|
4 | 4 |
|
5 | 5 | Secure the traffic between the driver and Cassandra.
|
6 | 6 |
|
7 |
| -* `advanced.ssl-engine-factory` in the configuration; defaults to none, also available: JSSE, or |
8 |
| - write your own. |
| 7 | +* `advanced.ssl-engine-factory` in the configuration; defaults to none, also available: |
| 8 | + config-based, or write your own. |
9 | 9 | * or programmatically:
|
10 | 10 | [CqlSession.builder().withSslEngineFactory()][SessionBuilder.withSslEngineFactory] or
|
11 | 11 | [CqlSession.builder().withSslContext()][SessionBuilder.withSslContext].
|
@@ -178,26 +178,12 @@ CqlSession session = CqlSession.builder()
|
178 | 178 | .build();
|
179 | 179 | ```
|
180 | 180 |
|
181 |
| -#### Netty |
| 181 | +#### Netty-tcnative |
182 | 182 |
|
183 |
| -Netty provides a more efficient SSL implementation based on native OpenSSL support. It's possible to |
184 |
| -customize the driver to use it instead of JSSE. |
| 183 | +Netty supports native integration with OpenSSL / boringssl. The driver does not provide this out of |
| 184 | +the box, but with a bit of custom development it is fairly easy to add. See |
| 185 | +[SslHandlerFactory](../../developer/netty_pipeline/#ssl-handler-factory) in the developer docs. |
185 | 186 |
|
186 |
| -This is an advanced topic and beyond the scope of this document, but here is an overview: |
187 |
| - |
188 |
| -1. add a dependency to Netty-tcnative: follow |
189 |
| - [these instructions](http://netty.io/wiki/forked-tomcat-native.html); |
190 |
| -2. write your own implementation of the driver's `SslHandlerFactory`. This is a higher-level |
191 |
| - abstraction than `SslEngineFactory`, that returns a Netty `SslHandler`. You'll build this handler |
192 |
| - with Netty's own `SslContext`; |
193 |
| -3. write a subclass of `DefaultDriverContext` that overrides `buildSslHandlerFactory()` to return |
194 |
| - the custom `SslHandlerFactory` you wrote in step 2. This will cause the driver to completely |
195 |
| - ignore the `ssl-engine-factory` options in the configuration; |
196 |
| -4. write a subclass of `SessionBuilder` that overrides `buildContext` to return the custom context |
197 |
| - that you wrote in step 3. |
198 |
| -5. build your session with your custom builder. |
199 |
| - |
200 |
| -Note that this approach relies on the driver's [internal API](../../api_conventions). |
201 | 187 |
|
202 | 188 | [dsClientToNode]: https://docs.datastax.com/en/cassandra/3.0/cassandra/configuration/secureSSLClientToNode.html
|
203 | 189 | [pickle]: http://thelastpickle.com/blog/2015/09/30/hardening-cassandra-step-by-step-part-1-server-to-server.html
|
|
0 commit comments