cassandra-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Stefan Podkowinski (JIRA)" <>
Subject [jira] [Commented] (CASSANDRA-9220) Hostname verification for node-to-node encryption
Date Tue, 26 May 2015 20:10:19 GMT


Stefan Podkowinski commented on CASSANDRA-9220:

In response to [~thobbs] notes on the *Python* patch:
The [match_hostname|] function
has already been backported to Python 2.7.9 ([PEP 466|]).
But most distros won't use the latest version yet and some people may even use 2.6. How about
letting users install the backport them self in such cases, instead of bundling it and try
to {{import backport.ssl_match_hostname}} in case {{import ssl.match_hostname}} fails? 

Using a mix of hostnames and IPs gathered from configs and discovery can indeed be a problem.
But saying {{match_hostname}} doesn't work with IPs isn't entirely true. It only supports
DNS when using {{subjectAltName}} extensions, but will still fallback to the CN, which can
also be an IP. See [source|]
for details. I used IPs exclusively this way for the [implemented dtests|].
In practice, you'll likely end up with certs using both DNS and IP. 

> Hostname verification for node-to-node encryption
> -------------------------------------------------
>                 Key: CASSANDRA-9220
>                 URL:
>             Project: Cassandra
>          Issue Type: New Feature
>          Components: Core
>            Reporter: Stefan Podkowinski
>            Assignee: Stefan Podkowinski
>             Fix For: 3.x
>         Attachments: sslhostverification-2.0.patch
> This patch will will introduce a new ssl server option: {{require_endpoint_verification}}.

> Setting it will enable hostname verification for inter-node SSL communication. This is
necessary to prevent man-in-the-middle attacks when building a trust chain against a common
CA. See [here|] for background
> Clusters that solely rely on importing all node certificates into each trust store (as
described [here|])
are not effected. 
> Clusters that use the same common CA to sign node certificates are potentially affected.
In case the CA signing process will allow other parties to generate certs for different purposes,
those certificates could in turn be used for MITM attacks. The provided patch will allow to
enable hostname verification to make sure not only to check if the cert is valid but also
if it has been created for the host that we're about to connect.
> Corresponding dtest: [Test for CASSANDRA-9220|]
> Github: 
> 2.0 -> [diff|],
> Trunk -> [diff|],
> Related patches from the client perspective: [Java|],

This message was sent by Atlassian JIRA

View raw message