Add generic SSL/TLS configuration support#17854
Open
HTHou wants to merge 15 commits into
Open
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #17854 +/- ##
============================================
+ Coverage 41.04% 41.21% +0.17%
Complexity 318 318
============================================
Files 5258 5258
Lines 365157 366150 +993
Branches 47204 47355 +151
============================================
+ Hits 149878 150912 +1034
+ Misses 215279 215238 -41 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Collaborator
|
I think there are two correctness issues in this PR:
|
HTHou
commented
Jun 11, 2026
…onfig # Conflicts: # dependencies.json
…onfig # Conflicts: # iotdb-client/service-rpc/src/test/java/org/apache/iotdb/rpc/RpcUtilsTest.java
Caideyipi
approved these changes
Jun 16, 2026
Caideyipi
left a comment
Caideyipi
left a comment
Collaborator
There was a problem hiding this comment.
I reviewed the latest head (a55227f). I do not see a functional issue in the implemented ssl_protocol support, so I am approving the implemented functionality.
Non-blocking follow-ups:
- The PR description still mentions ssl_provider_class and optional JSSE provider registration, but the current code only implements ssl_protocol. Please either remove that claim from the PR text or add provider support.
- The integration-test EnvFactory SSL helpers do not propagate ssl_protocol into client connection properties/builders, so ITs built through AbstractEnv would still use the default TLS protocol even when a non-default ssl_protocol is configured. This does not appear to affect production code, but it would be worth fixing to make future protocol-specific ITs meaningful.
I also rechecked the previously discussed REST default-protocol concern and the sync internal-client propagation path. Those look addressed in the current version.
Contributor
Author
|
Thanks for the review. I addressed both follow-ups:
Validation:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR generalizes SSL/TLS handling by introducing a shared RpcSslUtils utility and propagating a new ssl_protocol setting through IoTDB’s server-side Thrift/REST/consensus stacks and through Java client entry points (Session/TableSession/JDBC/CLI). It also updates the integration-test environment to support SSL-enabled Thrift clients and adds an SSL-focused IT.
Changes:
- Add
ssl_protocolconfiguration (defaultTLS) and wire it through common + REST configs, Thrift SSL server/client transports, and Ratis TLS material loading. - Extend Java clients (Session/TableSession/SessionPool/JDBC/CLI tools) to carry
ssl_protocolthrough connection building and URL/property parsing. - Update integration-test env to auto-configure SSL clients when Thrift SSL is enabled; add
IoTDBClientSSLIT.
Reviewed changes
Copilot reviewed 56 out of 56 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| pom.xml | Updates Ratis version and excludes OTel API/context from ratis-common. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/service/AbstractThriftServiceThread.java | Switches Thrift SSL keystore/truststore handling to RpcSslUtils. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonDescriptor.java | Loads ssl_protocol and configures global RPC SSL defaults via RpcSslUtils. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java | Adds sslProtocol field + getters/setters to common config. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/client/sync/SyncIoTConsensusV2ServiceClient.java | Passes ssl_protocol into internal SSL transport creation. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/client/sync/SyncDataNodeMPPDataExchangeServiceClient.java | Passes ssl_protocol into internal SSL transport creation. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/client/sync/SyncDataNodeInternalServiceClient.java | Passes ssl_protocol into internal SSL transport creation. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/client/sync/SyncConfigNodeIServiceClient.java | Passes ssl_protocol into internal SSL transport creation. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/client/sync/SyncAINodeClient.java | Passes ssl_protocol into internal SSL transport creation. |
| iotdb-core/node-commons/src/assembly/resources/conf/iotdb-system.properties.template | Documents and adds ssl_protocol configuration key. |
| iotdb-core/datanode/src/main/java/org/apache/iotdb/db/protocol/client/ConfigNodeClient.java | Threads ssl_protocol into DataNode→ConfigNode SSL Thrift connection. |
| iotdb-core/datanode/src/main/java/org/apache/iotdb/db/protocol/client/an/AINodeClient.java | Threads ssl_protocol into DataNode→AINode SSL Thrift connection. |
| iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/rest/IoTDBRestServiceDescriptor.java | Loads/normalizes ssl_protocol for REST service config. |
| iotdb-core/datanode/src/main/java/org/apache/iotdb/db/conf/rest/IoTDBRestServiceConfig.java | Adds sslProtocol field + getters/setters for REST config. |
| iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/ratis/utils/Utils.java | Reuses RpcSslUtils for key/trust manager creation for Ratis gRPC TLS. |
| iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/client/SyncIoTConsensusServiceClient.java | Passes ssl_protocol into IoT consensus SSL transport creation. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/ThriftConnection.java | Adds sslProtocol argument and passes it into SSL transport factory. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/TableSessionBuilder.java | Adds sslProtocol(...) builder method for table sessions. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/SessionConnection.java | Propagates sslProtocol to SSL transport creation and reconnect paths. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/Session.java | Stores sslProtocol in Session and exposes builder setter. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/pool/TableSessionPoolBuilder.java | Adds sslProtocol(...) builder method for table session pools. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/pool/SessionPool.java | Persists and forwards sslProtocol into created sessions and node suppliers. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/NodesSupplier.java | Threads sslProtocol into background node-availability connection checks. |
| iotdb-client/session/src/main/java/org/apache/iotdb/session/AbstractSessionBuilder.java | Adds sslProtocol field with default. |
| iotdb-client/service-rpc/src/test/java/org/apache/iotdb/rpc/RpcUtilsTest.java | Adds tests for TLS protocol normalization/validation. |
| iotdb-client/service-rpc/src/main/java/org/apache/iotdb/rpc/RpcSslUtils.java | Introduces shared SSL utility for protocol normalization, store loading, managers, and Thrift SSL params. |
| iotdb-client/service-rpc/src/main/java/org/apache/iotdb/rpc/BaseRpcTransportFactory.java | Adds SSL-transport creation overloads that accept sslProtocol and uses RpcSslUtils. |
| iotdb-client/jdbc/src/test/java/org/apache/iotdb/jdbc/UtilsTest.java | Adds JDBC URL parsing test for ssl_protocol. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/Utils.java | Parses JDBC ssl_protocol into connection params. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/IoTDBConnectionParams.java | Adds sslProtocol field + getters/setters with default. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/IoTDBConnection.java | Passes sslProtocol to SSL transport creation. |
| iotdb-client/jdbc/src/main/java/org/apache/iotdb/jdbc/Config.java | Adds JDBC property key ssl_protocol and default. |
| iotdb-client/isession/src/main/java/org/apache/iotdb/isession/SessionConfig.java | Adds DEFAULT_SSL_PROTOCOL. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/ImportSchemaTree.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/ImportSchemaTable.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/ExportSchemaTree.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/ExportSchemaTable.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/schema/AbstractSchemaTool.java | Adds sslProtocol CLI arg parsing + helper methods to apply SSL settings to builders. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ImportDataTree.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ImportDataTable.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ExportDataTree.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ExportDataTable.java | Reuses shared CLI SSL configuration helper. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/AbstractDataTool.java | Adds sslProtocol CLI arg parsing + helper methods to apply SSL settings to builders. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/OptionsUtil.java | Adds CLI option for ssl_protocol. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/Constants.java | Defines CLI constants for ssl_protocol. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/cli/Cli.java | Includes ssl_protocol property when constructing connection properties. |
| iotdb-client/cli/src/main/java/org/apache/iotdb/cli/AbstractCli.java | Adds CLI option parsing/support for ssl_protocol. |
| integration-test/src/test/java/org/apache/iotdb/session/it/IoTDBClientSSLIT.java | Adds IT verifying SSL-only Thrift port behavior and SSL Session/TableSession/JDBC connectivity. |
| integration-test/src/main/java/org/apache/iotdb/itbase/env/CommonConfig.java | Extends IT CommonConfig with Thrift SSL enablement and sslProtocol setter. |
| integration-test/src/main/java/org/apache/iotdb/it/env/remote/config/RemoteCommonConfig.java | Adds no-op implementations for new SSL-related setters in remote env config. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/env/AbstractEnv.java | Makes env-created JDBC/Sessions/Pools SSL-aware when Thrift client SSL is enabled. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppSharedCommonConfig.java | Propagates new SSL-related settings across CN/DN shared test config. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppCommonConfig.java | Persists enable_thrift_ssl and ssl_protocol into test node properties. |
| integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppBaseConfig.java | Exposes getProperty(key, defaultValue) for env SSL property reads. |
| external-service-impl/rest/src/main/java/org/apache/iotdb/rest/RestService.java | Applies normalized TLS protocol configuration to Jetty HTTPS setup. |
| external-service-impl/rest/pom.xml | Cleans up redundant exclusions related to jakarta.annotation-api. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR generalizes IoTDB SSL/TLS handling around the existing thrift SSL switches and wires the selected SSL protocol through the client, service, REST, and consensus paths.
Changes include:
RpcSslUtilshelper for TLS protocol normalization, thrift SSL transport parameter creation,SSLContext/key manager/trust manager creation, keystore/truststore type detection, and certificate validation.ssl_protocolconfiguration with defaultTLS, load it from common and REST configs, and apply it to thrift SSL services, internal SSL clients, REST HTTPS, and Ratis certificate loading.IoTDBClientSSLITto verify that non-SSL clients cannot connect to an SSL thrift port and that SSL Session, TableSession, and JDBC clients can connect and execute basic read/write flows.Validation
./mvnw spotless:apply -pl iotdb-client/service-rpc,iotdb-core/node-commons./mvnw -pl iotdb-client/service-rpc,iotdb-client/isession,iotdb-client/session,iotdb-client/jdbc,iotdb-client/cli,iotdb-core/node-commons -DskipTests compile./mvnw -pl iotdb-client/jdbc -Dtest=UtilsTest#testParseSslConfig testmvn spotless:apply -pl integration-test -P with-integration-testsmvn verify -DskipUTs -Dit.test=IoTDBClientSSLIT -DfailIfNoTests=false -Dfailsafe.failIfNoSpecifiedTests=false -pl integration-test -am -P with-integration-testsgit diff --check