feat(tls): add custom CA certificate support for TLSContext (alibaba#1529)

Add set_ca_cert() and set_ca_file() to TLSContext, allowing each HTTP
client to specify custom CA certificates for peer verification,
equivalent to curl's --cacert / --capath options.

Changes:
- tls-stream.h: add set_ca_cert(const char*) and set_ca_file(const char*,
  const char*) pure virtual methods to TLSContext interface
- tls-stream.cpp: implement both methods using OpenSSL X509_STORE and
  SSL_CTX_load_verify_locations; add missing #include <openssl/pem.h>;
  add null check for set_ca_cert(nullptr)
- client.h: document that HTTP clients within the same std::thread share
  TLS config and connection pool

Author: Moonpuck

net/http/client.h

@@ -204,7 +204,9 @@ class Client : public Object {
     std::vector<IPAddr> m_bind_ips;
 };
 
-//A Client without cookie_jar would ignore all response-header "Set-Cookies"
+// Create an HTTP client. Without cookie_jar, "Set-Cookies" headers are ignored.
+// Note: HTTP clients within the same std::thread share TLS config and connection pool.
+// Use separate std::threads for different TLS configurations.
 Client* new_http_client(ICookieJar *cookie_jar = nullptr, TLSContext *tls_ctx = nullptr);
 
 ICookieJar* new_simple_cookie_jar();

net/http/test/client_tls_test.cpp

@@ -16,6 +16,8 @@ limitations under the License.
 
 #include <openssl/ssl.h>
 
+#include <thread>
+
 #include <photon/photon.h>
 #include <photon/common/alog.h>
 #include <photon/common/alog-stdstring.h>
@@ -29,6 +31,7 @@ limitations under the License.
 #include "to_url.h"
 
 #include "../../test/cert-key.cpp"
+#include "../../security-context/test/test_cert_utils.h"
 
 using namespace photon;
 
@@ -98,6 +101,140 @@ TEST(http_client, DISABLED_SNI) {
 }
 #endif
 
+// HTTP-level test: verify set_ca_cert works through the HTTP client.
+// Must run in a separate std::thread because the thread_local PooledDialer
+// caches the TLS context from previous tests; reusing it after the context
+// is freed would be a use-after-free.
+TEST(client_tls, http_with_ca_cert) {
+    // Server: TLS + HTTP, using self-signed cert
+    auto server_ctx = net::new_tls_context(cert_str, key_str, passphrase_str);
+    DEFER(delete server_ctx);
+    auto tcpserver = net::new_tls_server(server_ctx, net::new_tcp_socket_server(), true);
+    DEFER(delete tcpserver);
+    tcpserver->timeout(1000UL * 1000);
+    ASSERT_EQ(0, tcpserver->bind_v4localhost());
+    tcpserver->listen();
+
+    auto server = net::http::new_http_server();
+    DEFER(delete server);
+    server->add_handler({nullptr, &idiot_handler});
+    tcpserver->set_handler(server->get_connection_handler());
+    tcpserver->start_loop();
+
+    auto port = tcpserver->getsockname().port;
+    int client_result = -1;
+    int status_code = 0;
+    std::string test_handle;
+    photon::semaphore sem;
+
+    std::thread t([&, port] {
+        photon::init(photon::INIT_EVENT_DEFAULT, photon::INIT_IO_NONE);
+        DEFER(photon::fini());
+
+        // Client: separate TLSContext, load server's cert as CA
+        auto client_ctx = net::new_tls_context();
+        DEFER(delete client_ctx);
+        if (client_ctx->set_ca_cert(cert_str) != 0) {
+            sem.signal(1);
+            return;
+        }
+
+        auto client = net::http::new_http_client(nullptr, client_ctx);
+        DEFER(delete client);
+
+        auto url = estring().appends("https://localhost:", port, "/test");
+        auto op = client->new_operation(net::http::Verb::GET, url);
+        DEFER(client->destroy_operation(op));
+        op->req.headers.range(0, 19);
+        client_result = op->call();
+        if (client_result == 0) {
+            status_code = op->resp.status_code();
+            test_handle = std::string(op->resp.headers["Test_Handle"]);
+        }
+        sem.signal(1);
+    });
+    t.detach();
+    sem.wait(1);
+
+    ASSERT_EQ(0, client_result);
+    EXPECT_EQ(200, status_code);
+    EXPECT_EQ("test", test_handle);
+}
+
+// Verify HTTP clients with different CA configs are isolated across OS threads.
+// Each client runs in its own std::thread to get an independent PooledDialer,
+// avoiding use-after-free on the thread_local dialer's cached TLS context.
+TEST(client_tls, http_client_cross_thread_isolation) {
+    auto server_ctx = net::new_tls_context(cert_str, key_str, passphrase_str);
+    DEFER(delete server_ctx);
+    auto tcpserver = net::new_tls_server(server_ctx, net::new_tcp_socket_server(), true);
+    DEFER(delete tcpserver);
+    tcpserver->timeout(1000UL * 1000);
+    ASSERT_EQ(0, tcpserver->bind_v4localhost());
+    tcpserver->listen();
+
+    auto server = net::http::new_http_server();
+    DEFER(delete server);
+    server->add_handler({nullptr, &idiot_handler});
+    tcpserver->set_handler(server->get_connection_handler());
+    tcpserver->start_loop();
+
+    auto port = tcpserver->getsockname().port;
+
+    // Client A with correct CA (separate thread for fresh PooledDialer)
+    int thread_a_result = -1;
+    int thread_a_status = 0;
+    photon::semaphore sem_a;
+    std::thread ta([&, port] {
+        photon::init(photon::INIT_EVENT_DEFAULT, photon::INIT_IO_NONE);
+        DEFER(photon::fini());
+
+        auto ctx_a = net::new_tls_context();
+        DEFER(delete ctx_a);
+        ctx_a->set_ca_cert(cert_str);
+        auto client_a = net::http::new_http_client(nullptr, ctx_a);
+        DEFER(delete client_a);
+
+        auto url = estring().appends("https://127.0.0.1:", port, "/test");
+        auto op = client_a->new_operation(net::http::Verb::GET, url);
+        DEFER(client_a->destroy_operation(op));
+        op->retry = 0;
+        thread_a_result = op->call();
+        if (thread_a_result == 0)
+            thread_a_status = op->resp.status_code();
+        sem_a.signal(1);
+    });
+    ta.detach();
+    sem_a.wait(1);
+    ASSERT_EQ(0, thread_a_result);
+    EXPECT_EQ(200, thread_a_status);
+
+    // Client B with wrong CA (separate thread)
+    auto wrong_ca_pem = generate_different_self_signed_cert();
+    int thread_b_result = 0;
+    photon::semaphore sem_b;
+    std::thread tb([&, port] {
+        photon::init(photon::INIT_EVENT_DEFAULT, photon::INIT_IO_NONE);
+        DEFER(photon::fini());
+
+        auto ctx_b = net::new_tls_context();
+        DEFER(delete ctx_b);
+        ctx_b->set_ca_cert(wrong_ca_pem.c_str());
+        auto client_b = net::http::new_http_client(nullptr, ctx_b);
+        DEFER(delete client_b);
+
+        auto url = estring().appends("https://127.0.0.1:", port, "/test");
+        auto op = client_b->new_operation(net::http::Verb::GET, url);
+        DEFER(client_b->destroy_operation(op));
+        op->retry = 0;
+        thread_b_result = op->call();
+        sem_b.signal(1);
+    });
+    tb.detach();
+    sem_b.wait(1);
+    EXPECT_NE(0, thread_b_result);
+}
+
 int main(int argc, char** arg) {
     LOG_DEBUG("Begin test");
     if (photon::init(photon::INIT_EVENT_DEFAULT, photon::INIT_IO_NONE))