HTHou commented on code in PR #3600:
URL: https://github.com/apache/thrift/pull/3600#discussion_r3429230077
##########
lib/cpp/test/SecurityTest.cpp:
##########
@@ -226,6 +228,77 @@ struct SecurityFixture
BOOST_FIXTURE_TEST_SUITE(BOOST_TEST_MODULE, SecurityFixture)
+BOOST_AUTO_TEST_CASE(default_ssl_context_options)
+{
+ apache::thrift::transport::SSLContext context;
+ const auto options = SSL_CTX_get_options(context.get());
+
+ if (SSL_OP_NO_SSLv2 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_SSLv2) != 0);
+ }
+ if (SSL_OP_NO_SSLv3 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_SSLv3) != 0);
+ }
+ if (SSL_OP_NO_TLSv1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1) != 0);
+ }
+ if (SSL_OP_NO_TLSv1_1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1_1) != 0);
+ }
+}
+
+BOOST_AUTO_TEST_CASE(custom_ssl_context_options)
+{
+ class CustomSSLContext : public apache::thrift::transport::SSLContext
+ {
+ public:
+ CustomSSLContext() : SSLContext()
+ {
+ SSL_CTX_clear_options(get(), SSL_OP_NO_TLSv1_1);
+ }
+ };
+
+ std::shared_ptr<apache::thrift::transport::SSLContext> context;
+ TSSLSocketFactory factory([&context]() {
+ context = std::make_shared<CustomSSLContext>();
+ return context;
+ });
+ const auto options = SSL_CTX_get_options(context->get());
Review Comment:
Updated in the latest push. `custom_ssl_context_options` now explicitly
resets the captured `SSLContext` before the test exits, so the extra shared
reference is released before `TSSLSocketFactory` reaches its destructor/cleanup
path.
##########
lib/cpp/test/SecurityTest.cpp:
##########
@@ -226,6 +228,77 @@ struct SecurityFixture
BOOST_FIXTURE_TEST_SUITE(BOOST_TEST_MODULE, SecurityFixture)
+BOOST_AUTO_TEST_CASE(default_ssl_context_options)
+{
+ apache::thrift::transport::SSLContext context;
+ const auto options = SSL_CTX_get_options(context.get());
+
+ if (SSL_OP_NO_SSLv2 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_SSLv2) != 0);
+ }
+ if (SSL_OP_NO_SSLv3 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_SSLv3) != 0);
+ }
+ if (SSL_OP_NO_TLSv1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1) != 0);
+ }
+ if (SSL_OP_NO_TLSv1_1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1_1) != 0);
+ }
+}
+
+BOOST_AUTO_TEST_CASE(custom_ssl_context_options)
+{
+ class CustomSSLContext : public apache::thrift::transport::SSLContext
+ {
+ public:
+ CustomSSLContext() : SSLContext()
+ {
+ SSL_CTX_clear_options(get(), SSL_OP_NO_TLSv1_1);
+ }
+ };
+
+ std::shared_ptr<apache::thrift::transport::SSLContext> context;
+ TSSLSocketFactory factory([&context]() {
+ context = std::make_shared<CustomSSLContext>();
+ return context;
+ });
+ const auto options = SSL_CTX_get_options(context->get());
+
+ if (SSL_OP_NO_TLSv1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1) != 0);
+ }
+ if (SSL_OP_NO_TLSv1_1 != 0) {
+ BOOST_CHECK((options & SSL_OP_NO_TLSv1_1) == 0);
+ }
+}
+
+BOOST_AUTO_TEST_CASE(custom_ssl_context_factory_validation)
+{
+ try
+ {
+ SSLContextFactory contextFactory;
+ TSSLSocketFactory factory(contextFactory);
+ BOOST_FAIL("Expected empty SSLContextFactory to throw");
+ }
+ catch (const TSSLException& ex)
+ {
+ BOOST_CHECK_EQUAL("SSLContextFactory must not be empty", ex.what());
+ }
+
+ try
+ {
+ TSSLSocketFactory factory([]() {
+ return std::shared_ptr<apache::thrift::transport::SSLContext>();
+ });
+ BOOST_FAIL("Expected null SSLContextFactory result to throw");
+ }
+ catch (const TSSLException& ex)
+ {
+ BOOST_CHECK_EQUAL("SSLContextFactory must not return null", ex.what());
+ }
Review Comment:
Updated in the latest push. The `TSSLException` message checks now compare
against `std::string(ex.what())`, making the assertions explicit content
comparisons.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
