ijuma commented on a change in pull request #8695:
URL: https://github.com/apache/kafka/pull/8695#discussion_r428153104
##########
File path:
clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java
##########
@@ -622,6 +622,34 @@ public void testUnsupportedTLSVersion() throws Exception {
server.verifyAuthenticationMetrics(0, 1);
}
+ /**
+ * Tests that connections can be made with TLSv1.2 and custom cipher suite.
+ */
+ @Test
+ public void testCiphersSuiteForTLSv1_2() throws Exception {
+ String node = "0";
+ SSLContext context = SSLContext.getInstance(tlsProtocol);
+ context.init(null, null, null);
+
+ //Note, that only some ciphers works out of the box. Others requires
additional configuration.
+ String cipherSuite = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+
+ sslServerConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.2");
+ sslServerConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG,
Arrays.asList(SslConfigs.DEFAULT_SSL_ENABLED_PROTOCOLS.split(",")));
Review comment:
Ah, I see, you are forcefully setting it to the default. Makes sense.
OK, so this test shows that we can negotiate successfully even though we have
no cipher suites that work with TLS 1.3. Can we also test that if the client
sets TLS 1.3, it will fail?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
