From 34bc1337c0a73bbb2564cc481fb848452477e6e3 Mon Sep 17 00:00:00 2001 From: Ismael Juma Date: Wed, 23 Jun 2021 06:22:23 -0700 Subject: [PATCH 1/3] KAFKA-12790: Fix SslTransportLayerTest.testUnsupportedTlsVersion with recent JDKs Support for TLS 1.0 and 1.1 was disabled in recent versions of Java 8/11 and all versions of 16. Re-enable it in this test so that we can verify the server behavior when it establishes connections with such TLS versions. --- .../common/network/SslTransportLayerTest.java | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java index f9a64f6fdb6fc..3eafa696090b5 100644 --- a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java +++ b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java @@ -16,6 +16,7 @@ */ package org.apache.kafka.common.network; +import java.security.Security; import org.apache.kafka.common.KafkaException; import org.apache.kafka.common.config.SslConfigs; import org.apache.kafka.common.config.internals.BrokerSecurityConfigs; @@ -36,8 +37,6 @@ import org.apache.kafka.test.TestSslUtils; import org.apache.kafka.test.TestUtils; import org.junit.jupiter.api.AfterEach; -import org.junit.jupiter.api.condition.DisabledOnJre; -import org.junit.jupiter.api.condition.JRE; import org.junit.jupiter.api.extension.ExtensionContext; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.Arguments; @@ -632,15 +631,23 @@ private void checkAuthenticationFailed(Args args, String node, String tlsVersion */ @ParameterizedTest @ArgumentsSource(SslTransportLayerArgumentsProvider.class) - @DisabledOnJre(JRE.JAVA_16) public void testUnsupportedTlsVersion(Args args) throws Exception { - server = createEchoServer(args, SecurityProtocol.SSL); + // Capture the current value so that we can restore at the end of the test + String disabledAlgorithms = System.getProperty("jdk.tls.disabledAlgorithms"); + // TLS 1.0 and 1.1 have been disabled in recent versions of Java 8/11 and all versions + // of 16, temporarily allow it so that we can test we send the expected error. + Security.setProperty("jdk.tls.disabledAlgorithms", ""); + try { + server = createEchoServer(args, SecurityProtocol.SSL); - checkAuthenticationFailed(args, "0", "TLSv1.1"); - server.verifyAuthenticationMetrics(0, 1); + checkAuthenticationFailed(args, "0", "TLSv1.1"); + server.verifyAuthenticationMetrics(0, 1); - checkAuthenticationFailed(args, "0", "TLSv1"); - server.verifyAuthenticationMetrics(0, 2); + checkAuthenticationFailed(args, "0", "TLSv1"); + server.verifyAuthenticationMetrics(0, 2); + } finally { + Security.setProperty("jdk.tls.disabledAlgorithms", disabledAlgorithms); + } } /** From b8cf066021736a5ef6aad9a7157204b76dbce62a Mon Sep 17 00:00:00 2001 From: Rajini Sivaram Date: Wed, 23 Jun 2021 16:35:07 +0100 Subject: [PATCH 2/3] Fix NPE in finally block --- .../org/apache/kafka/common/network/SslTransportLayerTest.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java index 3eafa696090b5..39b17ecc86ce8 100644 --- a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java +++ b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java @@ -646,7 +646,8 @@ public void testUnsupportedTlsVersion(Args args) throws Exception { checkAuthenticationFailed(args, "0", "TLSv1"); server.verifyAuthenticationMetrics(0, 2); } finally { - Security.setProperty("jdk.tls.disabledAlgorithms", disabledAlgorithms); + if (disabledAlgorithms != null) + Security.setProperty("jdk.tls.disabledAlgorithms", disabledAlgorithms); } } From 03fba29a0fba2157d88f2f9ced3182cd3e5a2fc9 Mon Sep 17 00:00:00 2001 From: Ismael Juma Date: Fri, 25 Jun 2021 05:17:38 -0700 Subject: [PATCH 3/3] Delete test --- .../common/network/SslTransportLayerTest.java | 26 ------------------- 1 file changed, 26 deletions(-) diff --git a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java index 39b17ecc86ce8..17a8d796a7f11 100644 --- a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java +++ b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java @@ -16,7 +16,6 @@ */ package org.apache.kafka.common.network; -import java.security.Security; import org.apache.kafka.common.KafkaException; import org.apache.kafka.common.config.SslConfigs; import org.apache.kafka.common.config.internals.BrokerSecurityConfigs; @@ -626,31 +625,6 @@ private void checkAuthenticationFailed(Args args, String node, String tlsVersion selector.close(); } - /** - * Tests that connections cannot be made with unsupported TLS versions - */ - @ParameterizedTest - @ArgumentsSource(SslTransportLayerArgumentsProvider.class) - public void testUnsupportedTlsVersion(Args args) throws Exception { - // Capture the current value so that we can restore at the end of the test - String disabledAlgorithms = System.getProperty("jdk.tls.disabledAlgorithms"); - // TLS 1.0 and 1.1 have been disabled in recent versions of Java 8/11 and all versions - // of 16, temporarily allow it so that we can test we send the expected error. - Security.setProperty("jdk.tls.disabledAlgorithms", ""); - try { - server = createEchoServer(args, SecurityProtocol.SSL); - - checkAuthenticationFailed(args, "0", "TLSv1.1"); - server.verifyAuthenticationMetrics(0, 1); - - checkAuthenticationFailed(args, "0", "TLSv1"); - server.verifyAuthenticationMetrics(0, 2); - } finally { - if (disabledAlgorithms != null) - Security.setProperty("jdk.tls.disabledAlgorithms", disabledAlgorithms); - } - } - /** * Tests that connections cannot be made with unsupported TLS cipher suites */