpenSSL CI builds
* (Optional) Local verification demonstrates NTLS handshake using injected
SSL_CTX
h2. References
* GitHub PR: https://github.com/apache/thrift/pull/3606
* Motivation: TLCP/NTLS deployments in regulated environments; avoid
maintaining a private transport fork
Environment: C++ libthrift; default OpenSSL 3.x build. SSLContext injection
verified via SecurityTest on standard OpenSSL CI configuration. (was: C++
libthrift, OpenSSL 3.x default build; TLCP/NTLS verified locally with Tongsuo
(OpenSSL-compatible).)
> Allow injecting external SSL_CTX into C++ SSLContext
> ----------------------------------------------------
>
> Key: THRIFT-6073
> URL: https://issues.apache.org/jira/browse/THRIFT-6073
> Project: Thrift
> Issue Type: New Feature
> Components: C++ - Library
> Affects Versions: 0.24.0
> Environment: C++ libthrift; default OpenSSL 3.x build. SSLContext
> injection verified via SecurityTest on standard OpenSSL CI configuration.
> Reporter: Hongzhi Gao
> Priority: Major
> Fix For: 0.24.0
>
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> h2. Summary
> Add a backend-neutral extension point to the C++ TSSLSocket stack:
> applications can inject a pre-configured OpenSSL SSL_CTX through the existing
> SSLContextFactory / TSSLSocketFactory hook.
> This makes it easier for applications to supply a fully configured TLS
> context—protocol options, cipher suites, certificate loading, and other
> OpenSSL settings—in application code, without patching libthrift or replacing
> the transport layer.
> h2. Problem
> Thrift C++ provides SSL/TLS via TSSLSocket / TSSLSocketFactory
> (OpenSSL-backed). TSSLSocketFactory already accepts a custom
> SSLContextFactory, but SSLContext could only be constructed from SSLProtocol.
> Applications that need TLS setup beyond the default helpers cannot supply an
> externally configured SSL_CTX without patching Thrift locally.
> Specific gaps today:
> * loadCertificate() / loadPrivateKey() cover the common single cert/key
> case; multi-step or non-standard certificate loading has no injection point
> at the SSLContext level.
> * Protocol methods, cipher configuration, and other OpenSSL options not
> exposed by TSSLSocketFactory cannot be applied to a Thrift-managed context
> without forking.
> h2. Proposed solution
> Add explicit SSLContext(SSL_CTX* ctx, bool takeOwnership = true) to wrap an
> application-owned SSL_CTX. Applications configure the context with OpenSSL
> (or an OpenSSL-compatible library) in application code, then pass it through
> the existing SSLContextFactory hook. Thrift continues to handle handshake,
> I/O, and certificate verification policy via TSSLSocketFactory.
> No provider-specific build options, protocol enums, or certificate-loading
> APIs in libthrift.
> h2. Scope
> *In scope:*
> * SSLContext wrapper constructor and ownership-aware destructor
> * Documentation in lib/cpp/README.md
> * SecurityTest coverage for wrapped and null contexts
> *Out of scope / removed from earlier draft:*
> * Provider-specific build flags (e.g. WITH_TONGSUO)
> * Protocol enums or dual-certificate helper APIs in libthrift
> * Optional local integration tests tied to a specific TLS provider
> h2. Acceptance criteria
> * SSLContext can be constructed from an application-provided SSL_CTX*
> * takeOwnership=true frees the context on destruction; takeOwnership=false
> leaves ownership with the caller
> * Null SSL_CTX is rejected with a clear error
> * Existing default OpenSSL / SSLProtocol code path is unchanged
> * SecurityTest passes on standard OpenSSL CI builds (wrapped_ssl_context,
> wrapped_ssl_context_null)
> h2. References
> * GitHub PR: [https://github.com/apache/thrift/pull/3606]
> * Motivation: enable advanced TLS configuration in application code without
> maintaining a private transport fork
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
