Support Thrift client mutual TLS#18026
Open
HTHou wants to merge 2 commits into
Open
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #18026 +/- ##
============================================
+ Coverage 41.31% 41.44% +0.13%
Complexity 318 318
============================================
Files 5273 5282 +9
Lines 368330 369399 +1069
Branches 47681 47806 +125
============================================
+ Hits 152159 153095 +936
- Misses 216171 216304 +133 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds end-to-end mutual TLS (mTLS) support for IoTDB’s external Thrift RPC: a new server-side flag to require client certificates, plus optional client keystore configuration across the Java Session APIs, JDBC, CLI/tools, and integration-test coverage for the mTLS client paths.
Changes:
- Add
thrift_ssl_client_authconfiguration and wire it into the DataNode external Thrift RPC service so the server can require client certificates when SSL is enabled. - Extend client connection stacks (Session/SessionPool/Table sessions, JDBC, CLI/tools) to optionally provide a client key store + password for mTLS.
- Extend integration-test environment SSL helpers and add
IoTDBClientMutualSSLITvalidating mTLS connectivity across Session/Pool/Table/JDBC clients.
Reviewed changes
Copilot reviewed 30 out of 30 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonDescriptor.java | Loads new thrift_ssl_client_auth property into common config. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java | Adds thriftSSLClientAuth flag with getter/setter. |
| iotdb-core/node-commons/src/assembly/resources/conf/iotdb-system.properties.template | Documents and exposes thrift_ssl_client_auth in the template. |
| iotdb-core/datanode/src/main/java/org/apache/iotdb/db/service/ExternalRPCService.java | Switches Thrift thread construction based on SSL + client-auth requirement. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/ThriftConnection.java | Passes optional client keystore config into RPC transport creation. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/TableSessionBuilder.java | Adds builder setters for client keystore path/password (mTLS). |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/SessionConnection.java | Threads client keystore parameters through connection initialization/reconnect paths. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/Session.java | Persists client keystore fields and exposes builder setters. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/pool/TableSessionPoolBuilder.java | Adds builder setters for client keystore path/password (mTLS). |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/pool/SessionPool.java | Carries client keystore config into pooled session construction and node discovery. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/NodesSupplier.java | Supplies client keystore config when creating node connections. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/AbstractSessionBuilder.java | Adds fields to hold client keystore settings for session builders. |
| iotdb-client/service-rpc/src/main/java/org/apache/iotdb/rpc/BaseRpcTransportFactory.java | Extends SSL transport creation to optionally set a client key store for mTLS. |
| iotdb-client/jdbc/src/test/java/org/apache/iotdb/jdbc/UtilsTest.java | Adds JDBC URL parsing assertions for keystore properties. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/Utils.java | Parses key_store / key_store_pwd into connection params. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/IoTDBConnectionParams.java | Adds JDBC connection params for client keystore path/password. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/IoTDBConnection.java | Uses updated SSL transport factory API including client keystore fields. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/Config.java | Introduces JDBC property keys for client keystore settings. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/AbstractSchemaTool.java | Enables CLI schema tools to pass optional client keystore for mTLS. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/AbstractDataTool.java | Enables CLI data tools to pass optional client keystore for mTLS. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/OptionsUtil.java | Adds CLI option definitions for client keystore args. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/Constants.java | Adds constants for new CLI keystore flags. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/cli/Cli.java | Allows specifying truststore/keystore via args (otherwise prompts) and passes them to JDBC properties. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/cli/AbstractCli.java | Adds CLI option parsing/plumbing for client keystore fields. |
| integration-test/src/test/java/org/apache/iotdb/session/it/IoTDBClientMutualSSLIT.java | New IT validating mTLS connectivity across Session/Pool/Table/JDBC clients. |
| integration-test/src/main/java/org/apache/iotdb/itbase/env/CommonConfig.java | Extends IT common config interface with setThriftSSLClientAuth. |
| integration-test/src/main/java/org/apache/iotdb/it/env/remote/config/RemoteCommonConfig.java | Implements new IT common config method as a no-op for remote env. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/env/AbstractEnv.java | Propagates mTLS client keystore properties into client connection helpers when server requires client auth. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppSharedCommonConfig.java | Propagates new thrift_ssl_client_auth setting to CN/DN in IT cluster configs. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppCommonConfig.java | Writes thrift_ssl_client_auth into generated properties for IT cluster nodes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
115
to
120
| TSSLTransportFactory.TSSLTransportParameters params = | ||
| RpcSslUtils.createTSSLTransportParameters(sslProtocol); | ||
| if (Files.exists(Paths.get(trustStore)) && Files.exists(Paths.get(keyStore))) { | ||
| RpcSslUtils.setTrustStore(params, trustStore, trustStorePwd); | ||
| RpcSslUtils.setTrustStore(params, trustStore, trustStorePwd); | ||
| if (hasText(keyStore)) { | ||
| RpcSslUtils.setKeyStore(params, keyStore, keyStorePwd); | ||
| } else { | ||
| throw new TTransportException(new IOException(RpcMessages.COULD_NOT_LOAD_KEYSTORE)); | ||
| } |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
thrift_ssl_client_authto require client certificates for Thrift SSL connections without reusing RESTclient_auth.IoTDBClientMutualSSLITcoverage for mTLS client paths.Notes
The server-side keystore/truststore paths remain the shared existing SSL settings. The new option only controls whether the Thrift SSL server requires client certificate authentication.
Validation
mvn spotless:apply -pl iotdb-client/service-rpc,iotdb-client/session,iotdb-client/jdbc,iotdb-client/cli,iotdb-core/node-commons,iotdb-core/datanodemvn spotless:apply -pl integration-test -P with-integration-testsmvn compile -pl iotdb-client/service-rpc,iotdb-client/session,iotdb-client/jdbc,iotdb-client/cli,iotdb-core/node-commonsmvn test -pl iotdb-client/jdbc -Dtest=UtilsTestgit diff --checkmvn compile -pl iotdb-core/node-commons,iotdb-core/datanodeis currently blocked by existing generated parser compile errors inASTVisitor.javaforMAX_SCHEMA_REGION_GROUP_NUM()andMAX_DATA_REGION_GROUP_NUM().IoTDBClientMutualSSLITcompiles and runs when current client modules are in the reactor; positive mTLS client cases pass, but the negative server-side enforcement case requires a locally built server containing this PR's DataNode changes. The local DataNode build is blocked by the parser issue above.