cpp-driver icon indicating copy to clipboard operation
cpp-driver copied to clipboard

Fixes for CPP-928, and trusted certs

Open maxdymond opened this issue 3 years ago • 2 comments

This PR consists of two commits:


CPP-928 Ensure server name information flows through from contact point configuration

Previously during Address name resolution, the server name information for a given Address was lost. This fix ensures that the server name information flows through during the name resolution process for a given Address.


Iterate over all certificates in a trusted cert BIO, not just the first

Previously the code which loaded a trusted certificate from file only assumed that there was a single certificate in that file, meaning that using a certificate bundle for certificate verification would not work.

This fix allows the driver to read multiple trusted certificates out of a BIO and provision them in the trusted certificate store.


Please let me know if you have any comments!

maxdymond avatar Mar 04 '21 14:03 maxdymond

Hey, I think domain name verification is working as intended. The driver uses reverse DNS to lookup the name for certificate validation (which is a side effect of Cassandra using IP addresses internally). We have some SSL documentation that makes the use of those flags a bit clearer. I agree the header docs could do a better job of explaining those.

Cassandra uses IP addresses internally so those can be used directly for verification or a domain name can be used via reverse DNS (PTR record).

CassSsl* ssl = cass_ssl_new();

// CASS_SSL_VERIFY_PEER_IDENTITY_DNS (domain name)
cass_ssl_set_verify_flags(ssl, CASS_SSL_VERIFY_PEER_CERT | CASS_SSL_VERIFY_PEER_IDENTITY_DNS);

CassCluster* cluster = cass_cluster_new();

// Enable reverse DNS
cass_cluster_set_use_hostname_resolution(cluster, cass_true);

// ...

mpenick avatar Mar 10 '21 01:03 mpenick

@mpenick @maxdymond Happy New Year! I've pulled out the uncontroversial part of this PR (the change to read all certs) into a separate PR; @mpenick please can you re-review and merge? It's just a cherry-pick, no code changes since you reviewed above. Thanks.

kw217 avatar Jan 10 '22 15:01 kw217