@platformatic/rdkafka 4.0.1 → 4.1.0

package/deps/librdkafka/tests/0097-ssl_verify.cpp

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2019-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -34,6 +35,8 @@
 #include "testcpp.h"
 #include "tinycthread.h"
 
+namespace TestSSLVerify {
+
 static const std::string envname[RdKafka::CERT__CNT][RdKafka::CERT_ENC__CNT] = {
     /* [RdKafka::CERT_PUBLIC_KEY] = */
     {
@@ -117,6 +120,51 @@ class TestVerifyCb : public RdKafka::SslCertificateVerifyCb {
   }
 };
 
+/**
+ * @name Test event callback.
+ */
+class TestEventCb : public RdKafka::EventCb {
+ public:
+  bool should_succeed;
+
+  TestEventCb(bool should_succeed) : should_succeed(should_succeed) {
+  }
+
+  void event_cb(RdKafka::Event &event) {
+    switch (event.type()) {
+    case RdKafka::Event::EVENT_LOG:
+      Test::Say("Log: " + event.str() + "\n");
+      break;
+    case RdKafka::Event::EVENT_ERROR:
+      if (should_succeed)
+        Test::Fail("Unexpected error event, got: " + event.str());
+      else if (event.err() != RdKafka::ERR__SSL &&
+               event.err() != RdKafka::ERR__ALL_BROKERS_DOWN)
+        Test::Fail(
+            "Expected _SSL or _ALL_BROKERS_DOWN error codes"
+            ", got: " +
+            RdKafka::err2str(event.err()));
+      else if (event.err() == RdKafka::ERR__SSL) {
+        bool expected = false;
+        Test::Say("SSL error: " + event.str() + "\n");
+        if (event.str().find("alert number 42") != std::string::npos)
+          /* Verify that certificate isn't sent if not trusted
+           * by the broker. We should receive 42 (bad_certificate)
+           * instead of 46 (certificate_unknown). */
+          expected = true;
+        else if (event.str().find("broker certificate could not be verified") !=
+                 std::string::npos)
+          expected = true;
+
+        if (!expected)
+          Test::Fail("Unexpected SSL error message, got: " + event.str());
+      }
+      break;
+    default:
+      break;
+    }
+  }
+};
 
 /**
  * @brief Set SSL PEM cert/key using configuration property.
@@ -126,36 +174,41 @@ class TestVerifyCb : public RdKafka::SslCertificateVerifyCb {
  * @param loc_prop ssl.X.location property that will be cleared.
  * @param pem_prop ssl.X.pem property that will be set.
  * @param cert_type Certificate type.
+ * @param use_conf_value_file Read the file from existing configuration value,
+ *                            instead of the one in the environment variable.
  */
 static void conf_location_to_pem(RdKafka::Conf *conf,
                                  std::string loc_prop,
                                  std::string pem_prop,
-                                 RdKafka::CertificateType cert_type) {
+                                 RdKafka::CertificateType cert_type,
+                                 bool use_conf_value_file) {
   std::string loc;
 
   std::string errstr;
+  if (use_conf_value_file && conf->get(loc_prop, loc) != RdKafka::Conf::CONF_OK)
+    Test::Fail("Failed to get " + loc_prop);
   if (conf->set(loc_prop, "", errstr) != RdKafka::Conf::CONF_OK)
     Test::Fail("Failed to reset " + loc_prop + ": " + errstr);
 
-  const char *p;
-  p = test_getenv(envname[cert_type][RdKafka::CERT_ENC_PEM].c_str(), NULL);
-  if (!p)
-    Test::Fail(
-        "Invalid test environment: "
-        "Missing " +
-        envname[cert_type][RdKafka::CERT_ENC_PEM] +
-        " env variable: make sure trivup is up to date");
-
-  loc = p;
-
+  if (!use_conf_value_file) {
+    const char *p;
+    p = test_getenv(envname[cert_type][RdKafka::CERT_ENC_PEM].c_str(), NULL);
+    if (!p)
+      Test::Fail(
+          "Invalid test environment: "
+          "Missing " +
+          envname[cert_type][RdKafka::CERT_ENC_PEM] +
+          " env variable: make sure trivup is up to date");
+
+    loc = p;
+  }
 
   /* Read file */
   std::ifstream ifs(loc.c_str());
   std::string pem((std::istreambuf_iterator<char>(ifs)),
                   std::istreambuf_iterator<char>());
 
-  Test::Say("Read env " + envname[cert_type][RdKafka::CERT_ENC_PEM] + "=" +
-            loc + " from disk and changed to in-memory " + pem_prop +
+  Test::Say("Read " + loc + " from disk and changed to in-memory " + pem_prop +
             " string\n");
 
   if (conf->set(pem_prop, pem, errstr) != RdKafka::Conf::CONF_OK)
@@ -172,7 +225,8 @@ static void conf_location_to_pem(RdKafka::Conf *conf,
 static void conf_location_to_setter(RdKafka::Conf *conf,
                                     std::string loc_prop,
                                     RdKafka::CertificateType cert_type,
-                                    RdKafka::CertificateEncoding encoding) {
+                                    RdKafka::CertificateEncoding encoding,
+                                    bool use_conf_value_file) {
   std::string loc;
   static const std::string encnames[] = {
       "PKCS#12",
@@ -182,23 +236,26 @@ static void conf_location_to_setter(RdKafka::Conf *conf,
 
   /* Clear the config property (e.g., ssl.key.location) */
   std::string errstr;
+  if (use_conf_value_file && conf->get(loc_prop, loc) != RdKafka::Conf::CONF_OK)
+    Test::Fail("Failed to get " + loc_prop);
   if (conf->set(loc_prop, "", errstr) != RdKafka::Conf::CONF_OK)
     Test::Fail("Failed to reset " + loc_prop);
 
-  const char *p;
-  p = test_getenv(envname[cert_type][encoding].c_str(), NULL);
-  if (!p)
-    Test::Fail(
-        "Invalid test environment: "
-        "Missing " +
-        envname[cert_type][encoding] +
-        " env variable: make sure trivup is up to date");
-
-  loc = p;
+  if (!use_conf_value_file) {
+    const char *p;
+    p = test_getenv(envname[cert_type][encoding].c_str(), NULL);
+    if (!p)
+      Test::Fail(
+          "Invalid test environment: "
+          "Missing " +
+          envname[cert_type][encoding] +
+          " env variable: make sure trivup is up to date");
+
+    loc = p;
+  }
 
-  Test::Say(tostr() << "Reading " << loc_prop << " file " << loc << " as "
-                    << encnames[encoding] << " from env "
-                    << envname[cert_type][encoding] << "\n");
+  Test::Say(tostr() << "Reading file as " << encnames[encoding] << " from "
+                    << loc << "\n");
 
   /* Read file */
   std::ifstream ifs(loc.c_str(), std::ios::binary | std::ios::ate);
@@ -231,28 +288,111 @@ static const std::string load_names[] = {
     "setter",
 };
 
+static bool is_client_auth_required() {
+  const char *C_client_auth = test_getenv("SSL_client_auth", "required");
+  std::string client_auth(C_client_auth);
+  return client_auth == "required";
+}
 
+/**
+ * @brief Test SSL certificate verification.
+ *
+ * @param line Test line number.
+ * @param verify_ok Expected verification result.
+ * @param untrusted_client_key Set up an untrusted client key.
+ * @param untrusted_client_key_intermediate_ca The untrusted client key is
+ *                                             signed by an intermediate CA.
+ * @param load_key How to load the client key.
+ * @param key_enc Encoding of the client key.
+ * @param load_pub How to load the client public key.
+ * @param pub_enc Encoding of the client public key.
+ * @param load_ca How to load the CA.
+ * @param ca_enc Encoding of the CA.
+ */
 static void do_test_verify(const int line,
                            bool verify_ok,
+                           bool untrusted_client_key,
+                           bool untrusted_client_key_intermediate_ca,
                            cert_load_t load_key,
                            RdKafka::CertificateEncoding key_enc,
                            cert_load_t load_pub,
                            RdKafka::CertificateEncoding pub_enc,
                            cert_load_t load_ca,
                            RdKafka::CertificateEncoding ca_enc) {
+#define TEST_FIXTURES_FOLDER       "./fixtures"
+#define TEST_FIXTURES_SSL_FOLDER   TEST_FIXTURES_FOLDER "/ssl/"
+#define TEST_FIXTURES_KEY_PASSWORD "use_strong_password_keystore_client2"
+
+/* Certificate directly signed by the root CA (untrusted) */
+#define TEST_CERTIFICATE_LOCATION                                              \
+  TEST_FIXTURES_SSL_FOLDER "client2.certificate.pem"
+#define TEST_KEY_LOCATION TEST_FIXTURES_SSL_FOLDER "client2.key"
+
+/* Certificate signed by an intermediate CA (untrusted) */
+#define TEST_CERTIFICATE_INTERMEDIATE_LOCATION                                 \
+  TEST_FIXTURES_SSL_FOLDER "client2.certificate.intermediate.pem"
+#define TEST_KEY_INTERMEDIATE_LOCATION                                         \
+  TEST_FIXTURES_SSL_FOLDER "client2.intermediate.key"
+
+  std::string errstr, existing_key_password;
   /*
    * Create any type of client
    */
-  std::string teststr = tostr() << line << ": "
-                                << "SSL cert verify: verify_ok=" << verify_ok
-                                << ", load_key=" << load_names[load_key]
-                                << ", load_pub=" << load_names[load_pub]
-                                << ", load_ca=" << load_names[load_ca];
+  std::string teststr =
+      tostr() << line << ": " << "SSL cert verify: verify_ok=" << verify_ok
+              << ", untrusted_client_key=" << untrusted_client_key
+              << ", untrusted_client_key_intermediate_ca="
+              << untrusted_client_key_intermediate_ca
+              << ", load_key=" << load_names[load_key]
+              << ", load_pub=" << load_names[load_pub]
+              << ", load_ca=" << load_names[load_ca];
 
   Test::Say(_C_BLU "[ " + teststr + " ]\n" _C_CLR);
 
   RdKafka::Conf *conf;
+  std::string security_protocol;
   Test::conf_init(&conf, NULL, 10);
+  if (conf->get("security.protocol", security_protocol) !=
+      RdKafka::Conf::CONF_OK)
+    Test::Fail("Failed to get security.protocol");
+  /* sasl_ssl endpoints don't require
+   * SSL authentication even when
+   * ssl.client.auth=required */
+  bool should_succeed =
+      verify_ok && (!untrusted_client_key || !is_client_auth_required() ||
+                    security_protocol != "ssl");
+  TestEventCb eventCb(should_succeed);
+
+  if (conf->set("event_cb", &eventCb, errstr) != RdKafka::Conf::CONF_OK)
+    Test::Fail("Failed to set event_cb: " + errstr);
+
+  if (untrusted_client_key) {
+    /* Set an untrusted certificate, signed by a root CA or by an
+     * intermediate CA, and verify client authentication fails. */
+
+    const char *untrusted_key_location = untrusted_client_key_intermediate_ca
+                                             ? TEST_KEY_INTERMEDIATE_LOCATION
+                                             : TEST_KEY_LOCATION;
+    const char *untrusted_certificate_location =
+        untrusted_client_key_intermediate_ca
+            ? TEST_CERTIFICATE_INTERMEDIATE_LOCATION
+            : TEST_CERTIFICATE_LOCATION;
+
+    if (conf->set("ssl.key.location", untrusted_key_location, errstr) !=
+        RdKafka::Conf::CONF_OK)
+      Test::Fail("Failed to set untrusted ssl.key.location: " + errstr);
+
+    if (conf->get("ssl.key.password", existing_key_password) !=
+        RdKafka::Conf::CONF_OK)
+      Test::Fail("Failed to get existing ssl.key.password: " + errstr);
+    if (conf->set("ssl.key.password", TEST_FIXTURES_KEY_PASSWORD, errstr) !=
+        RdKafka::Conf::CONF_OK)
+      Test::Fail("Failed to set untrusted ssl.key.password: " + errstr);
+
+    if (conf->set("ssl.certificate.location", untrusted_certificate_location,
+                  errstr) != RdKafka::Conf::CONF_OK)
+      Test::Fail("Failed to set untrusted ssl.certificate.location: " + errstr);
+  }
 
   std::string val;
   if (conf->get("ssl.key.location", val) != RdKafka::Conf::CONF_OK ||
@@ -266,28 +406,35 @@ static void do_test_verify(const int line,
    * ssl.key.pem. Same with ssl.certificate.location -> ssl.certificate.pem. */
   if (load_key == USE_CONF)
     conf_location_to_pem(conf, "ssl.key.location", "ssl.key.pem",
-                         RdKafka::CERT_PRIVATE_KEY);
+                         RdKafka::CERT_PRIVATE_KEY, true);
   else if (load_key == USE_SETTER)
     conf_location_to_setter(conf, "ssl.key.location", RdKafka::CERT_PRIVATE_KEY,
-                            key_enc);
+                            key_enc, key_enc == RdKafka::CERT_ENC_PEM);
 
   if (load_pub == USE_CONF)
     conf_location_to_pem(conf, "ssl.certificate.location",
-                         "ssl.certificate.pem", RdKafka::CERT_PUBLIC_KEY);
+                         "ssl.certificate.pem", RdKafka::CERT_PUBLIC_KEY, true);
   else if (load_pub == USE_SETTER)
     conf_location_to_setter(conf, "ssl.certificate.location",
-                            RdKafka::CERT_PUBLIC_KEY, pub_enc);
+                            RdKafka::CERT_PUBLIC_KEY, pub_enc,
+                            pub_enc == RdKafka::CERT_ENC_PEM);
+
+  if (untrusted_client_key && ca_enc != RdKafka::CERT_ENC_PEM) {
+    /* Original password is needed for reading the
+     * CA certificate in the PKCS12 keystore. */
+    if (conf->set("ssl.key.password", existing_key_password, errstr) !=
+        RdKafka::Conf::CONF_OK)
+      Test::Fail("Failed to revert to existing ssl.key.password: " + errstr);
+  }
 
   if (load_ca == USE_CONF)
     conf_location_to_pem(conf, "ssl.ca.location", "ssl.ca.pem",
-                         RdKafka::CERT_CA);
+                         RdKafka::CERT_CA, true);
   else if (load_ca == USE_SETTER)
-    conf_location_to_setter(conf, "ssl.ca.location", RdKafka::CERT_CA, ca_enc);
+    conf_location_to_setter(conf, "ssl.ca.location", RdKafka::CERT_CA, ca_enc,
+                            ca_enc == RdKafka::CERT_ENC_PEM);
 
-
-  std::string errstr;
   conf->set("debug", "security", errstr);
-
   TestVerifyCb verifyCb(verify_ok);
   if (conf->set("ssl_cert_verify_cb", &verifyCb, errstr) !=
       RdKafka::Conf::CONF_OK)
@@ -318,9 +465,9 @@ static void do_test_verify(const int line,
    * this test. */
   std::string cluster = p->clusterid(1000);
 
-  if (verify_ok == cluster.empty())
+  if (should_succeed == cluster.empty())
     Test::Fail("Expected connection to " +
-               (std::string)(verify_ok ? "succeed" : "fail") +
+               (std::string)(should_succeed ? "succeed" : "fail") +
                ", but got clusterid '" + cluster + "'");
 
   delete p;
@@ -381,8 +528,27 @@ static void do_test_bad_calls() {
   Test::Say("Producer creation failed expectedly: " + errstr + "\n");
 }
 
+}  // namespace TestSSLVerify
+
+using namespace TestSSLVerify;
+
 extern "C" {
+
+/**
+ * @brief Test SSL certificate verification with various
+ *        key types and trusted or untrusted client certificates.
+ *
+ * @remark This tests can be run with a root CA signed certificate
+ *         when trivup is started with "--ssl" only,
+ *         or with an intermediate CA signed certificate,
+ *         when trivup is started with:
+ *         --conf='{"ssl_intermediate_ca": true}'
+ *         or with "ssl.client.auth=requested" when started with:
+ *         --conf='{"ssl_client_auth": "requested"}'
+ *         or a combination of both.
+ */
 int main_0097_ssl_verify(int argc, char **argv) {
+  int untrusted_client_key, untrusted_client_key_intermediate_ca;
   if (!test_check_builtin("ssl")) {
     Test::Skip("Test requires SSL support\n");
     return 0;
@@ -396,32 +562,58 @@ int main_0097_ssl_verify(int argc, char **argv) {
 
   do_test_bad_calls();
 
-  do_test_verify(__LINE__, true, USE_LOCATION, RdKafka::CERT_ENC_PEM,
-                 USE_LOCATION, RdKafka::CERT_ENC_PEM, USE_LOCATION,
-                 RdKafka::CERT_ENC_PEM);
-  do_test_verify(__LINE__, false, USE_LOCATION, RdKafka::CERT_ENC_PEM,
-                 USE_LOCATION, RdKafka::CERT_ENC_PEM, USE_LOCATION,
-                 RdKafka::CERT_ENC_PEM);
-
-  /* Verify various priv and pub key and CA input formats */
-  do_test_verify(__LINE__, true, USE_CONF, RdKafka::CERT_ENC_PEM, USE_CONF,
-                 RdKafka::CERT_ENC_PEM, USE_LOCATION, RdKafka::CERT_ENC_PEM);
-  do_test_verify(__LINE__, true, USE_CONF, RdKafka::CERT_ENC_PEM, USE_CONF,
-                 RdKafka::CERT_ENC_PEM, USE_CONF, RdKafka::CERT_ENC_PEM);
-  do_test_verify(__LINE__, true, USE_SETTER, RdKafka::CERT_ENC_PEM, USE_SETTER,
-                 RdKafka::CERT_ENC_PEM, USE_SETTER, RdKafka::CERT_ENC_PKCS12);
-  do_test_verify(__LINE__, true, USE_LOCATION, RdKafka::CERT_ENC_PEM,
-                 USE_SETTER, RdKafka::CERT_ENC_DER, USE_SETTER,
-                 RdKafka::CERT_ENC_DER);
-  do_test_verify(__LINE__, true, USE_LOCATION, RdKafka::CERT_ENC_PEM,
-                 USE_SETTER, RdKafka::CERT_ENC_DER, USE_SETTER,
-                 RdKafka::CERT_ENC_PEM); /* env: SSL_all_cas_pem */
-  do_test_verify(__LINE__, true, USE_LOCATION, RdKafka::CERT_ENC_PEM,
-                 USE_SETTER, RdKafka::CERT_ENC_DER, USE_CONF,
-                 RdKafka::CERT_ENC_PEM); /* env: SSL_all_cas_pem */
-  do_test_verify(__LINE__, true, USE_SETTER, RdKafka::CERT_ENC_PKCS12,
-                 USE_SETTER, RdKafka::CERT_ENC_PKCS12, USE_SETTER,
-                 RdKafka::CERT_ENC_PKCS12);
+  for (untrusted_client_key = 0; untrusted_client_key <= 1;
+       untrusted_client_key++) {
+    for (untrusted_client_key_intermediate_ca = 0;
+         untrusted_client_key_intermediate_ca <= untrusted_client_key;
+         untrusted_client_key_intermediate_ca++) {
+      do_test_verify(__LINE__, true /*verify ok*/, untrusted_client_key,
+                     untrusted_client_key_intermediate_ca, USE_LOCATION,
+                     RdKafka::CERT_ENC_PEM, USE_LOCATION, RdKafka::CERT_ENC_PEM,
+                     USE_LOCATION, RdKafka::CERT_ENC_PEM);
+      do_test_verify(__LINE__, false /*verify not ok*/, untrusted_client_key,
+                     untrusted_client_key_intermediate_ca, USE_LOCATION,
+                     RdKafka::CERT_ENC_PEM, USE_LOCATION, RdKafka::CERT_ENC_PEM,
+                     USE_LOCATION, RdKafka::CERT_ENC_PEM);
+
+      /* Verify various priv and pub key and CA input formats */
+      do_test_verify(__LINE__, true /*verify ok*/, untrusted_client_key,
+                     untrusted_client_key_intermediate_ca, USE_CONF,
+                     RdKafka::CERT_ENC_PEM, USE_CONF, RdKafka::CERT_ENC_PEM,
+                     USE_LOCATION, RdKafka::CERT_ENC_PEM);
+      do_test_verify(__LINE__, true /*verify ok*/, untrusted_client_key,
+                     untrusted_client_key_intermediate_ca, USE_CONF,
+                     RdKafka::CERT_ENC_PEM, USE_CONF, RdKafka::CERT_ENC_PEM,
+                     USE_CONF, RdKafka::CERT_ENC_PEM);
+      do_test_verify(__LINE__, true /*verify ok*/, untrusted_client_key,
+                     untrusted_client_key_intermediate_ca, USE_SETTER,
+                     RdKafka::CERT_ENC_PEM, USE_SETTER, RdKafka::CERT_ENC_PEM,
+                     USE_SETTER, RdKafka::CERT_ENC_PKCS12);
+    }
+  }
+
+  if (test_getenv("SSL_intermediate_pub_pem", NULL) == NULL) {
+    Test::Say("Running root CA only tests\n");
+    /* DER format can contain only a single certificate so it's
+     * not suited for sending the complete chain of trust
+     * corresponding to the private key,
+     * that is necessary when using an intermediate CA. */
+    do_test_verify(__LINE__, true /*verify ok*/, false, false, USE_LOCATION,
+                   RdKafka::CERT_ENC_PEM, USE_SETTER, RdKafka::CERT_ENC_DER,
+                   USE_SETTER, RdKafka::CERT_ENC_DER);
+    do_test_verify(__LINE__, true /*verify ok*/, false, false, USE_LOCATION,
+                   RdKafka::CERT_ENC_PEM, USE_SETTER, RdKafka::CERT_ENC_DER,
+                   USE_SETTER,
+                   RdKafka::CERT_ENC_PEM); /* env: SSL_all_cas_pem */
+    do_test_verify(__LINE__, true /*verify ok*/, false, false, USE_LOCATION,
+                   RdKafka::CERT_ENC_PEM, USE_SETTER, RdKafka::CERT_ENC_DER,
+                   USE_CONF, RdKafka::CERT_ENC_PEM); /* env: SSL_all_cas_pem */
+    Test::Say("Finished running root CA only tests\n");
+  }
+
+  do_test_verify(__LINE__, true /*verify ok*/, false, false, USE_SETTER,
+                 RdKafka::CERT_ENC_PKCS12, USE_SETTER, RdKafka::CERT_ENC_PKCS12,
+                 USE_SETTER, RdKafka::CERT_ENC_PKCS12);
 
   return 0;
 }

package/deps/librdkafka/tests/0098-consumer-txn.cpp

@@ -500,7 +500,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-0", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x0, 5, BeginCommit, DoFlush",
                "producer1, -1, 0x10, 5, BeginAbort, DoFlush");
@@ -554,7 +554,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-0.1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x0, 5, BeginCommit, DontFlush",
                "producer1, -1, 0x10, 5, BeginAbort, DoFlush");
@@ -598,7 +598,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-0.2", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x10, 5, BeginAbort, DoFlush",
                "producer1, -1, 0x30, 5, BeginCommit, DoFlush");
@@ -642,7 +642,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
   TestEventCb::topic = topic_name;
 
   run_producer("producer3, -1, 0x10, 5, None, DoFlush",
@@ -682,7 +682,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-1.1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x30, 5, BeginAbort, DoFlush",
                "producer3, -1, 0x40, 5, None, DoFlush",
@@ -714,7 +714,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-1.2", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x10, 5, BeginCommit, DoFlush",
                "producer1, -1, 0x20, 5, BeginAbort, DoFlush",
@@ -746,7 +746,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-2", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x10, 1, BeginAbort, DontFlush",
                "producer1, -1, 0x20, 1, BeginCommit, DontFlush",
@@ -799,7 +799,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-2.1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, -1, 0x10, 1, BeginAbort, DoFlush",
                "producer1, -1, 0x20, 1, BeginCommit, DoFlush",
@@ -883,7 +883,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-3", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 2, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 2, 3, 5000);
 
   run_producer("producer1, 0, 0x10, 3, BeginOpen, DoFlush",
                "producer1, 1, 0x20, 3, ContinueOpen, DoFlush",
@@ -928,7 +928,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-3.1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 2, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 2, 3, 5000);
 
   run_producer("producer1, 0, 0x55, 1, BeginCommit, DoFlush",
                "producer1, 0, 0x10, 3, BeginOpen, DoFlush",
@@ -969,7 +969,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-4", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer3, 0, 0x10, 1, None, DoFlush",
                "producer1, 0, 0x20, 3, BeginOpen, DoFlush",
@@ -1004,7 +1004,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-4.1", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer3, 0, 0x10, 1, None, DoFlush",
                "producer1, 0, 0x20, 3, BeginOpen, DoFlush",
@@ -1039,7 +1039,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-4.2", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer3, 0, 0x10, 1, None, DoFlush",
                "producer1, 0, 0x20, 3, BeginOpen, DoFlush",
@@ -1074,7 +1074,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-4.3", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer3, 0, 0x10, 1, None, DoFlush",
                "producer1, 0, 0x20, 3, BeginOpen, DoFlush",
@@ -1111,7 +1111,7 @@ static void do_test_consumer_txn_test(bool use_java_producer) {
 test5:
   topic_name = Test::mk_topic_name("0098-consumer_txn-5", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
 
   run_producer("producer1, 0, 0x10, 2, BeginOpen, DontFlush", "sleep,200",
                "producer1, 0, 0x20, 2, ContinueAbort, DontFlush",
@@ -1167,7 +1167,7 @@ test5:
 
   topic_name = Test::mk_topic_name("0098-consumer_txn-0", 1);
   c          = create_consumer(topic_name, "READ_COMMITTED");
-  Test::create_topic(c, topic_name.c_str(), 1, 3);
+  Test::create_topic_wait_exists(c, topic_name.c_str(), 1, 3, 5000);
   TestEventCb::topic = topic_name;
 
   run_producer("producer3, 0, 0x10, 1, None, DoFlush",

package/deps/librdkafka/tests/0099-commit_metadata.c

@@ -164,7 +164,7 @@ int main_0099_commit_metadata(int argc, char **argv) {
 
         test_str_id_generate(group_id, sizeof(group_id));
 
-        test_create_topic(NULL, topic, 1, 1);
+        test_create_topic_wait_exists(NULL, topic, 1, 1, 5000);
 
         origin_toppar = rd_kafka_topic_partition_list_new(1);
 

package/deps/librdkafka/tests/0101-fetch-from-follower.cpp

@@ -290,7 +290,7 @@ static void do_fff_test(void) {
   int msgcnt            = 1000;
   const int msgsize     = 100;
   std::string topic_str = Test::mk_topic_name("0101-fetch-from-follower", 1);
-  test_create_topic(NULL, topic_str.c_str(), 1, 3);
+  test_create_topic_wait_exists(NULL, topic_str.c_str(), 1, 3, 5000);
   test_produce_msgs_easy_size(topic_str.c_str(), 0, 0, msgcnt, msgsize);
 
   int leader_id;