URL endpoint listener and TLS identities for Linux and Windows - #73
Open
jeffdgr8 wants to merge 4 commits into
Open
URL endpoint listener and TLS identities for Linux and Windows#73jeffdgr8 wants to merge 4 commits into
jeffdgr8 wants to merge 4 commits into
Conversation
The Couchbase Lite C SDK added URL-endpoint-listener and TLS-identity support in 4.x. Replaces the pre-4.x "not supported in CBL C SDK" stubs in the EE linuxMingw source set with real implementations: - TLSIdentity backed by CBLTLSIdentity: DER certificate chains, expiration, and label-based create/get/delete. Windows persists identities via the platform key store; Linux has no standard secure key storage and the C SDK compiles the label-lookup functions out there, so getIdentity/deleteIdentity throw CouchbaseLiteException(UNSUPPORTED) on Linux (new linuxMain and mingwMain actual splits). Certificate attributes are translated from the Java-style attribute names to the C kCBLCertAttrKey keys. - KeyUsage maps to the CBLKeyUsages bitmask - ListenerPasswordAuthenticator and ListenerCertificateAuthenticator via CBLListenerAuth callbacks (StableRef-dispatched delegates; root-cert chains built from concatenated PEM) - ClientCertificateAuthenticator via CBLAuth_CreateCertificate - URLEndpointListenerConfiguration snapshots into the C struct following the ImmutableReplicatorConfiguration pattern - URLEndpointListener: create/start/stop, port, urls, status, tlsIdentity, config MessageEndpoint remains stubbed: the C SDK still has no message-endpoint API. Tests: the common TLSIdentityTest now runs on Windows (still skipped on Linux, where label persistence is genuinely unsupported); a new URLEndpointListenerNativeTest covers config validation, listener lifecycle with password/certificate auth, TLS with explicit and auto-generated anonymous identities, and the Linux unsupported behavior. Verified by compiling and linking the linuxX64/mingwX64 test binaries (test execution requires Linux/Windows hosts); JVM, macOS, and Android are unaffected; apiCheck passes (the stub-era public no-arg TLSIdentity constructor is now internal). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
TLSIdentity.createAnonymousIdentity creates a self-signed, non-persisted identity via CBLTLSIdentity_CreateIdentity with a null label. This is the only way to construct a TLSIdentity on Linux (no secure key storage for alias-based identities, and the C SDK's key-pair-based constructors would require wrapping CBLKeyPair) — without it, ClientCertificateAuthenticator could not be used there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds TLSIdentity.createIdentityWithKeyPairAndCerts, wrapping CBLKeyPair_CreateWithPrivateKeyData (PEM or DER, optional password) and CBLTLSIdentity_IdentityWithKeyPairAndCerts. This is the native platforms' bring-your-own-identity path, giving them parity with the JVM (KeyStore), Apple (importIdentity), and Android (AndroidKeyStore) platforms: a URLEndpointListener can present a CA-signed server certificate and a ClientCertificateAuthenticator can use an issued client certificate, instead of self-signed identities only. The CBLKeyPair and CBLCert types remain unexposed: certificates stay ByteArray, kotbase's cross-platform convention. External-key (HSM/TPM) key pairs via CBLKeyPair_CreateWithExternalKey are left as a possible future addition. Tests use an embedded self-signed PEM fixture (plain and encrypted key) and verify identity creation, listener use, wrong-password failure, and input validation. Verified by compile and link for linuxX64/mingwX64; runtime verification on Linux/Windows CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Remove Defaults.Database.MMAP_ENABLED: the mmap configuration API was removed in CBL 4.0 and the constant no longer has a use - Add isEmpty to ArrayInterface and DictionaryInterface (inherited by Array, Dictionary, Document, and their mutable variants) and Result, matching the Java SDK - Make level and domains public on ConsoleLogSink and CustomLogSink, and logSink public on CustomLogSink, matching the public accessors of the Java and Objective-C SDKs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Couchbase Lite C SDK added URL-endpoint-listener and TLS-identity support in 4.x. Replaces Kotbase's pre-4.x "not supported in CBL C SDK" stubs on Linux and Windows with real implementations:
TLSIdentity: DER certificate chains, expiration, and label-based create/get/delete. Windows persists identities in the CNG Key Storage Provider; Linux has no standard secure key storage and the C SDK compiles the label-lookup functions out there, sogetIdentity/deleteIdentitythrowUNSUPPORTED(honest per-OS behavior, per the header)TLSIdentity.createAnonymousIdentity(new public API, linux/mingw): self-signed, non-persisted identities — the only way to construct an identity on LinuxTLSIdentity.createIdentityWithKeyPairAndCerts(new public API, linux/mingw): CA-issued identities from an existing private key + certificate chain, giving native platforms parity with JVM (KeyStore), Apple (importIdentity), and Android (AndroidKeyStore)URLEndpointListener+ configuration, password and certificate authenticators (C callbacks dispatching to Kotlin delegates), and a realClientCertificateAuthenticatorMessageEndpointremains stubbed (still no C SDK API)Also aligns minor APIs with the 4.1 SDKs: removes the orphaned
Defaults.Database.MMAP_ENABLED, addsisEmptyto Array/Dictionary/Document/Result, and makeslevel/domains/logSinkpublic on the console and custom log sinks.The common
TLSIdentityTestnow runs on Windows; a newURLEndpointListenerNativeTestcovers config validation, listener lifecycle, authenticators, and TLS with anonymous and CA-issued identities. Verified by compiling and linking the linuxX64/mingwX64 test binaries — runtime verification needs the Linux/Windows CI hosts.🤖 Generated with Claude Code