Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Cassandra: ExtendDB w/Cassandra uses plain-text between ExtendDB server and Cassandra node

Aperta
  • Qualcosa non va?
#472 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
30/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cassandra, docker, rust
Ambito
backend, database, documentation, security, testing

Direzione di ricerca

Start with Cargo.toml:68 and crates/storage-cassandra/src/engine.rs to trace the Cassandra session setup, then read the config definitions and PostgreSQL SSL settings for the existing configuration pattern. Review devtools/cassandra-node and the two named Cassandra deployment guides for the integration and documentation work. Done means a configured TLS connection passes an integration test, plaintext remains the default, and the guides explain the option.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

cassandra enhancement security

The ExtendDB server connects to a Cassandra backend plain TCP only (i.e. no TLS). There is currently no option to enable TLS, so the application credentials and all item data cross the network in clear text. This is acceptable only on a trusted, isolated network. Surfaced in the docs PR (#412) review; the docs now state the limitation, and this issue tracks adding encryption.

cdrs-tokio is declared with features = ["derive"] and no TLS feature (Cargo.toml:68). The ExtendDB engine builds the session with NodeTcpConfigBuilder + TcpSessionBuilder (crates/storage-cassandra/src/engine.rs) which results in a the plaintext connection. There is no config key to enable encryption.

Mitigation involves:

  • Dependency change. cdrs-tokio's TLS is a Cargo feature (rust-tls) that pulls in rustls and a different node config builder (NodeRustlsConfigBuilder), requiring a rustls::ClientConfig.
  • Second engine path. engine.rs needs a TLS branch that builds the session via the rustls config builder when TLS is configured, leaving the existing plaintext path as the default.
  • New config surface. A [storage.cassandra.tls] block: enable flag, CA bundle path, optional client certificate (for mutual TLS), and a verify mode.
  • Test infrastructure. devtools/cassandra-node starts a plaintext node; verifying this needs a TLS-enabled node (server cert, and the client trusting it), which we don't set up today.

Proposed approach:
- Add an optional [storage.cassandra.tls] config block; absent = plaintext (unchanged default, so local dev is untouched).

  • When present, enable the cdrs-tokio TLS feature and build the session through NodeRustlsConfigBuilder with a rustls::ClientConfig assembled from the configured CA / client cert / verify mode.
  • Mirror the PostgreSQL sslmode story in the config and docs (CA bundle, verify-full equivalent).
  • Extend devtools/cassandra-node (or add a sibling) to start a TLS node for the integration test, and add a test that connects over TLS.

Done when:

  • A [storage.cassandra.tls] config enables an encrypted connection to a TLS-enabled Cassandra node, verified by an integration test.
  • Plaintext remains the default when the block is absent (local dev unchanged).
  • docs/cassandra-setup.md and docs/manuals/11-deployment-guide.md are updated to document the TLS option and drop the current "unencrypted, trusted network only" caveat (or scope it to the plaintext default).
Lingua principale
Rust
Stelle
517
Fork
60
Merge medio
2g 23h
PR unite (30g)
25

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ExtendDB/extenddb

Tutte le issue di ExtendDB/extenddb

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.