scylladb / scylladb/cpp-rs-driver

Research and consider implementing cass_cluster_set_use_hostname_resolution

Open
#426 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C++
Stars
26
Forks
19
Avg merge
1d 21h
Merged PRs (30d)
7

Description

We removed it from cassandra.h because we saw no point in disabling hostname resolution.
However, the name is misleading.
Description of this:

 * Enable/Disable retrieving hostnames for IP addresses using reverse IP lookup.
 *
 * This is useful for authentication (Kerberos) or encryption (SSL) services
 * that require a valid hostname for verification.

So this is about reverse-lookup, not just DNS resolution.

It is also mentioned in description of cass_ssl_set_verify_flags:

/**
 * Sets verification performed on the peer's certificate.
 *
 * CASS_SSL_VERIFY_NONE - No verification is performed
 * CASS_SSL_VERIFY_PEER_CERT - Certificate is present and valid
 * CASS_SSL_VERIFY_PEER_IDENTITY - IP address matches the certificate's
 * common name or one of its subject alternative names. This implies the
 * certificate is also present.
 * CASS_SSL_VERIFY_PEER_IDENTITY_DNS - Hostname matches the certificate's
 * common name or one of its subject alternative names. This implies the
 * certificate is also present. Hostname resolution must also be enabled.
 *
 * <b>Default:</b> CASS_SSL_VERIFY_PEER_CERT
 *
 * @public @memberof CassSsl
 *
 * @param[in] ssl
 * @param[in] flags
 * @return CASS_OK if successful, otherwise an error occurred
 *
 * @see cass_cluster_set_use_hostname_resolution()
 */
CASS_EXPORT void
cass_ssl_set_verify_flags(CassSsl* ssl,
                          int flags);

We should verify again if this functionality really is something that we want to totally get rid of.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names cassandra.h and cass_ssl_set_verify_flags; start by reviewing those API declarations and the documented hostname-resolution behavior. Verify whether reverse DNS lookup is still needed for Kerberos or SSL use cases, then record a concrete decision about retaining, renaming, or removing the function and update the related API documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, rust
Domain
api, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.