cassandra/io/eventletreactor.py (1)

121-158: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Dead code: uses_legacy_ssl_options is now always False.

Since __init__ hardcodes self.uses_legacy_ssl_options = False and nothing else ever sets it True, the if self.uses_legacy_ssl_options: super()... branches in _initiate_connection and _validate_hostname are now unreachable. TwistedConnection doesn't carry this flag at all and branches on _ssl_enabled directly — consider removing the vestigial flag/branches here for consistency and to avoid implying conditional behavior that no longer exists.

♻️ Suggested cleanup

     def __init__(self, *args, **kwargs):
         Connection.__init__(self, *args, **kwargs)
-        self.uses_legacy_ssl_options = False
         self._write_queue = Queue()
...
     def _initiate_connection(self, sockaddr):
-        if self.uses_legacy_ssl_options:
-            super(EventletConnection, self)._initiate_connection(sockaddr)
-        else:
-            self._socket.connect(sockaddr)
-            if self._ssl_enabled:
-                self._socket.do_handshake()
+        self._socket.connect(sockaddr)
+        if self._ssl_enabled:
+            self._socket.do_handshake()

     def _validate_hostname(self):
-        if self.uses_legacy_ssl_options:
-            super(EventletConnection, self)._validate_hostname()
-        else:
-            expected_name = (self.ssl_options or {}).get('server_hostname') or self.endpoint.address
-            _validate_pyopenssl_hostname(self._socket.get_peer_certificate(), expected_name)
+        expected_name = (self.ssl_options or {}).get('server_hostname') or self.endpoint.address
+        _validate_pyopenssl_hostname(self._socket.get_peer_certificate(), expected_name)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cassandra/io/eventletreactor.py` around lines 121 - 158, Remove the hardcoded
uses_legacy_ssl_options assignment from EventletConnection.__init__ and delete
the unreachable legacy branches in _initiate_connection and _validate_hostname.
Keep the current non-legacy socket connection, handshake, and hostname
validation behavior as the unconditional implementation.

cassandra/datastax/cloud/__init__.py (1)

188-193: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use raise ... from for cleaner exception chaining.

Within an except clause, using raise ... from e is the idiomatic Python 3 approach. It automatically preserves the original traceback and sets the __cause__ attribute, making it cleaner than manually chaining with .with_traceback().
As per static analysis hints, within an except clause, exceptions should be raised with raise ... from err to distinguish them from errors in exception handling.

♻️ Proposed refactor

     try:
         from OpenSSL import SSL
     except ImportError as e:
         raise ImportError(
-            "PyOpenSSL must be installed to connect to Astra with the Eventlet or Twisted event loops")\
-            .with_traceback(e.__traceback__)
+            "PyOpenSSL must be installed to connect to Astra with the Eventlet or Twisted event loops"
+        ) from e

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cassandra/datastax/cloud/__init__.py` around lines 188 - 193, Update the
OpenSSL import error handling in the cloud initialization code to raise the
custom ImportError using Python’s explicit exception chaining syntax with the
caught exception as its cause. Remove the manual .with_traceback() chaining
while preserving the existing error message and behavior.

Source: Linters/SAST tools

cassandra/io/twistedreactor.py (1)

43-80: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate pyOpenSSL helpers across reactors and cloud module.

_default_ssl_method (43-48) is an exact duplicate of cassandra/datastax/cloud/__init__.py::_default_pyopenssl_ssl_method, and per the codebase graph, cassandra/io/eventletreactor.py defines an identical _default_ssl_method/_build_pyopenssl_context_from_options pair as well. Three independent copies of TLS negotiation/context-building logic increase the risk of divergence (e.g. one path missing a future security fix).

Extracting these into a single shared module (e.g. near _validate_pyopenssl_hostname in cassandra/connection.py) would remove the duplication.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cassandra/io/twistedreactor.py` around lines 43 - 80, Extract the shared
pyOpenSSL TLS negotiation and context-building logic from `_default_ssl_method`
and `_build_pyopenssl_context_from_options` into a common helper module,
alongside the existing shared SSL utilities such as
`_validate_pyopenssl_hostname`. Update `cassandra/io/twistedreactor.py`,
`cassandra/io/eventletreactor.py`, and `cassandra/datastax/cloud/__init__.py` to
import and reuse the shared helpers, preserving their current certificate,
verification, and fallback behavior.

cassandra/datastax/cloud/__init__.py (1)

179-184: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate TLS-method-selection helper across three modules.

This exact loop-and-fallback logic is duplicated verbatim in cassandra/io/twistedreactor.py (_default_ssl_method) and, per the codebase graph, cassandra/io/eventletreactor.py (_default_ssl_method). Three independent copies of security-relevant TLS negotiation logic risk silently diverging if one is patched without the others.

Consider hoisting this into a single shared helper (e.g. alongside _validate_pyopenssl_hostname in cassandra/connection.py) and having all three call sites import it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cassandra/datastax/cloud/__init__.py` around lines 179 - 184, Consolidate the
duplicated TLS method-selection loop from _default_pyopenssl_ssl_method,
twistedreactor._default_ssl_method, and eventletreactor._default_ssl_method into
one shared helper alongside _validate_pyopenssl_hostname in connection.py.
Update all three modules to import and call the shared helper, removing their
local implementations while preserving the existing method order and ImportError
fallback.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

CHANGELOG.rst:12

• This newly advertised behavior conflicts with the SSL guide: docs/security.rst:50-53 says an ssl_context is required to enable SSL, and lines 70-72 say Twisted/Eventlet users must pass a pyOpenSSL context. Update that guide to document options-only TLS and the new reactor handling; otherwise the primary user documentation tells users this supported path is invalid.

* Legacy ``ssl_options`` now work with the Twisted and Eventlet reactors by
  using pyOpenSSL contexts with mapped protocol, verification, cipher, SNI, and
  hostname-validation settings.

cassandra/connection.py:185

• When check_hostname=True is used with a supplied context from an older pyOpenSSL that lacks get_verify_mode(), this helper now silently does nothing. Such contexts default to VERIFY_NONE, so Eventlet/Twisted proceed to hostname-match a certificate whose chain was never authenticated; the new compatibility test codifies that insecure path. Please fail closed for this combination or otherwise force VERIFY_PEER while preserving any user verification callback.

def _ensure_pyopenssl_context_requires_verification(ssl_module, context, check_hostname):
    get_verify_mode = getattr(context, 'get_verify_mode', None)
    if (check_hostname and get_verify_mode is not None and
            get_verify_mode() == ssl_module.VERIFY_NONE):
        context.set_verify(
            ssl_module.VERIFY_PEER,
            callback=lambda _connection, _x509, _errnum, _errdepth, ok: ok
        )

cassandra/connection.py:203

• When promoting a caller-supplied pyOpenSSL context to require peer verification, this overwrites the verify mode with VERIFY_PEER and can silently drop any other verification flags already set (e.g., VERIFY_FAIL_IF_NO_PEER_CERT or similar OpenSSL bitmask flags). To avoid changing behavior beyond adding peer verification (while still replacing the callback), compute the new mode by OR-ing the existing verify mode (when available) with VERIFY_PEER instead of replacing it entirely.

def _ensure_pyopenssl_context_requires_verification(ssl_module, context, check_hostname):
    """
    Make hostname verification fail closed for a caller-supplied context.

    When hostname checking is enabled, this may mutate the context's verify
    mode and callback because pyOpenSSL does not expose a non-mutating way to
    require peer verification.
    """
    if not check_hostname:
        return

    get_verify_mode = getattr(context, 'get_verify_mode', None)
    verify_mode = get_verify_mode() if get_verify_mode is not None else None
    if (verify_mode is not None and
            verify_mode & ssl_module.VERIFY_PEER):
        return

    log.warning(
        "check_hostname=True requires peer verification; mutating supplied "
        "pyOpenSSL context to use VERIFY_PEER and replacing its verification "
        "callback"
    )
    context.set_verify(
        ssl_module.VERIFY_PEER,
        callback=lambda _connection, _x509, _errnum, _errdepth, ok: ok
    )

tests/unit/test_shard_aware.py:78

• This EndpointSSLOptionsEndPoint test helper is duplicated (also present in tests/unit/advanced/test_insights.py). Consider moving it to a shared test utility module (or a shared fixture) to prevent future drift and keep endpoint-SSL behavior tests consistent across suites.

class EndpointSSLOptionsEndPoint(DefaultEndPoint):
    @property
    def ssl_options(self):
        return {}

cassandra/connection.py:1173

• This conditional expression is difficult to read and relies on operator-precedence rules that are easy to misinterpret. Refactor into an explicit if ssl_options is not None: ... else: ... (or add parentheses around the intended grouping) to make the verification-default logic unambiguous.

        self._ssl_options_verify_by_default = (
            bool(ssl_options) or endpoint_has_non_sni_options
            if ssl_options is not None
            else bool(endpoint_ssl_options)
        )

tests/unit/io/test_twistedreactor.py:37

• These unit tests depend on a certificate file living under tests/integration/..., which can make the unit suite brittle in environments where integration assets aren’t present or packaged. Prefer generating a temporary CA bundle during the test (or patching Context.load_verify_locations and asserting the call) so unit tests remain hermetic and filesystem-independent.

CA_CERTS = os.path.abspath(os.path.join(
    os.path.dirname(__file__), '..', '..', 'integration', 'long', 'ssl', 'rootCa.crt'))

tests/unit/io/test_eventletreactor.py:38

• Same issue as Twisted: the unit test suite is coupled to an integration certificate file on disk. Consider creating a temp CA cert file within the test (or mocking load_verify_locations) to avoid failures when integration fixtures are not available.

CA_CERTS = os.path.abspath(os.path.join(
    os.path.dirname(__file__), '..', '..', 'integration', 'long', 'ssl', 'rootCa.crt'))

tests/unit/io/test_eventletreactor.py:366

• Sockets return bytes from recv() on Python 3; using a str here works only because the code checks falsiness, but it doesn’t reflect real behavior. Use b'' to better model actual socket/pyOpenSSL return values.

        conn = Mock(in_buffer_size=4096)
        conn._socket.recv.return_value = ''

tests/unit/test_shard_aware.py:78

• This EndpointSSLOptionsEndPoint helper is duplicated (a very similar class also appears in tests/unit/advanced/test_insights.py). To reduce duplication and keep endpoint-test helpers consistent, consider moving this to a shared test utility module (e.g., tests/unit/io/utils.py) and importing it where needed.

class EndpointSSLOptionsEndPoint(DefaultEndPoint):
    @property
    def ssl_options(self):
        return {}

cassandra/datastax/insights/reporter.py:153

• If the control connection disappears before startup data is collected, this fallback reports endpoint-only TLS as disabled because it checks only cluster-level fields. EndPoint contact points with non-None ssl_options are supported and now enable TLS, so the startup event can contradict the actual connection configuration during this race. Include endpoint-derived SSL state (or retain the last control-connection state) in this fallback.

            ssl_context = cluster.ssl_context
            ssl_options = cluster.ssl_options
            ssl_enabled = ssl_context is not None or ssl_options is not None

tests/unit/test_client_routes.py:460

• This regression only covers cluster-level ssl_options={}. Supported EndPoint contact points can supply ssl_options={} themselves, but Cluster still initializes the client-routes handler from cluster-level settings only; it consequently selects port instead of tls_port, and generated ClientRoutesEndPoints do not retain the original endpoint SSL options. Add an endpoint-only case and propagate that TLS configuration so routed connections both select and use TLS.

            cluster = Cluster(
                contact_points=["10.0.0.1"],
                ssl_options={},
                client_routes_config=config,

cassandra/datastax/insights/reporter.py:154

• Because endpoint options are only read when cluster options are None, this fallback ignores them for explicit cluster options. For example, Cluster(ssl_options={}) plus an endpoint {'ca_certs': ...} creates a verifying context in Connection, but if the control connection is unavailable Insights reports certValidation: false from the empty cluster dict. Merge cluster and endpoint options with the same origin-sensitive verification default used by Connection before computing the fallback report.

            if ssl_options is None:
                ssl_options = next((