Support Thrift client mutual TLS (#18026)

Author: HTHou

integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppCommonConfig.java

@@ -632,6 +632,12 @@ public CommonConfig setEnableThriftClientSSL(boolean enableThriftClientSSL) {
     return this;
   }
 
+  @Override
+  public CommonConfig setThriftSSLClientAuth(boolean thriftSSLClientAuth) {
+    setProperty("thrift_ssl_client_auth", String.valueOf(thriftSSLClientAuth));
+    return this;
+  }
+
   @Override
   public CommonConfig setEnableInternalSSL(boolean enableInternalSSL) {
     setProperty("enable_internal_ssl", String.valueOf(enableInternalSSL));

integration-test/src/main/java/org/apache/iotdb/it/env/cluster/config/MppSharedCommonConfig.java

@@ -658,6 +658,13 @@ public CommonConfig setEnableThriftClientSSL(boolean enableThriftClientSSL) {
     return this;
   }
 
+  @Override
+  public CommonConfig setThriftSSLClientAuth(boolean thriftSSLClientAuth) {
+    cnConfig.setThriftSSLClientAuth(thriftSSLClientAuth);
+    dnConfig.setThriftSSLClientAuth(thriftSSLClientAuth);
+    return this;
+  }
+
   @Override
   public CommonConfig setEnableInternalSSL(boolean enableInternalSSL) {
     cnConfig.setEnableInternalSSL(enableInternalSSL);

integration-test/src/main/java/org/apache/iotdb/it/env/cluster/env/AbstractEnv.java

@@ -692,6 +692,10 @@ private boolean isThriftClientSSLEnabled() {
     return Boolean.parseBoolean(getDataNodeCommonConfigProperty("enable_thrift_ssl", "false"));
   }
 
+  private boolean isThriftSSLClientAuthEnabled() {
+    return Boolean.parseBoolean(getDataNodeCommonConfigProperty("thrift_ssl_client_auth", "false"));
+  }
+
   private String getDataNodeCommonConfigProperty(final String key, final String defaultValue) {
     return ((MppCommonConfig) clusterConfig.getDataNodeCommonConfig())
         .getProperty(key, defaultValue);
@@ -711,6 +715,11 @@ private Properties constructConnectionProperties(
       putIfPresent(
           info, Config.TRUST_STORE_PWD, getDataNodeCommonConfigProperty("trust_store_pwd", ""));
       putIfPresent(info, Config.SSL_PROTOCOL, getClientSSLProtocol());
+      if (isThriftSSLClientAuthEnabled()) {
+        putIfPresent(info, Config.KEY_STORE, getDataNodeCommonConfigProperty("key_store_path", ""));
+        putIfPresent(
+            info, Config.KEY_STORE_PWD, getDataNodeCommonConfigProperty("key_store_pwd", ""));
+      }
     }
     return info;
   }
@@ -728,6 +737,11 @@ private Session.Builder configureClientSSL(final Session.Builder builder) {
           .trustStore(getDataNodeCommonConfigProperty("trust_store_path", ""))
           .trustStorePwd(getDataNodeCommonConfigProperty("trust_store_pwd", ""))
           .sslProtocol(getClientSSLProtocol());
+      if (isThriftSSLClientAuthEnabled()) {
+        builder
+            .keyStore(getDataNodeCommonConfigProperty("key_store_path", ""))
+            .keyStorePwd(getDataNodeCommonConfigProperty("key_store_pwd", ""));
+      }
     }
     return builder;
   }
@@ -739,6 +753,11 @@ private TableSessionBuilder configureClientSSL(final TableSessionBuilder builder
           .trustStore(getDataNodeCommonConfigProperty("trust_store_path", ""))
           .trustStorePwd(getDataNodeCommonConfigProperty("trust_store_pwd", ""))
           .sslProtocol(getClientSSLProtocol());
+      if (isThriftSSLClientAuthEnabled()) {
+        builder
+            .keyStore(getDataNodeCommonConfigProperty("key_store_path", ""))
+            .keyStorePwd(getDataNodeCommonConfigProperty("key_store_pwd", ""));
+      }
     }
     return builder;
   }
@@ -750,6 +769,11 @@ private SessionPool.Builder configureClientSSL(final SessionPool.Builder builder
           .trustStore(getDataNodeCommonConfigProperty("trust_store_path", ""))
           .trustStorePwd(getDataNodeCommonConfigProperty("trust_store_pwd", ""))
           .sslProtocol(getClientSSLProtocol());
+      if (isThriftSSLClientAuthEnabled()) {
+        builder
+            .keyStore(getDataNodeCommonConfigProperty("key_store_path", ""))
+            .keyStorePwd(getDataNodeCommonConfigProperty("key_store_pwd", ""));
+      }
     }
     return builder;
   }
@@ -761,6 +785,11 @@ private TableSessionPoolBuilder configureClientSSL(final TableSessionPoolBuilder
           .trustStore(getDataNodeCommonConfigProperty("trust_store_path", ""))
           .trustStorePwd(getDataNodeCommonConfigProperty("trust_store_pwd", ""))
           .sslProtocol(getClientSSLProtocol());
+      if (isThriftSSLClientAuthEnabled()) {
+        builder
+            .keyStore(getDataNodeCommonConfigProperty("key_store_path", ""))
+            .keyStorePwd(getDataNodeCommonConfigProperty("key_store_pwd", ""));
+      }
     }
     return builder;
   }

integration-test/src/main/java/org/apache/iotdb/it/env/remote/config/RemoteCommonConfig.java

@@ -447,6 +447,11 @@ public CommonConfig setEnableThriftClientSSL(boolean enableThriftClientSSL) {
     return this;
   }
 
+  @Override
+  public CommonConfig setThriftSSLClientAuth(boolean thriftSSLClientAuth) {
+    return this;
+  }
+
   @Override
   public CommonConfig setSubscriptionPrefetchTsFileBatchMaxDelayInMs(
       int subscriptionPrefetchTsFileBatchMaxDelayInMs) {

integration-test/src/main/java/org/apache/iotdb/itbase/env/CommonConfig.java

@@ -203,6 +203,8 @@ default CommonConfig setDefaultDatabaseLevel(int defaultDatabaseLevel) {
 
   CommonConfig setEnableThriftClientSSL(boolean enableThriftClientSSL);
 
+  CommonConfig setThriftSSLClientAuth(boolean thriftSSLClientAuth);
+
   CommonConfig setEnableInternalSSL(boolean enableInternalSSL);
 
   CommonConfig setKeyStorePath(String keyStorePath);