Openssl hostname verification

docs/source/connecting/tls.md

@@ -6,6 +6,15 @@ Driver uses either the
 
 Both of this features are behind their respective feature flag.
 
+## Hostname verification
+
+For both implementations we provide node IP address for purposes of hostname verification.
+Our assumption is that certificates on nodes will have node IP address in the subject alternative name.
+
+Implementation details (might change in the future):
+For openssl we use `set_ip` method on `X509VerifyParamRef`, which corresponds to `X509_VERIFY_PARAM_set1_ip` openssl function.
+For rustls, we use `ServerName::IpAddress`, which is passed to `ClientConnection::new_with_alpn` (by `tokio_rustls`).
+
 
 ### Enabling feature
 
@@ -50,6 +59,9 @@ and a rustls
 can be automatically converted to a `TlsContext` when passing to
 `SessionBuilder`.
 
+**_NOTE:_** Recommended API in `openssl` crate is `SslConnector`, because it has safer defaults. Please use it, and then call `into_context()` to
+get `SslContext` instance you can pass to the driver.
+
 For example, if database certificate is in the file `ca.crt`:
 ```rust
 # extern crate scylla;

scylla/src/network/connection.rs

@@ -1427,7 +1427,10 @@ impl Connection {
             #[allow(unreachable_code)]
             match tls_config.new_tls()? {
                 #[cfg(feature = "openssl-010")]
-                crate::network::tls::Tls::OpenSsl010(ssl) => {
+                crate::network::tls::Tls::OpenSsl010(mut ssl) => {
+                    ssl.param_mut()
+                        .set_ip(node_address)
+                        .map_err(crate::network::tls::TlsError::OpenSsl010)?;
                     let mut stream = tokio_openssl::SslStream::new(ssl, stream)
                         .map_err(crate::network::tls::TlsError::OpenSsl010)?;
                     std::pin::Pin::new(&mut stream)

scylla/src/network/tls.rs

@@ -123,6 +123,7 @@ impl TlsConfig {
             TlsContext::OpenSsl010(ref context) => {
                 #[allow(unused_mut)]
                 let mut ssl = openssl::ssl::Ssl::new(context)?;
+                ssl.set_connect_state();
                 Ok(Tls::OpenSsl010(ssl))
             }
             #[cfg(feature = "rustls-023")]

scylla/tests/integration/ccm/tls.rs

@@ -239,16 +239,13 @@ async fn test_tls_verifies_hostname() {
             let mut builder = SslContext::builder(SslMethod::tls()).unwrap();
             builder.set_verify(SslVerifyMode::PEER);
             builder.set_cert_store(build_openssl_ca_store(ca));
-            let session = cluster
+            let _err = cluster
                 .make_session_builder()
                 .await
                 .tls_context(Some(TlsContext::OpenSsl010(builder.build())))
                 .build()
                 .await
-                // This should be unwrap_err, but hostname verification doesn't work with openssl.
-                // This is a bug: https://github.com/scylladb/scylla-rust-driver/issues/1116
-                .unwrap();
-            check_session_works_and_fully_connected(cluster.nodes().len(), &session).await;
+                .unwrap_err();
         }
 
         {