Feature/session cpp ntls

.github/scripts/package-client-cpp-manylinux228.sh

@@ -73,10 +73,10 @@ java -version
 
 # manylinux_2_28 is AlmaLinux 8, whose system OpenSSL is 1.1.1 (EOL and not
 # Apache-2.0 - must not be bundled/redistributed in an ASF convenience binary).
-# Build OpenSSL 3.x from source instead (-Diotdb.openssl.from.source=ON), which
-# keeps the glibc 2.28 baseline. OpenSSL 3.x's Configure needs perl plus a few
-# modules (IPC::Cmd, Data::Dumper) that are not on the minimal image - install
-# them even when perl itself is already present.
+# A pinned Tongsuo 8.4-stable commit is always built from source (WITH_SSL=ON), which keeps the
+# glibc 2.28 baseline. Tongsuo's Configure needs perl plus a
+# few modules (IPC::Cmd, Data::Dumper) that are not on the minimal image -
+# install them even when perl itself is already present.
 if command -v dnf >/dev/null 2>&1; then
   dnf install -y perl perl-IPC-Cmd perl-Data-Dumper
 else
@@ -86,7 +86,6 @@ fi
 cd "${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is not set}"
 ./mvnw clean package -P with-cpp -pl iotdb-client/client-cpp -am -DskipTests \
   -Dspotless.skip=true \
-  -Diotdb.openssl.from.source=ON \
   -Dclient.cpp.package.classifier="${PACKAGE_CLASSIFIER}"
 
 SO="iotdb-client/client-cpp/target/install/lib/libiotdb_session.so"

.github/workflows/client-cpp-package.yml

@@ -309,14 +309,12 @@ jobs:
         shell: bash
         run: |
           set -euxo pipefail
-          # Pin openssl@3 (Apache-2.0): the default 'openssl' formula will move to
-          # OpenSSL 4.0, which drops the legacy TLS-method APIs Thrift still uses.
-          brew install boost openssl@3 llvm@17 bison
+          # Build Tongsuo from source for SSL/TLS (国密 / TLCP support).
+          brew install boost llvm@17 bison perl
           ln -sf "$(brew --prefix llvm@17)/bin/clang-format" "$(brew --prefix)/bin/clang-format"
           echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"
           echo "$(brew --prefix llvm@17)/bin" >> "$GITHUB_PATH"
-          # Homebrew OpenSSL is keg-only, so point find_package(OpenSSL) at it.
-          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
+          echo "$(brew --prefix perl)/bin" >> "$GITHUB_PATH"
           clang-format --version
           bison --version
       - name: Cache Maven packages
@@ -420,6 +418,7 @@ jobs:
         shell: pwsh
         run: |
           choco install winflexbison3 -y --no-progress
+          choco install strawberryperl -y --no-progress
           $boostArgs = @('install', '${{ matrix.boost_choco }}', '-y', '--no-progress')
           if ('${{ matrix.boost_choco_version }}' -ne '') {
             $boostArgs += @("--version=${{ matrix.boost_choco_version }}")
@@ -433,18 +432,7 @@ jobs:
             throw "Boost not found under C:\local after installing ${{ matrix.boost_choco }}"
           }
           echo $boostDir.FullName >> $env:GITHUB_PATH
-          # Use a pinned OpenSSL 3.x (Apache-2.0). 'choco install openssl' now
-          # installs OpenSSL 4.0, which removed the legacy TLS-method APIs that
-          # Apache Thrift's TSSLSocket still calls. The FireDaemon zip is a clean
-          # prebuilt OpenSSL 3.5.x that keeps them.
-          $sslZip = "$env:RUNNER_TEMP\openssl-3.5.3.zip"
-          $sslDir = "$env:RUNNER_TEMP\openssl-3"
-          curl.exe -L --fail --retry 3 -o $sslZip 'https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.3.zip'
-          Expand-Archive -Path $sslZip -DestinationPath $sslDir -Force
-          $sslPath = (Get-ChildItem $sslDir -Recurse -Directory -Filter 'x64' | Select-Object -First 1).FullName
-          if (-not $sslPath) { throw "OpenSSL x64 dir not found under $sslDir" }
-          echo "$sslPath\bin" >> $env:GITHUB_PATH
-          echo "OPENSSL_ROOT_DIR=$sslPath" >> $env:GITHUB_ENV
+          echo "C:\strawberry\perl\bin" >> $env:GITHUB_PATH
       - name: Cache Maven packages
         uses: actions/cache@v5
         with:
@@ -459,6 +447,12 @@ jobs:
           PACKAGE_CLASSIFIER: ${{ matrix.package_classifier }}
         run: |
           set -euxo pipefail
+          # Git Bash perl lacks modules for Tongsuo Configure; Strawberry is installed above.
+          if [ -d /c/Strawberry/perl/bin ]; then
+            export PATH="/c/Strawberry/perl/bin:${PATH}"
+          fi
+          which perl
+          perl -MLocale::Maketext::Simple -e1
           MVN_ARGS=(./mvnw clean package -P with-cpp -pl iotdb-client/client-cpp -am -DskipTests \
             -Dspotless.skip=true \
             "-Dclient.cpp.package.classifier=${PACKAGE_CLASSIFIER}")

.github/workflows/multi-language-client.yml

@@ -124,7 +124,7 @@ jobs:
         run: |
           set -euxo pipefail
           sudo apt-get update
-          sudo apt-get install -y libboost-all-dev openssl libssl-dev wget
+          sudo apt-get install -y libboost-all-dev perl wget
           # jammy (22.04): no clang-format-17 in default repos — use apt.llvm.org (same LLVM 17 as noble/choco/brew)
           . /etc/os-release
           if [[ "${VERSION_CODENAME}" == "jammy" ]]; then
@@ -144,13 +144,12 @@ jobs:
         if: runner.os == 'macOS'
         shell: bash
         run: |
-          # Pin openssl@3 (Apache-2.0); the default formula will move to OpenSSL 4.0.
-          brew install boost openssl@3 llvm@17 bison
+          # Build Tongsuo from source for SSL/TLS (国密 / TLCP support).
+          brew install boost llvm@17 bison perl
           ln -sf "$(brew --prefix llvm@17)/bin/clang-format" "$(brew --prefix)/bin/clang-format"
           echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"
           echo "$(brew --prefix llvm@17)/bin" >> "$GITHUB_PATH"
-          # Homebrew OpenSSL is keg-only, so point find_package(OpenSSL) at it.
-          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
+          echo "$(brew --prefix perl)/bin" >> "$GITHUB_PATH"
           clang-format --version
           bison --version
           sudo rm -rf /Applications/Xcode_14.3.1.app
@@ -163,19 +162,10 @@ jobs:
         run: |
           choco install winflexbison3 -y
           choco install boost-msvc-14.3 -y
+          choco install strawberryperl -y
           $boost_path = (Get-ChildItem -Path 'C:\local\' -Filter 'boost_*').FullName
           echo $boost_path >> $env:GITHUB_PATH
-
-          # Pinned OpenSSL 3.x (Apache-2.0): 'choco install openssl' now installs
-          # OpenSSL 4.0, which removed the legacy TLS-method APIs Thrift uses.
-          $sslZip = "$env:RUNNER_TEMP\openssl-3.5.3.zip"
-          $sslDir = "$env:RUNNER_TEMP\openssl-3"
-          curl.exe -L --fail --retry 3 -o $sslZip 'https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.3.zip'
-          Expand-Archive -Path $sslZip -DestinationPath $sslDir -Force
-          $sslPath = (Get-ChildItem $sslDir -Recurse -Directory -Filter 'x64' | Select-Object -First 1).FullName
-          if (-not $sslPath) { throw "OpenSSL x64 dir not found under $sslDir" }
-          echo "$sslPath\bin" >> $env:GITHUB_PATH
-          echo "OPENSSL_ROOT_DIR=$sslPath" >> $env:GITHUB_ENV
+          echo "C:\strawberry\perl\bin" >> $env:GITHUB_PATH
           choco install llvm --version=17.0.6 --force -y
           clang-format --version
       - name: Cache Maven packages
@@ -197,8 +187,12 @@ jobs:
         # Explicitly using "install" instead of package in order to be sure we're using libs built on this machine
         # (was causing problems on windows, but could cause problem on linux, when updating the thrift module)
         run: |
+          if [ "${{ runner.os }}" = "Windows" ] && [ -d /c/Strawberry/perl/bin ]; then
+            export PATH="/c/Strawberry/perl/bin:${PATH}"
+          fi
           if [[ "${{ matrix.os }}" == "windows-2025-vs2026" ]]; then
-            ./mvnw clean verify -P with-cpp -pl iotdb-client/client-cpp -am -Dcmake.generator="Visual Studio 18 2026"
+            ./mvnw clean verify -P with-cpp -pl iotdb-client/client-cpp -am \
+              -Dcmake.generator="Visual Studio 18 2026"
           else
             ./mvnw clean verify -P with-cpp -pl iotdb-client/client-cpp -am
           fi

LICENSE-binary

@@ -246,6 +246,7 @@ io.dropwizard.metrics:metrics-core:4.2.19
 io.dropwizard.metrics:metrics-jvm:3.2.2
 com.librato.metrics:metrics-librato:5.1.0
 com.github.moquette-io.moquette:moquette-broker:0.18
+GmSSL:GmSSL:3.2.x (optional C++ NTLS provider)
 io.netty:netty-buffer:4.1.137.Final
 io.netty:netty-codec:4.1.137.Final
 io.netty:netty-codec-http:4.1.137.Final
@@ -261,6 +262,7 @@ org.osgi:org.osgi.core:7.0.0
 org.osgi:osgi.cmpn:7.0.0
 org.ops4j.pax.jdbc:pax-jdbc-common:1.5.6
 org.xerial.snappy:snappy-java:1.1.10.5
+Tongsuo:Tongsuo:8.4-stable commit 0aed892c (default C++ NTLS provider)
 io.airlift.airline:0.9
 
 

iotdb-client/client-cpp/CMakeLists.txt

@@ -78,7 +78,7 @@ if(NOT MSVC)
     file(WRITE "${_iotdb_cxx11_abi_stamp}" "${_iotdb_cxx11_abi_stamp_value}")
 endif()
 
-option(WITH_SSL "Build with OpenSSL support" ON)
+option(WITH_SSL "Build with SSL/TLS support" ON)
 option(BUILD_TESTING "Build IT test executables" OFF)
 option(IOTDB_OFFLINE "Disable all network access during configure" OFF)
 set(IOTDB_SESSION_VERSION "0.0.0"
@@ -99,6 +99,19 @@ set(BOOST_VERSION "${_iotdb_default_boost_version}"
     CACHE STRING "Boost version used when downloading / unpacking (Thrift build only)")
 set(THRIFT_VERSION "0.24.0"
     CACHE STRING "Apache Thrift version used when downloading / building")
+set(IOTDB_NTLS_PROVIDER "TONGSUO"
+    CACHE STRING "NTLS provider: TONGSUO (default) or GMSSL")
+set_property(CACHE IOTDB_NTLS_PROVIDER PROPERTY STRINGS TONGSUO GMSSL)
+string(TOUPPER "${IOTDB_NTLS_PROVIDER}" IOTDB_NTLS_PROVIDER)
+if(NOT IOTDB_NTLS_PROVIDER MATCHES "^(TONGSUO|GMSSL)$")
+    message(FATAL_ERROR "IOTDB_NTLS_PROVIDER must be TONGSUO or GMSSL")
+endif()
+set(TONGSUO_GIT_REF "0aed892c5f48c9a52d1f5667667ae45156b9cdf4"
+    CACHE STRING "Pinned Tongsuo git commit used when building SSL/TLS from source")
+set(TONGSUO_SHA256 "4bb302df8ff73a89b3483873d10e7b6a4eeb041310b8eabd2be309004a88f8b6"
+    CACHE STRING "SHA-256 of the pinned Tongsuo source archive")
+set(IOTDB_GMSSL_ROOT_DIR ""
+    CACHE PATH "Preinstalled GmSSL 3.2 root (required for the GMSSL provider)")
 
 if(WIN32)
     set(IOTDB_OS_DEPS_DIR "${IOTDB_DEPS_DIR}/windows")
@@ -145,8 +158,8 @@ if(UNIX AND NOT APPLE)
             SOVERSION "${IOTDB_SESSION_SOVERSION}")
 endif()
 
-# When SSL is on we bundle the OpenSSL shared libraries next to libiotdb_session
-# in the package lib/ directory. Give the library an $ORIGIN-relative runtime
+# When SSL is on we bundle the Tongsuo/OpenSSL-compatible shared libraries next to
+# libiotdb_session in the package lib/ directory. Give the library an $ORIGIN-relative runtime
 # search path so the loader finds them without LD_LIBRARY_PATH / install_name
 # tweaks, keeping the SDK self-contained.
 if(WITH_SSL)
@@ -179,6 +192,13 @@ target_include_directories(iotdb_session
             ${THRIFT_INCLUDE_DIR}
             $<$<BOOL:${BOOST_INCLUDE_DIR}>:${BOOST_INCLUDE_DIR}>)
 
+if(WITH_SSL AND IOTDB_NTLS_PROVIDER STREQUAL "TONGSUO")
+    # Homebrew installs Boost and OpenSSL into the same broad include prefix.
+    # Put Tongsuo first so Boost's -I prefix cannot shadow its NTLS headers.
+    set_target_properties(iotdb_session PROPERTIES NO_SYSTEM_FROM_IMPORTED ON)
+    target_include_directories(iotdb_session BEFORE PRIVATE "${OPENSSL_INCLUDE_DIR}")
+endif()
+
 if(APPLE)
     target_link_libraries(iotdb_session PRIVATE "-Wl,-force_load,${THRIFT_STATIC_LIB_PATH}")
 elseif(UNIX AND NOT MSVC)
@@ -194,8 +214,14 @@ else()
 endif()
 
 if(WITH_SSL)
-    target_link_libraries(iotdb_session PUBLIC OpenSSL::SSL OpenSSL::Crypto)
     target_compile_definitions(iotdb_session PUBLIC WITH_SSL=1)
+    if(IOTDB_NTLS_PROVIDER STREQUAL "GMSSL")
+        target_link_libraries(iotdb_session PRIVATE IoTDB::gmssl)
+        target_compile_definitions(iotdb_session PUBLIC IOTDB_NTLS_PROVIDER_GMSSL=1)
+    else()
+        target_link_libraries(iotdb_session PUBLIC OpenSSL::SSL OpenSSL::Crypto)
+        target_compile_definitions(iotdb_session PUBLIC IOTDB_NTLS_PROVIDER_TONGSUO=1)
+    endif()
 else()
     target_compile_definitions(iotdb_session PUBLIC WITH_SSL=0)
 endif()
@@ -217,6 +243,7 @@ include(GNUInstallDirs)
 set(IOTDB_PUBLIC_HEADERS
         Export.h
         SessionConfig.h
+        SslConfig.h
         Session.h
         Common.h
         Optional.h
@@ -240,8 +267,8 @@ install(TARGETS iotdb_session
         LIBRARY DESTINATION lib
         ARCHIVE DESTINATION lib)
 
-# Ship the OpenSSL shared libraries we link against next to iotdb_session so the
-# packaged SDK is self-contained on machines without a system OpenSSL.
+# Ship the Tongsuo shared libraries we link against next to iotdb_session so the
+# packaged SDK is self-contained on machines without a system SSL library.
 if(WITH_SSL)
     iotdb_install_openssl_runtime()
 endif()
@@ -296,6 +323,9 @@ file(WRITE "${CMAKE_BINARY_DIR}/package-metadata/BUILD-INFO.txt"
         "cmake.generator=${CMAKE_GENERATOR}\n"
         "cmake.build.type=${CMAKE_BUILD_TYPE}\n"
         "with.ssl=${WITH_SSL}\n"
+        "ntls.provider=${IOTDB_NTLS_PROVIDER}\n"
+        "tongsuo.git.ref=${TONGSUO_GIT_REF}\n"
+        "tongsuo.sha256=${TONGSUO_SHA256}\n"
         "iotdb.offline=${IOTDB_OFFLINE}\n"
         "iotdb.use.cxx11.abi=${IOTDB_USE_CXX11_ABI}\n"
         "iotdb.extra.cxx.flags=${IOTDB_EXTRA_CXX_FLAGS}\n")
@@ -307,7 +337,6 @@ install(FILES
         "${CMAKE_BINARY_DIR}/package-metadata/VERSION"
         "${CMAKE_BINARY_DIR}/package-metadata/BUILD-INFO.txt"
         DESTINATION .)
-
 if(BUILD_TESTING)
     enable_testing()
     add_subdirectory(test)
@@ -317,6 +346,7 @@ endif()
 
 message(STATUS "iotdb_session configuration summary:")
 message(STATUS "    WITH_SSL              = ${WITH_SSL}")
+message(STATUS "    IOTDB_NTLS_PROVIDER   = ${IOTDB_NTLS_PROVIDER}")
 message(STATUS "    BUILD_TESTING         = ${BUILD_TESTING}")
 message(STATUS "    IOTDB_OFFLINE         = ${IOTDB_OFFLINE}")
 message(STATUS "    IOTDB_USE_CXX11_ABI   = ${IOTDB_USE_CXX11_ABI}")