Jens Geyer created THRIFT-6218:
----------------------------------
Summary: C++: document that TSSLSocket::open() does not perform
the TLS handshake
Key: THRIFT-6218
URL: https://issues.apache.org/jira/browse/THRIFT-6218
Project: Thrift
Issue Type: Improvement
Components: C++ - Library, Documentation
Reporter: Jens Geyer
{{TSSLSocket::open()}} only opens the TCP connection: it calls
{{TSocket::open()}} and returns. The TLS handshake, and with it certificate
verification and the {{AccessManager}} check, happens later, on the first read
or write ({{checkHandshake()}}, a protected member).
That is a reasonable design, but {{TSSLSocket.h}} does not say so, and code
that treats a successful {{open()}} as "connected and verified" is wrong
without noticing. A test of a handshake that is supposed to fail, which only
calls {{open()}}, passes whether verification works or not.
Suggested: a comment on {{open()}} in {{TSSLSocket.h}} stating that the
handshake is deferred to the first I/O, and that handshake and verification
errors surface there.
_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
