Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Cassandra: ExtendDB w/Cassandra uses plain-text between ExtendDB server and Cassandra node

Abierto
  • ¿Algo no está bien?
#472 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
30/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
cassandra, docker, rust
Área
backend, database, documentation, security, testing

Línea de trabajo

Start with Cargo.toml:68 and crates/storage-cassandra/src/engine.rs to trace the Cassandra session setup, then read the config definitions and PostgreSQL SSL settings for the existing configuration pattern. Review devtools/cassandra-node and the two named Cassandra deployment guides for the integration and documentation work. Done means a configured TLS connection passes an integration test, plaintext remains the default, and the guides explain the option.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

cassandra enhancement security

The ExtendDB server connects to a Cassandra backend plain TCP only (i.e. no TLS). There is currently no option to enable TLS, so the application credentials and all item data cross the network in clear text. This is acceptable only on a trusted, isolated network. Surfaced in the docs PR (#412) review; the docs now state the limitation, and this issue tracks adding encryption.

cdrs-tokio is declared with features = ["derive"] and no TLS feature (Cargo.toml:68). The ExtendDB engine builds the session with NodeTcpConfigBuilder + TcpSessionBuilder (crates/storage-cassandra/src/engine.rs) which results in a the plaintext connection. There is no config key to enable encryption.

Mitigation involves:

  • Dependency change. cdrs-tokio's TLS is a Cargo feature (rust-tls) that pulls in rustls and a different node config builder (NodeRustlsConfigBuilder), requiring a rustls::ClientConfig.
  • Second engine path. engine.rs needs a TLS branch that builds the session via the rustls config builder when TLS is configured, leaving the existing plaintext path as the default.
  • New config surface. A [storage.cassandra.tls] block: enable flag, CA bundle path, optional client certificate (for mutual TLS), and a verify mode.
  • Test infrastructure. devtools/cassandra-node starts a plaintext node; verifying this needs a TLS-enabled node (server cert, and the client trusting it), which we don't set up today.

Proposed approach:
- Add an optional [storage.cassandra.tls] config block; absent = plaintext (unchanged default, so local dev is untouched).

  • When present, enable the cdrs-tokio TLS feature and build the session through NodeRustlsConfigBuilder with a rustls::ClientConfig assembled from the configured CA / client cert / verify mode.
  • Mirror the PostgreSQL sslmode story in the config and docs (CA bundle, verify-full equivalent).
  • Extend devtools/cassandra-node (or add a sibling) to start a TLS node for the integration test, and add a test that connects over TLS.

Done when:

  • A [storage.cassandra.tls] config enables an encrypted connection to a TLS-enabled Cassandra node, verified by an integration test.
  • Plaintext remains the default when the block is absent (local dev unchanged).
  • docs/cassandra-setup.md and docs/manuals/11-deployment-guide.md are updated to document the TLS option and drop the current "unencrypted, trusted network only" caveat (or scope it to the plaintext default).
Lenguaje dominante
Rust
Estrellas
517
Forks
60
Merge medio
2 d 15 h
PR fusionados (30 d)
24

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ExtendDB/extenddb

Todos los issues de ExtendDB/extenddb

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.