Fix setting TLS verify

[wprzytula]

Summary

This PR follows up #489 and cleans up setting verify flags for TLS.

What's done

Repaired the default (security-critical)

There was a bug that caused mismatch between documentation (VERIFY_PEER_CERT) and reality (VERIFY_NONE).
By fixing the bug, the real default moves from "no verification at all" to verifying the peer's certificate, . So for callers who never called cass_ssl_set_verify_flags(), a trusted certificate must now be configured with cass_ssl_add_trusted_cert(), otherwise every connection fails. The previous behaviour remains available as CASS_SSL_VERIFY_NONE.

Fixed CASS_SSL_VERIFY_PEER_CERT semantics

After Rust Driver turned on hostname verification by IP in SAN (scylladb/scylla-rust-driver#1491), semantics of our implementation silently changed, requiring identity verification even with CASS_SSL_VERIFY_PEER_CERT option set.
To support chain-only validation, a bit hacky logic via custom verify callback was introduced: after openssl finishes identity verification (either with success or failure), the callback is fired; the callback matches on an error and ignores errors related to failing identity verification. This emulates no identity verification, just certificate chain verification.

Detailed description of the hack by Opus

Support for PEER_CERT is hacked in — but the hack looks solid

CASS_SSL_VERIFY_PEER_CERT means "certificate is present and valid" — chain
validation without an identity check. We could not express that, because the
Rust driver pins the identity itself, in network/connection.rs:

crate::network::tls::Tls::OpenSsl010(mut ssl) => {
    ssl.param_mut()
        .set_ip(node_address.ip())?;

That runs per-connection, on the Ssl created from our SslContext, so nothing
we configure on the SSL_CTX can undo it. PEER_CERT therefore behaved
identically to PEER_IDENTITY, and an intermediate commit in this PR does no
more than log a warning saying so.

The way out is a custom verification callback that tolerates exactly the
identity-mismatch errors. When the identity check fails, OpenSSL's
check_id() does not abort outright — it sets the error and asks the verify
callback, continuing if the callback returns 1:

if (vpm->ip != NULL && X509_check_ip(...) <= 0) {
    if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
        return 0;
}

So PEER_CERT installs:

extern "C" fn verify_peer_cert_callback(preverify_ok: c_int, x509_ctx: *mut X509_STORE_CTX) -> c_int {
    if preverify_ok == 1 { return 1; }

    let error = unsafe { X509_STORE_CTX_get_error(x509_ctx) };
    match error {
        X509_V_ERR_HOSTNAME_MISMATCH
        | X509_V_ERR_EMAIL_MISMATCH
        | X509_V_ERR_IP_ADDRESS_MISMATCH => {
            unsafe { X509_STORE_CTX_set_error(x509_ctx, X509_V_OK) };
            1
        }
        _ => 0,
    }
}

Why I think this is solid:

• It is narrow. Only the three identity-mismatch codes are accepted. An
  untrusted issuer, an expired certificate, a self-signed leaf, a broken chain
  — all still fail, at any depth. It cannot degrade into "accept anything".
• It is not a bypass of chain validation. SSL_VERIFY_PEER stays on and
  the full chain walk runs unchanged; we only suppress the identity check that
  the layer below forces on us.
• It only applies to PEER_CERT. PEER_IDENTITY still passes None, so
  switching flags in either direction is clean.
• Resetting the error to X509_V_OK keeps SSL_get_verify_result() consistent
  with the handshake outcome; returning 1 alone would let the handshake succeed
  while leaving a stale mismatch error on the session.
• It is covered by the test that asserts both directions: mismatched SAN
  accepted, untrusted CA rejected.

The honest caveat: this is a workaround for the driver forcing set_ip(). The clean fix belongs in the Rust Driver — letting the caller opt out of identity verification — after which the callback can go away.

Flags handling

• CASS_SSL_VERIFY_PEER_IDENTITY is now supported. After Rust Driver turned on hostname verification by IP in SAN (Openssl hostname verification scylla-rust-driver#1491), this is easily turned on.
• CASS_SSL_VERIFY_PEER_IDENTITY_DNS is mapped to CASS_SSL_VERIFY_PEER_IDENTITY with a warning — the driver verifies the IP, not a hostname, and hostname resolution is a separate feature we do not implement.
• cass_ssl_set_verify_flags() now treats the flags as the bitmask they are, so documented combinations such as CASS_SSL_VERIFY_PEER_CERT | CASS_SSL_VERIFY_PEER_IDENTITY work. Values carrying unknown bits log an
  error and leave the settings untouched, rather than silently switching verification on.

Updated documentation

• Noted that certificates that identify a node only by subject common name are rejected — they need an iPAddress subject alternative name. OpenSSL's X509_VERIFY_PARAM_set1_ip(), which the Rust driver uses, never falls back to the subject for IP checks, unlike the C/C++ driver's own verification code. This is documented in cassandra.h and in the TLS guide.

Possible follow-ups

• Upstream cpp-driver documents CASS_SSL_VERIFY_PEER_CERT as the default; we may deliberately default to the stricter CASS_SSL_VERIFY_PEER_IDENTITY, which is the Rust Driver's choice.
• Real CASS_SSL_VERIFY_PEER_IDENTITY_DNS (requires Rust Driver's support).
• Push identity-verification opt-out into the Rust Driver, so the PEER_CERT callback can be dropped.

Pre-review checklist

• I have split my patch into logically separate commits.
• All commit messages clearly explain what they change and why.
• PR description sums up the changes and reasons why they should be introduced.
• I have implemented Rust unit tests for the features/changes introduced.
• I have enabled appropriate tests in Makefile in {SCYLLA,CASSANDRA}_(NO_VALGRIND_)TEST_FILTER.
• [ ] I added appropriate Fixes: annotations to PR description.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: 031dbefb-9312-4d88-bb4f-23505fcd152f

📥 Commits

Reviewing files that changed from the base of the PR and between 2a49017 and fcc6af6.

📒 Files selected for processing (6)

• docs/source/topics/security/tls.md
• include/cassandra.h
• scylla-rust-wrapper/build.rs
• scylla-rust-wrapper/src/lib.rs
• scylla-rust-wrapper/src/ssl.rs
• scylla-rust-wrapper/tests/integration/ccm/tls.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• scylladb/scylladb (auto-detected)

---

📝 Walkthrough

Walkthrough

OpenSSL peer certificate-chain verification is now enabled by default. Verification flags support validated combinations for disabled, chain-only, identity, and combined verification. The chain-only callback tolerates identity mismatches but rejects other certificate errors. Rust bindings expose CassSslVerifyFlags. TLS tests cover untrusted chains, identity mismatches, and chain-only verification. Documentation defines IP SAN requirements and unsupported DNS verification.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant CAPIConnection
  participant OpenSSL
  participant VerificationCallback

  Client->>CAPIConnection: Set SSL verification flags
  CAPIConnection->>OpenSSL: Configure peer verification
  OpenSSL->>VerificationCallback: Validate certificate chain
  VerificationCallback-->>OpenSSL: Accept or reject result
  OpenSSL-->>CAPIConnection: TLS handshake result
  CAPIConnection-->>Client: Connection success or failure

Loading

Possibly related PRs

• scylladb/cpp-rs-driver#489: Extends TLS verification tests and implements related verification behavior.

Suggested labels: area/testing

Suggested reviewers: lorak-mmk

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: fixing TLS verification behavior and flag handling.
Description check	✅ Passed	The description explains the motivation, behavior changes, tests, documentation updates, and checklist status in sufficient detail.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Not ready to approve

Valid bitmask combinations are rejected, CN-only certificates violate the advertised contract, and related documentation and regression coverage remain incomplete.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Fixes TLS verification defaults and adds CCM-backed end-to-end TLS coverage through the C API.

Changes:

• Defaults TLS to peer identity verification and adds chain-only verification.
• Adds TLS, mutual-TLS, and certificate validation integration tests.
• Updates dependencies and Makefile test targets.

File summaries

File	Description
Makefile	Runs CCM TLS tests and updates ScyllaDB version.
include/cassandra.h	Documents the new TLS default.
scylla-rust-wrapper/Cargo.toml	Adds CCM and certificate-generation dependencies.
scylla-rust-wrapper/Cargo.lock	Locks updated dependencies.
scylla-rust-wrapper/src/ssl.rs	Implements verification defaults and flag handling.
scylla-rust-wrapper/tests/integration/main.rs	Registers CCM tests.
scylla-rust-wrapper/tests/integration/ccm/mod.rs	Adds shared CCM test support.
scylla-rust-wrapper/tests/integration/ccm/tls.rs	Adds end-to-end TLS tests.

Review details

Suppressed comments (1)

scylla-rust-wrapper/src/ssl.rs:246

• flags is a bitmask in the public API, but this catch-all rejects valid documented combinations such as CASS_SSL_VERIFY_PEER_CERT | CASS_SSL_VERIFY_PEER_IDENTITY (0x03) and the DNS variant (0x05); both are used in docs/source/topics/security/tls.md:176-179 and handled bitwise by the C++ implementation. With the new stricter default, those calls silently retain IP verification instead of applying the requested mode. Accept combinations of known bits while rejecting only unknown bits, and add coverage for the documented combinations.

        _ => {
            tracing::error!(
                "Provided unknown CASS_SSL_VERIFY flags variant: {}. Leaving settings unchanged.",
                flags
            );

• Files reviewed: 7/8 changed files
• Comments generated: 5
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

Makefile (1)

503-503: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Update the stale version example.

The comment uses release:2025.3.8, but the default SCYLLA_VERSION is now release:2026.2.2.

📝 Proposed fix

-	@# Prefer a fully-qualified SCYLLA_VERSION (e.g. release:2025.3.8 rather
-	@# than release:2025.3): scylla-ccm re-resolves the version on every `ccm`
+	@# Prefer a fully-qualified SCYLLA_VERSION (e.g. release:2026.2.2 rather
+	@# than release:2026.2): scylla-ccm re-resolves the version on every `ccm`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` at line 503, Update the version example in the Makefile comment
near SCYLLA_VERSION from release:2025.3.8 to release:2026.2.2, matching the
current default value while preserving the surrounding guidance.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scylla-rust-wrapper/tests/integration/ccm/tls.rs`:
- Around line 225-270: The if let Some((cert_pem, key_pem)) =
client_cert_and_key_pem conditional block that calls cass_ssl_set_cert and
cass_ssl_set_private_key is duplicated verbatim in the code. Remove the second
occurrence of this entire block (the duplicate starting after the first one
completes) to ensure the certificate and key are set only once on the CassSsl
instance.
- Around line 52-59: Prevent concurrent TLS integration tests from sharing the
`cluster_tls_3_node` directory: update `cluster_3_nodes` or the four
`run_ccm_tls_test` callers to use test-specific cluster names, or serialize
those test functions with `#[serial_test::serial]`. Preserve the existing
cluster configuration while ensuring each test’s `File::create_new()` calls
cannot race.

---

Nitpick comments:
In `@Makefile`:
- Line 503: Update the version example in the Makefile comment near
SCYLLA_VERSION from release:2025.3.8 to release:2026.2.2, matching the current
default value while preserving the surrounding guidance.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: e2bca14a-10b3-4886-a1a5-bfa78716d346

📥 Commits

Reviewing files that changed from the base of the PR and between 9e47e3b and 8382678.

⛔ Files ignored due to path filters (1)

• scylla-rust-wrapper/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• Makefile
• include/cassandra.h
• scylla-rust-wrapper/Cargo.toml
• scylla-rust-wrapper/src/ssl.rs
• scylla-rust-wrapper/tests/integration/ccm/mod.rs
• scylla-rust-wrapper/tests/integration/ccm/tls.rs
• scylla-rust-wrapper/tests/integration/main.rs

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (2)

docs/source/topics/security/tls.md-17-21 (1)

17-21: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Align TLS documentation with the IP-SAN-only implementation.

CN-only and DNS-SAN setup paths do not work with default identity verification.

• docs/source/topics/security/tls.md#L17-L21: Update Line 15 and Lines 23-43. Require an iPAddress SAN. Mark CN-only and DNS-SAN certificates as requiring CASS_SSL_VERIFY_PEER_CERT or CASS_SSL_VERIFY_NONE.
• include/cassandra.h#L4313-L4316: Remove the DNS hostname-matching and hostname-resolution behavior. State only that DNS verification is unsupported and maps to IP identity verification.

As per coding guidelines, “Adjust the documentation under ./docs/source/ when changes require documentation updates.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/source/topics/security/tls.md` around lines 17 - 21, Update
docs/source/topics/security/tls.md around the SAN setup guidance to require an
iPAddress subject alternative name and clearly mark CN-only and DNS-SAN
certificates as requiring CASS_SSL_VERIFY_PEER_CERT or CASS_SSL_VERIFY_NONE;
also update include/cassandra.h around the DNS verification documentation to
remove hostname matching and resolution claims, stating only that DNS
verification is unsupported and maps to IP identity verification.

Source: Coding guidelines

scylla-rust-wrapper/tests/integration/ccm/tls.rs-365-371 (1)

365-371: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Test the default identity mode.

Lines 365-371 only test an untrusted CA. Chain-only PEER_CERT also rejects that case. In tls_verifies_hostname, test None with ca_pem and the existing mismatched SAN.

As per coding guidelines, **/*{_test.rs,.rs}: Implement Rust unit tests for introduced features and changes.

Also applies to: 398-434

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scylla-rust-wrapper/tests/integration/ccm/tls.rs` around lines 365 - 371, The
current test for the default identity mode (when `None` is passed) only covers
the untrusted CA rejection case. Add a test case that passes `None` (default
mode) with `ca_pem` (a trusted CA) to verify that the default identity mode
correctly accepts connections with a valid certificate chain. This test should
use the existing mismatched SAN scenario in `tls_verifies_hostname` to ensure
the default behavior handles hostname verification appropriately when a trusted
CA is present, complementing the existing untrusted CA test.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Other comments:
In `@docs/source/topics/security/tls.md`:
- Around line 17-21: Update docs/source/topics/security/tls.md around the SAN
setup guidance to require an iPAddress subject alternative name and clearly mark
CN-only and DNS-SAN certificates as requiring CASS_SSL_VERIFY_PEER_CERT or
CASS_SSL_VERIFY_NONE; also update include/cassandra.h around the DNS
verification documentation to remove hostname matching and resolution claims,
stating only that DNS verification is unsupported and maps to IP identity
verification.

In `@scylla-rust-wrapper/tests/integration/ccm/tls.rs`:
- Around line 365-371: The current test for the default identity mode (when
`None` is passed) only covers the untrusted CA rejection case. Add a test case
that passes `None` (default mode) with `ca_pem` (a trusted CA) to verify that
the default identity mode correctly accepts connections with a valid certificate
chain. This test should use the existing mismatched SAN scenario in
`tls_verifies_hostname` to ensure the default behavior handles hostname
verification appropriately when a trusted CA is present, complementing the
existing untrusted CA test.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: cea8c6c0-f4f6-4c9e-8bcd-2601a547c981

📥 Commits

Reviewing files that changed from the base of the PR and between 8382678 and 58342dd.

📒 Files selected for processing (6)

• .github/pull_request_template.md
• Makefile
• docs/source/topics/security/tls.md
• include/cassandra.h
• scylla-rust-wrapper/src/ssl.rs
• scylla-rust-wrapper/tests/integration/ccm/tls.rs

[wprzytula]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[Copilot]

🟡 Changes recommended

The TLS guide misstates the security default, and its chain-only default semantics lack direct regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (3)

docs/source/topics/security/tls.md:163

• This states that identity verification is the default, but the constructor and public header now default to CASS_SSL_VERIFY_PEER_CERT, which performs chain-only verification. As written, users may incorrectly assume the node IP is checked when they do not call cass_ssl_set_verify_flags(); document the chain-only default and keep identity verification explicit.

**NOTE:** This is enabled by default, as part of the default
`CASS_SSL_VERIFY_PEER_IDENTITY`. The flags form a bitmask, so it can also be
requested explicitly, on its own or combined with `CASS_SSL_VERIFY_PEER_CERT`:

scylla-rust-wrapper/src/ssl.rs:58

• The security-critical default is only tested without a trusted CA, which fails under both chain-only and identity verification. A regression that drops the default callback and silently makes the default PEER_IDENTITY would therefore pass every current default-mode assertion. Add a verify_flags: None connection using the trusted CA and deliberately mismatched SAN from tls_peer_cert_verifies_chain_only to prove the default has the advertised chain-only semantics.

        SSL_CTX_set_verify(
            ssl_context,
            SslVerifyMode::PEER.bits(),
            Some(verify_peer_cert_callback),
        );

docs/source/topics/security/tls.md:15

• certficate is misspelled four times in this updated paragraph; use certificate.

This issue also appears on line 161 of the same file.

The most secure method of setting up TLS is to verify that DNS or IP address used to connect to the server matches identity information found in the TLS certificate. This helps to prevent man-in-the-middle attacks. ScyllaDB/Cassandra uses IP addresses internally so those can be used directly for verification (a domain name currently cannot be used via reverse DNS - PTR record). That means that the IP address of the ScyllaDB/Cassandra server where the certficate is installed needs to be present in one of the certficate's subject alternative names (SANs). It's possible to create the certficate without them, but then it will not be possible to verify the server's identity. Although this is not as secure, it eases the deployment of TLS by allowing the same certficate to be deployed across the entire ScyllaDB/Cassandra cluster.

• Files reviewed: 6/6 changed files
• Comments generated: 0 new
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[coderabbitai]

Actionable comments posted: 1

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

scylla-rust-wrapper/tests/integration/ccm/tls.rs-351-370 (1)

351-370: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Test default chain-only verification.

These assertions only prove that an untrusted chain fails. A peer-verification context without verify_peer_cert_callback also fails this case. Add a trusted CA with a mismatched IP SAN and verify_flags = None; assert that the connection succeeds.

As per coding guidelines, "Implement Rust unit tests for features and changes introduced by the patch."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scylla-rust-wrapper/tests/integration/ccm/tls.rs` around lines 351 - 370,
Extend the TLS integration coverage around assert_conn_fails and try_tls_connect
to add a trusted CA whose certificate has a mismatched IP SAN, then connect with
verify_flags set to None and assert CassError::CASS_OK. Preserve the existing
untrusted-CA failure assertions while specifically proving default verification
validates the chain without requiring peer identity matching.

Source: Coding guidelines

🧹 Nitpick comments (1)

scylla-rust-wrapper/build.rs (1)

175-175: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff

Split binding exposure from SSL behavior. Commit 41f9d1a682543cc4c49f210c9d2dd18a00d5b44e combines both changes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scylla-rust-wrapper/build.rs` at line 175, Separate the binding exposure
change from the SSL behavior change in the build configuration around
prepare_cppdriver_data. Keep CassSslVerifyFlags exposure in its own change and
isolate any SSL behavior modifications into a separate commit or implementation
change.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/source/topics/security/tls.md`:
- Around line 161-175: Align TLS documentation and API comments with runtime
behavior: in docs/source/topics/security/tls.md:161-175, state that the default
is CASS_SSL_VERIFY_PEER_CERT and require explicitly enabling identity
verification for IP checks; in docs/source/topics/security/tls.md:15-19, update
the keytool example to generate only an iPAddress SAN; in
include/cassandra.h:4314-4317, remove hostname/CN/resolution behavior and
document that CASS_SSL_VERIFY_PEER_IDENTITY_DNS maps to IP identity
verification.

---

Other comments:
In `@scylla-rust-wrapper/tests/integration/ccm/tls.rs`:
- Around line 351-370: Extend the TLS integration coverage around
assert_conn_fails and try_tls_connect to add a trusted CA whose certificate has
a mismatched IP SAN, then connect with verify_flags set to None and assert
CassError::CASS_OK. Preserve the existing untrusted-CA failure assertions while
specifically proving default verification validates the chain without requiring
peer identity matching.

---

Nitpick comments:
In `@scylla-rust-wrapper/build.rs`:
- Line 175: Separate the binding exposure change from the SSL behavior change in
the build configuration around prepare_cppdriver_data. Keep CassSslVerifyFlags
exposure in its own change and isolate any SSL behavior modifications into a
separate commit or implementation change.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: 0e833bc9-cad7-4719-9bd9-d6c3a4eb8d1e

📥 Commits

Reviewing files that changed from the base of the PR and between c40975d and 4d62b04.

📒 Files selected for processing (6)

• docs/source/topics/security/tls.md
• include/cassandra.h
• scylla-rust-wrapper/build.rs
• scylla-rust-wrapper/src/lib.rs
• scylla-rust-wrapper/src/ssl.rs
• scylla-rust-wrapper/tests/integration/ccm/tls.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• scylladb/scylladb (auto-detected)

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.