From 769c3a6800a3955c17a0a8ef715bac905d81706e Mon Sep 17 00:00:00 2001 From: James Chao Date: Mon, 10 Aug 2026 15:46:13 -0700 Subject: [PATCH] replace the tls layer in config key path with flat key names --- config/sample_webconfig.conf | 56 +++++++++++++++++--------------- db/cassandra/cassandra_client.go | 18 +++++----- 2 files changed, 39 insertions(+), 35 deletions(-) diff --git a/config/sample_webconfig.conf b/config/sample_webconfig.conf index 075dc47..c9cdfd5 100644 --- a/config/sample_webconfig.conf +++ b/config/sample_webconfig.conf @@ -184,19 +184,21 @@ webconfig { is_ssl_enabled = true // TLS/SSL configuration (optional when is_ssl_enabled = true) - // If tls block is not provided or incomplete, will use insecure TLS - tls { - // Client certificate for mutual TLS (mTLS) - optional - cert_file = "/path/to/client-cert.pem" - key_file = "/path/to/client-key.pem" - - // CA certificate for server verification - optional - ca_cert_file = "/path/to/ca-cert.pem" - - // Skip certificate verification (INSECURE - for testing only) - // When true, allows TLS without certificates or CA validation - insecure_skip_verify = false - } + // Client certificate for mutual TLS (mTLS) - optional + tls_cert_file = "/path/to/client-cert.pem" + tls_key_file = "/path/to/client-key.pem" + + // CA certificate for server verification - optional + tls_ca_cert_file = "/path/to/ca-cert.pem" + + // Skip certificate verification (INSECURE - for testing only) + // When true, allows TLS without certificates or CA validation + tls_insecure_skip_verify = false + + // Override SNI hostname sent during TLS handshake. + // Required when the certificate uses DNS SANs only (no IP SANs). + // Leave empty to use the host IP address (gocql default). + tls_server_name = "" } yugabyte { @@ -218,19 +220,21 @@ webconfig { is_ssl_enabled = true // TLS/SSL configuration (optional when is_ssl_enabled = true) - // If tls block is not provided or incomplete, will use insecure TLS - tls { - // Client certificate for mutual TLS (mTLS) - optional - cert_file = "/path/to/client-cert.pem" - key_file = "/path/to/client-key.pem" - - // CA certificate for server verification - optional - ca_cert_file = "/path/to/ca-cert.pem" - - // Skip certificate verification (INSECURE - for testing only) - // When true, allows TLS without certificates or CA validation - insecure_skip_verify = false - } + // Client certificate for mutual TLS (mTLS) - optional + tls_cert_file = "/path/to/client-cert.pem" + tls_key_file = "/path/to/client-key.pem" + + // CA certificate for server verification - optional + tls_ca_cert_file = "/path/to/ca-cert.pem" + + // Skip certificate verification (INSECURE - for testing only) + // When true, allows TLS without certificates or CA validation + tls_insecure_skip_verify = false + + // Override SNI hostname sent during TLS handshake. + // Required when the certificate uses DNS SANs only (no IP SANs). + // Leave empty to use the host IP address (gocql default). + tls_server_name = "" } } diff --git a/db/cassandra/cassandra_client.go b/db/cassandra/cassandra_client.go index 675f388..4f5d903 100644 --- a/db/cassandra/cassandra_client.go +++ b/db/cassandra/cassandra_client.go @@ -145,7 +145,8 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl } if isSslEnabled { - tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver) + insecureSkipVerify := dbconf.GetBoolean("tls_insecure_skip_verify") + tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver, insecureSkipVerify) if err != nil { return nil, common.NewError(err) } @@ -196,15 +197,13 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl // loadCassandraTLSConfig loads TLS configuration for Cassandra connection. // Returns a tls.Config with certificates loaded from the configuration. -// The function expects tls.{} block under the database driver config (cassandra or yugabyte). -func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string) (*tls.Config, error) { - // Check insecure_skip_verify flag first - insecureSkipVerify := dbconf.GetBoolean("tls.insecure_skip_verify") - +// Reads flat tls_* keys directly under the database driver config (cassandra or yugabyte). +func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string, insecureSkipVerify bool) (*tls.Config, error) { // Load client certificates for mTLS if provided (optional when insecure_skip_verify is true) - certFile := dbconf.GetString("tls.cert_file") - keyFile := dbconf.GetString("tls.key_file") - caCertFile := dbconf.GetString("tls.ca_cert_file") + certFile := dbconf.GetString("tls_cert_file") + keyFile := dbconf.GetString("tls_key_file") + caCertFile := dbconf.GetString("tls_ca_cert_file") + serverName := dbconf.GetString("tls_server_name") // Create TLS config for Cassandra connection. // Prefer modern ECDHE+AEAD suites for forward secrecy; keep TLS_RSA_WITH_AES_128_CBC_SHA @@ -222,6 +221,7 @@ func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string) (*tls tls.TLS_RSA_WITH_AES_128_CBC_SHA, }, InsecureSkipVerify: insecureSkipVerify, + ServerName: serverName, } // When insecure_skip_verify is true and no cert files configured, skip loading certificates