Skip to content

Commit 3bea742

Browse files
committed
Add cass_ssl_set_default_verify_paths API
Forwards SSL-configuration to use system default directories for finding certificate authorities.
1 parent 7f193cb commit 3bea742

File tree

8 files changed

+46
-0
lines changed

8 files changed

+46
-0
lines changed

include/cassandra.h

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4687,6 +4687,18 @@ cass_ssl_set_private_key_n(CassSsl* ssl,
46874687
const char* password,
46884688
size_t password_length);
46894689

4690+
/**
4691+
* Configures the context to use the default directories
4692+
* for finding certification authority certificates.
4693+
*
4694+
* @public @memberof CassSsl
4695+
*
4696+
* @param[in] ssl
4697+
* @return CASS_OK if successful, otherwise an error occurred
4698+
*/
4699+
CASS_EXPORT CassError
4700+
cass_ssl_set_default_verify_paths(CassSsl* ssl);
4701+
46904702
/***********************************************************************************
46914703
*
46924704
* Authenticator

src/ssl.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@ CassError cass_ssl_set_private_key_n(CassSsl* ssl, const char* key, size_t key_l
6565
return ssl->set_private_key(key, key_length, password, password_length);
6666
}
6767

68+
CassError cass_ssl_set_default_verify_paths(CassSsl* ssl) {
69+
return ssl->set_default_verify_paths();
70+
}
71+
6872
} // extern "C"
6973

7074
template <class T>

src/ssl.hpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ class SslContext : public RefCounted<SslContext> {
8787
virtual CassError set_cert(const char* cert, size_t cert_length) = 0;
8888
virtual CassError set_private_key(const char* key, size_t key_length, const char* password,
8989
size_t password_length) = 0;
90+
virtual CassError set_default_verify_paths() = 0;
9091

9192
protected:
9293
int verify_flags_;

src/ssl/ssl_no_impl.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,4 +44,8 @@ CassError NoSslContext::set_private_key(const char* key, size_t key_length, cons
4444
return CASS_ERROR_LIB_NOT_IMPLEMENTED;
4545
}
4646

47+
CassError NoSslContext::set_default_verify_paths() {
48+
return CASS_ERROR_LIB_NOT_IMPLEMENTED;
49+
}
50+
4751
SslContext::Ptr NoSslContextFactory::create() { return SslContext::Ptr(new NoSslContext()); }

src/ssl/ssl_no_impl.hpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ class NoSslContext : public SslContext {
4040
virtual CassError set_cert(const char* cert, size_t cert_length);
4141
virtual CassError set_private_key(const char* key, size_t key_length, const char* password,
4242
size_t password_length);
43+
virtual CassError set_default_verify_paths();
4344
};
4445

4546
class NoSslContextFactory : public SslContextFactoryBase<NoSslContextFactory> {

src/ssl/ssl_openssl_impl.cpp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -599,6 +599,16 @@ CassError OpenSslContext::set_private_key(const char* key, size_t key_length, co
599599
return CASS_OK;
600600
}
601601

602+
CassError OpenSslContext::set_default_verify_paths()
603+
{
604+
int rc = SSL_CTX_set_default_verify_paths(ssl_ctx_);
605+
if (!rc) {
606+
ssl_log_errors("Unable to load default verification paths");
607+
return CASS_ERROR_SSL_INVALID_CERT;
608+
}
609+
return CASS_OK;
610+
}
611+
602612
SslContext::Ptr OpenSslContextFactory::create() { return SslContext::Ptr(new OpenSslContext()); }
603613

604614
namespace openssl {

src/ssl/ssl_openssl_impl.hpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ class OpenSslContext : public SslContext {
6161
virtual CassError set_cert(const char* cert, size_t cert_length);
6262
virtual CassError set_private_key(const char* key, size_t key_length, const char* password,
6363
size_t password_length);
64+
virtual CassError set_default_verify_paths();
6465

6566
private:
6667
SSL_CTX* ssl_ctx_;

topics/security/ssl/README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,19 @@ cass_ssl_set_verify_flags(ssl, CASS_SSL_VERIFY_NONE);
165165
cass_ssl_free(ssl);
166166
```
167167

168+
System wide certificate authorities can be enabled as well:
169+
170+
```c
171+
CassSsl* ssl = cass_ssl_new();
172+
173+
// Use system default directories for finding certificate authorities.
174+
cass_ssl_set_default_verify_paths(ssl);
175+
176+
/* ... */
177+
178+
cass_ssl_free(ssl);
179+
```
180+
168181
#### Enabling Cassandra identity verification
169182
170183
If a unique certificate has been generated for each Cassandra node with the IP address or domain name in the CN or SAN fields, you also need to enable identity verification.

0 commit comments

Comments
 (0)