From 4399b6e7658d89ee9f6e498029c13fd8af372234 Mon Sep 17 00:00:00 2001 From: Ceyhun Can Ulker Date: Wed, 10 Dec 2025 18:15:54 +0300 Subject: [PATCH 1/3] Update SSL context to be able to use TLSv1.2 or TLSv1.3 (instead of harcoded v1.2) in ClientConnection (#528) --- lib/ClientConnection.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/ClientConnection.cc b/lib/ClientConnection.cc index 0bd935d4..86dfd9d1 100644 --- a/lib/ClientConnection.cc +++ b/lib/ClientConnection.cc @@ -207,7 +207,10 @@ ClientConnection::ClientConnection(const std::string& logicalAddress, const std: } if (clientConfiguration.isUseTls()) { - ASIO::ssl::context ctx(ASIO::ssl::context::tlsv12_client); + ASIO::ssl::context ctx(ASIO::ssl::context::sslv23_client); + ctx.set_options(ASIO::ssl::context::default_workarounds | ASIO::ssl::context::no_sslv2 | + ASIO::ssl::context::no_sslv3 | ASIO::ssl::context::no_tlsv1 | + ASIO::ssl::context::no_tlsv1_1); Url serviceUrl; Url proxyUrl; Url::parse(physicalAddress, serviceUrl); From 613764339aeb0f8dc22d220999f3032e6cf120ec Mon Sep 17 00:00:00 2001 From: Ceyhun Can Ulker Date: Thu, 11 Dec 2025 01:55:23 +0300 Subject: [PATCH 2/3] Add TlsNegotationTest --- tests/TlsNegotiationTest.cc | 182 ++++++++++++++++++++++++++++++++++++ 1 file changed, 182 insertions(+) create mode 100644 tests/TlsNegotiationTest.cc diff --git a/tests/TlsNegotiationTest.cc b/tests/TlsNegotiationTest.cc new file mode 100644 index 00000000..bb69b374 --- /dev/null +++ b/tests/TlsNegotiationTest.cc @@ -0,0 +1,182 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +#include +#include +#include +#include "lib/AsioDefines.h" +#include +#include +#include +#include "lib/LogUtils.h" +#include + +#ifdef USE_ASIO +#include +#include +#else +#include +#include +#endif + +DECLARE_LOG_OBJECT() + +#ifndef TEST_CONF_DIR +#error "TEST_CONF_DIR is not specified" +#endif + +static const std::string caPath = TEST_CONF_DIR "/cacert.pem"; +static const std::string clientPublicKeyPath = TEST_CONF_DIR "/client-cert.pem"; +static const std::string clientPrivateKeyPath = TEST_CONF_DIR "/client-key.pem"; + +using namespace pulsar; + +class MockTlsServer { +public: + MockTlsServer() + : acceptor_(io_context_, ASIO::ip::tcp::endpoint(ASIO::ip::tcp::v4(), 0)), + ctx_(ASIO::ssl::context::sslv23) { + + ctx_.set_options(ASIO::ssl::context::default_workarounds | + ASIO::ssl::context::no_sslv2 | + ASIO::ssl::context::no_sslv3); + + ctx_.use_certificate_chain_file(clientPublicKeyPath); + ctx_.use_private_key_file(clientPrivateKeyPath, ASIO::ssl::context::pem); + ctx_.set_verify_mode(ASIO::ssl::context::verify_none); + } + + int getPort() const { + return acceptor_.local_endpoint().port(); + } + + void setTls12Only() { + SSL_CTX* ssl_ctx = ctx_.native_handle(); +#if defined(TLS1_2_VERSION) + SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_2_VERSION); + SSL_CTX_set_max_proto_version(ssl_ctx, TLS1_2_VERSION); +#else + LOG_WARN("TLS 1.2 not supported by OpenSSL headers"); +#endif + } + + void setTls13Only() { + SSL_CTX* ssl_ctx = ctx_.native_handle(); +#if defined(TLS1_3_VERSION) + SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION); + SSL_CTX_set_max_proto_version(ssl_ctx, TLS1_3_VERSION); +#else + LOG_WARN("TLS 1.3 not supported by OpenSSL headers"); +#endif + } + + bool acceptAndHandshake() { + auto socket = std::make_shared(io_context_); + acceptor_.accept(*socket); + + ASIO::ssl::stream ssl_stream(*socket, ctx_); + + ASIO_ERROR error; + ssl_stream.handshake(ASIO::ssl::stream_base::server, error); + + if (error) { + LOG_ERROR("Handshake failed: " << error.message()); + return false; + } + LOG_INFO("Handshake success!"); + return true; + } + +private: + ASIO::io_context io_context_; + ASIO::ip::tcp::acceptor acceptor_; + ASIO::ssl::context ctx_; +}; + +TEST(TlsNegotiationTest, testTls12) { +#if !defined(TLS1_2_VERSION) + return; // Skip if TLS 1.2 is not available +#endif + + MockTlsServer server; + server.setTls12Only(); + int port = server.getPort(); + + std::promise handshakePromise; + auto handshakeFuture = handshakePromise.get_future(); + + std::thread serverThread([&server, &handshakePromise]() { + bool result = server.acceptAndHandshake(); + handshakePromise.set_value(result); + }); + + std::string serviceUrl = "pulsar+ssl://localhost:" + std::to_string(port); + ClientConfiguration config; + config.setTlsTrustCertsFilePath(caPath); + config.setTlsAllowInsecureConnection(true); // Self-signed certs match + config.setValidateHostName(false); + + Client client(serviceUrl, config); + + // Trigger connection by creating a producer. + // It will fail to create producer because mock server doesn't speak Pulsar, + // but we only care about the handshake. + Producer producer; + client.createProducerAsync("topic", [](Result, Producer){}); + + // Wait for handshake + ASSERT_TRUE(handshakeFuture.get()); + + serverThread.join(); + client.close(); +} + +TEST(TlsNegotiationTest, testTls13) { +#if !defined(TLS1_3_VERSION) + LOG_INFO("Skipping TLS 1.3 test because OpenSSL does not support it"); + return; +#endif + + MockTlsServer server; + server.setTls13Only(); + int port = server.getPort(); + + std::promise handshakePromise; + auto handshakeFuture = handshakePromise.get_future(); + + std::thread serverThread([&server, &handshakePromise]() { + bool result = server.acceptAndHandshake(); + handshakePromise.set_value(result); + }); + + std::string serviceUrl = "pulsar+ssl://localhost:" + std::to_string(port); + ClientConfiguration config; + config.setTlsTrustCertsFilePath(caPath); + config.setTlsAllowInsecureConnection(true); + config.setValidateHostName(false); + + Client client(serviceUrl, config); + + client.createProducerAsync("topic", [](Result, Producer){}); + + ASSERT_TRUE(handshakeFuture.get()); + + serverThread.join(); + client.close(); +} + From 5a85b45b6be197faf2dcdb9f924f7a7d5e62c01b Mon Sep 17 00:00:00 2001 From: Ceyhun Can Ulker Date: Thu, 11 Dec 2025 14:37:45 +0300 Subject: [PATCH 3/3] Fix format issues with the test --- tests/TlsNegotiationTest.cc | 51 +++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/tests/TlsNegotiationTest.cc b/tests/TlsNegotiationTest.cc index bb69b374..64f956d5 100644 --- a/tests/TlsNegotiationTest.cc +++ b/tests/TlsNegotiationTest.cc @@ -17,14 +17,16 @@ * under the License. */ #include -#include +#include #include -#include "lib/AsioDefines.h" +#include + +#include #include #include -#include + +#include "lib/AsioDefines.h" #include "lib/LogUtils.h" -#include #ifdef USE_ASIO #include @@ -47,23 +49,19 @@ static const std::string clientPrivateKeyPath = TEST_CONF_DIR "/client-key.pem"; using namespace pulsar; class MockTlsServer { -public: + public: MockTlsServer() : acceptor_(io_context_, ASIO::ip::tcp::endpoint(ASIO::ip::tcp::v4(), 0)), ctx_(ASIO::ssl::context::sslv23) { - - ctx_.set_options(ASIO::ssl::context::default_workarounds | - ASIO::ssl::context::no_sslv2 | + ctx_.set_options(ASIO::ssl::context::default_workarounds | ASIO::ssl::context::no_sslv2 | ASIO::ssl::context::no_sslv3); - + ctx_.use_certificate_chain_file(clientPublicKeyPath); ctx_.use_private_key_file(clientPrivateKeyPath, ASIO::ssl::context::pem); ctx_.set_verify_mode(ASIO::ssl::context::verify_none); } - int getPort() const { - return acceptor_.local_endpoint().port(); - } + int getPort() const { return acceptor_.local_endpoint().port(); } void setTls12Only() { SSL_CTX* ssl_ctx = ctx_.native_handle(); @@ -88,12 +86,12 @@ class MockTlsServer { bool acceptAndHandshake() { auto socket = std::make_shared(io_context_); acceptor_.accept(*socket); - + ASIO::ssl::stream ssl_stream(*socket, ctx_); - + ASIO_ERROR error; ssl_stream.handshake(ASIO::ssl::stream_base::server, error); - + if (error) { LOG_ERROR("Handshake failed: " << error.message()); return false; @@ -102,7 +100,7 @@ class MockTlsServer { return true; } -private: + private: ASIO::io_context io_context_; ASIO::ip::tcp::acceptor acceptor_; ASIO::ssl::context ctx_; @@ -110,7 +108,7 @@ class MockTlsServer { TEST(TlsNegotiationTest, testTls12) { #if !defined(TLS1_2_VERSION) - return; // Skip if TLS 1.2 is not available + return; // Skip if TLS 1.2 is not available #endif MockTlsServer server; @@ -128,20 +126,20 @@ TEST(TlsNegotiationTest, testTls12) { std::string serviceUrl = "pulsar+ssl://localhost:" + std::to_string(port); ClientConfiguration config; config.setTlsTrustCertsFilePath(caPath); - config.setTlsAllowInsecureConnection(true); // Self-signed certs match + config.setTlsAllowInsecureConnection(true); // Self-signed certs match config.setValidateHostName(false); Client client(serviceUrl, config); - - // Trigger connection by creating a producer. + + // Trigger connection by creating a producer. // It will fail to create producer because mock server doesn't speak Pulsar, // but we only care about the handshake. Producer producer; - client.createProducerAsync("topic", [](Result, Producer){}); + client.createProducerAsync("topic", [](Result, Producer) {}); // Wait for handshake ASSERT_TRUE(handshakeFuture.get()); - + serverThread.join(); client.close(); } @@ -149,7 +147,7 @@ TEST(TlsNegotiationTest, testTls12) { TEST(TlsNegotiationTest, testTls13) { #if !defined(TLS1_3_VERSION) LOG_INFO("Skipping TLS 1.3 test because OpenSSL does not support it"); - return; + return; #endif MockTlsServer server; @@ -171,12 +169,11 @@ TEST(TlsNegotiationTest, testTls13) { config.setValidateHostName(false); Client client(serviceUrl, config); - - client.createProducerAsync("topic", [](Result, Producer){}); + + client.createProducerAsync("topic", [](Result, Producer) {}); ASSERT_TRUE(handshakeFuture.get()); - + serverThread.join(); client.close(); } -