cpp-driver
cpp-driver copied to clipboard
Fixes for CPP-928, and trusted certs
This PR consists of two commits:
CPP-928 Ensure server name information flows through from contact point configuration
Previously during Address name resolution, the server name information for a given Address was lost. This fix ensures that the server name information flows through during the name resolution process for a given Address.
Iterate over all certificates in a trusted cert BIO, not just the first
Previously the code which loaded a trusted certificate from file only assumed that there was a single certificate in that file, meaning that using a certificate bundle for certificate verification would not work.
This fix allows the driver to read multiple trusted certificates out of a BIO and provision them in the trusted certificate store.
Please let me know if you have any comments!
Hey, I think domain name verification is working as intended. The driver uses reverse DNS to lookup the name for certificate validation (which is a side effect of Cassandra using IP addresses internally). We have some SSL documentation that makes the use of those flags a bit clearer. I agree the header docs could do a better job of explaining those.
Cassandra uses IP addresses internally so those can be used directly for verification or a domain name can be used via reverse DNS (PTR record).
CassSsl* ssl = cass_ssl_new();
// CASS_SSL_VERIFY_PEER_IDENTITY_DNS (domain name)
cass_ssl_set_verify_flags(ssl, CASS_SSL_VERIFY_PEER_CERT | CASS_SSL_VERIFY_PEER_IDENTITY_DNS);
CassCluster* cluster = cass_cluster_new();
// Enable reverse DNS
cass_cluster_set_use_hostname_resolution(cluster, cass_true);
// ...
@mpenick @maxdymond Happy New Year! I've pulled out the uncontroversial part of this PR (the change to read all certs) into a separate PR; @mpenick please can you re-review and merge? It's just a cherry-pick, no code changes since you reviewed above. Thanks.