[improve][client] Add TLSv1.3 support #529
Open
+183
−1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #172
Motivation
We've met this issue with a customer, whose network does deep packet inspection and somehow prevents TLSv1.2 connections to successfully do handshake. Other clients such as Java/Rust works just fine as they are able to connect with TLSv1.3. Since TLSv1.2 usage is hardcoded in CPP client (and by extension Python client), pulsar connection was no longer possible from there. I've opened a PR and would be happy to get it evaluated to be incorporated in
pulsar-client(we use python package).Modifications
The asio SSL context is now constructed with
ASIO::ssl::context::sslv23_clientinstead ofASIO::ssl::context::tlsv12_client, and withdefault_workarounds | no_sslv2 | no_sslv3 |no_tlsv1 | no_tlsv1_1options, which excludes unsafe versions and leaves only TLSv1.2 and TLSv1.3. I've tested this connection on the network and it worked fine.Verifying this change
This change added tests and can be verified as follows:
TlsNegotiationTest.cc) that will build a mock server that will either accept only TLSv1.2 and TLSv1.3Documentation
doc-required(Your PR needs to update docs and you will update later)
doc-not-neededThe change is transparent to user. It will enable the clients to be able to use TLSv1.3 automatically.
doc(Your PR contains doc changes)
doc-complete(Docs have been already added)