Hi,
I got a question from a team if they could set up Cassandra so they can
check the clients IP adress from a custom key manager. To do this the
IP must be availible via SSLSession.getPeerHost(), which mean that
Cassandra must set the IP when it creates the SslHandler. Today in
Cassandra you can enable require_endpoint_verification, that will set
the IP when creating the SslHandler and also enables HTTPS endpoint
identification (setEndpointIdentificationAlgorithm("HTTPS")). In this
case they don't want HTTPS, only the IP availible via
SSLSession.getPeerHost().
Would it be possible to decouple these two so enable
require_endpoint_verification only enables HTTPS and Cassandra always
set the IP when it creates the SslHandler if the IP is avilible?
I did some prototyping and I think it would work. I have a patch
available here
https://github.com/tommystendahl/cassandra/commit/7a3db469ededc50f039ad7136c5b81433b10720b
if you like to take a look at what I did.
/Tommy
