Add support for hostname verification

[dimakr]

The change adds ability to execute cassandra-stress with hostname verification, when client TLS/SSL encryption is enabled:

• the verification is programmatically configured/enabled using the RemoteEndpointAwareJdkSSLOptions class provided by the driver - as described in scylladb/java-driver/manual/ssl/README.md.
• a new CLI option is added to the set of 'transport' options, to be able to enable/disable the verification (disabled by default)

Fixes: #22

[dimakr]

Few checks executed to verify the change:

• certificate of a server under test has been generated and signed by a trusted CA. SAN extension of the certificate contains 'invalid' IPs/names, i.e. IPs/names that do not correspond to the real ones, which cassandra-stress uses to connect to the node

❯ openssl x509 -in /home/dmitriy/Downloads/ssl_conf3/10.4.3.18/client-facing.crt  -noout -text | grep -i alternative -A1
            X509v3 Subject Alternative Name: 
                DNS:ec2-52-215-223-111.eu-west-1.compute.amazonaws.com, DNS:ip-10-4-3-111.eu-west-1.compute.internal, DNS:PR-provision-test-dmitriy-db-node-0ed4aa85-3, IP Address:10.4.3.111, IP Address:52.215.223.111

• SSL handshake using openssl command shows that w/o hostname verification it is passing, w/ verification it is failing

❯ openssl s_client -connect 52.215.223.242:9042 -CAfile ~/Downloads/ssl_conf3/ca.pem
CONNECTED(00000003)
...
---
SSL handshake has read 2455 bytes and written 373 bytes
Verification: OK
...

❯ openssl s_client -connect 52.215.223.242:9042 -CAfile ~/Downloads/ssl_conf3/ca.pem -verify_hostname 52.215.223.242 -verify_return_error
CONNECTED(00000003)
...
---
SSL handshake has read 1839 bytes and written 300 bytes
Verification error: hostname mismatch
...

• new CLI transport option - hostname-verification

❯ ./tools/bin/cassandra-stress help -transport

Usage: -transport [factory=?] [truststore=?] [truststore-password=?] [keystore=?] [keystore-password=?] [ssl-protocol=?] [ssl-alg=?] [store-type=?] [ssl-ciphers=?] [hostname-verification=?]

  factory=? (default=org.apache.cassandra.thrift.TFramedTransportFactory) Fully-qualified ITransportFactory class name for creating a connection. Note: For Thrift over SSL, use org.apache.cassandra.thrift.SSLTransportFactory.
  truststore=?                             SSL: full path to truststore
  truststore-password=?                    SSL: truststore password
  keystore=?                               SSL: full path to keystore
  keystore-password=?                      SSL: keystore password
  ssl-protocol=? (default=TLS)             SSL: connection protocol to use
  ssl-alg=? (default=SunX509)              SSL: algorithm
  store-type=? (default=JKS)               SSL: keystore format
  ssl-ciphers=? (default=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA) SSL: comma delimited list of encryption suites to use
  hostname-verification=? (default=false)  SSL: enable hostname verification

• execute c-s against the server with enabled hostname verification, using the new hostname-verification CLI transport option (the command should fail)

❯ ./tools/bin/cassandra-stress read no-warmup cl=ONE duration=5s -schema keyspace=keyspace1 'replication(strategy=NetworkTopologyStrategy,replication_factor=1) compaction(strategy=SizeTieredCompactionStrategy)' -mode cql3 native -rate threads=10 -pop seq=1..10000000 -log interval=5 -transport 'truststore=/home/dmitriy/Downloads/ssl_conf3/truststore.jks truststore-password=cassandra hostname-verification=true' -node 52.215.223.242 -errors skip-unsupported-columns
******************** Stress Settings ********************
...
Transport:
  factory=org.apache.cassandra.thrift.TFramedTransportFactory; truststore=/home/dmitriy/Downloads/ssl_conf3/truststore.jks; truststore-password=cassandra; keystore=null; keystore-password=null; ssl-protocol=TLS; ssl-alg=SunX509; store-type=JKS; ssl-ciphers=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA; hostname-verification=true; 
...
INFO  [Thread-8] 2024-11-13 19:44:48,891 Cluster.java:195 - ===== Using optimized driver!!! =====
  Failed to connect to node due to an error during SSL handshake javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching ec2-52-215-223-242.eu-west-1.compute.amazonaws.com found.
com.datastax.driver.core.exceptions.NoHostAvailableException: All host(s) tried for query failed (tried: ec2-52-215-223-242.eu-west-1.compute.amazonaws.com/52.215.223.242:9042 (com.datastax.driver.core.exceptions.TransportException: [ec2-52-215-223-242.eu-west-1.compute.amazonaws.com/52.215.223.242:9042] Error writing))
Failed to create client too many times


Results:
Op rate                   :        0 op/s  []
Partition rate            :        0 pk/s  []
Row rate                  :        0 row/s []
Latency mean              :    0.0 ms []
Latency median            :    0.0 ms []
Latency 95th percentile   :    0.0 ms []
Latency 99th percentile   :    0.0 ms []
Latency 99.9th percentile :    0.0 ms []
Latency max               :    0.0 ms []
Total partitions          :          0 []
Total errors              :          0 []
Total GC count            : 0
Total GC memory           : 0.000 KiB
Total GC time             :    0.0 seconds
Avg GC time               :    NaN ms
StdDev GC time            :    0.0 ms
Total operation time      : 00:00:00

FAILURE
...

• execute c-s against the server with disabled hostname verification (default value)

❯ ./tools/bin/cassandra-stress read no-warmup cl=ONE duration=5s -schema keyspace=keyspace1 'replication(strategy=NetworkTopologyStrategy,replication_factor=1) compaction(strategy=SizeTieredCompactionStrategy)' -mode cql3 native -rate threads=10 -pop seq=1..10000000 -log interval=5 -transport 'truststore=/home/dmitriy/Downloads/ssl_conf3/truststore.jks truststore-password=cassandra' -node 52.215.223.242 -errors skip-unsupported-columns
******************** Stress Settings ********************
...
Transport:
  factory=org.apache.cassandra.thrift.TFramedTransportFactory; truststore=/home/dmitriy/Downloads/ssl_conf3/truststore.jks; truststore-password=cassandra; keystore=null; keystore-password=null; ssl-protocol=TLS; ssl-alg=SunX509; store-type=JKS; ssl-ciphers=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA; hostname-verification=false; 
...
Sleeping 2s...
Running READ with 10 threads 5 seconds
...
type       total ops,    op/s,    pk/s,   row/s,    mean,     med,     .95,     .99,    .999,     max,   time,   stderr, errors,  gc: #,  max ms,  sum ms,  sdv ms,      mb
total,          1123,     225,     225,     225,    42.3,    41.0,    47.0,    85.9,    94.9,   133.1,    5.0,  0.00000,      0,      0,       0,       0,       0,       0
total,          1161,     230,     230,     230,    41.0,    40.3,    49.2,    49.4,    49.4,    49.4,    5.2,  0.12240,      0,      0,       0,       0,       0,       0


Results:
Op rate                   :      225 op/s  [READ: 225 op/s]
Partition rate            :      225 pk/s  [READ: 225 pk/s]
Row rate                  :      225 row/s [READ: 225 row/s]
Latency mean              :   42.3 ms [READ: 42.3 ms]
Latency median            :   41.0 ms [READ: 41.0 ms]
Latency 95th percentile   :   47.0 ms [READ: 47.0 ms]
Latency 99th percentile   :   85.9 ms [READ: 85.9 ms]
Latency 99.9th percentile :   94.9 ms [READ: 94.9 ms]
Latency max               :  133.1 ms [READ: 133.1 ms]
Total partitions          :      1,161 [READ: 1,161]
Total errors              :          0 [READ: 0]
Total GC count            : 0
Total GC memory           : 0.000 KiB
Total GC time             :    0.0 seconds
Avg GC time               :    NaN ms
StdDev GC time            :    0.0 ms
Total operation time      : 00:00:05

END

[fruch]

LGTM

[Bouncheck]

Looks good.
small nitpick: Do I understand correctly that this option only pertains to the java driver? It seems that c-s can also use thrift client. We probably don't care about that part though. If you want you can modify option description to something like SSL: enable hostname verification in Java Driver

[dimakr]

If you want you can modify option description to something like SSL: enable hostname verification in Java Driver

Added that info to the option description