Skip to content

KAFKA-9460: Enable TLSv1.2 by default and disable all others protocol versions #7998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rajinisivaram merged 9 commits into from
Jan 28, 2020
Merged

KAFKA-9460: Enable TLSv1.2 by default and disable all others protocol versions #7998

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
b2a4fac
KAFKA-9460: Enable TLSv1.2 by default and disable all others protocol…
nizhikov Jan 22, 2020
491f8a3
KAFKA-9460: Code review fixes.
nizhikov Jan 22, 2020
35868d2
Merge branch 'trunk' of https://github.com/apache/kafka into KAFKA-9460
nizhikov Jan 27, 2020
db602b3
KAFKA-9460: Code review fixes.
nizhikov Jan 27, 2020
a44b3fb
KAFKA-9460: Code review fixes.
nizhikov Jan 27, 2020
3253500
KAFKA-9460: Code review fixes.
nizhikov Jan 27, 2020
f90f725
KAFKA-9460: Code review fixes.
nizhikov Jan 28, 2020
f2784b7
KAFKA-9460: Code review fixes.
nizhikov Jan 28, 2020
6c2051b
KAFKA-9460: Code review fixes.
nizhikov Jan 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,10 @@ public class SslConfigs {
public static final String SSL_PROTOCOL_CONFIG = "ssl.protocol";
public static final String SSL_PROTOCOL_DOC = "The SSL protocol used to generate the SSLContext. "
+ "Default setting is TLS, which is fine for most cases. "
Comment thread
nizhikov marked this conversation as resolved.
Outdated
+ "Allowed values in recent JVMs are TLS, TLSv1.1 and TLSv1.2. SSL, SSLv2 and SSLv3 "
+ "Allowed values in recent JVMs are TLSv1.2 and TLSv1.3. TLS, TLSv1.1, SSL, SSLv2 and SSLv3 "
+ "may be supported in older JVMs, but their usage is discouraged due to known security vulnerabilities.";

public static final String DEFAULT_SSL_PROTOCOL = "TLS";
public static final String DEFAULT_SSL_PROTOCOL = "TLSv1.2";

public static final String SSL_PROVIDER_CONFIG = "ssl.provider";
public static final String SSL_PROVIDER_DOC = "The name of the security provider used for SSL connections. Default value is the default security provider of the JVM.";
Expand All @@ -64,7 +64,7 @@ public class SslConfigs {

public static final String SSL_ENABLED_PROTOCOLS_CONFIG = "ssl.enabled.protocols";
public static final String SSL_ENABLED_PROTOCOLS_DOC = "The list of protocols enabled for SSL connections.";
public static final String DEFAULT_SSL_ENABLED_PROTOCOLS = "TLSv1.2,TLSv1.1,TLSv1";
public static final String DEFAULT_SSL_ENABLED_PROTOCOLS = "TLSv1.2";

public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
Expand Down
29 changes: 29 additions & 0 deletions clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -551,6 +551,35 @@ public void testInvalidKeyPassword() throws Exception {
server.verifyAuthenticationMetrics(0, 1);
}

/**
* Tests that connection sucess with the default TLS version.

@rajinisivaram rajinisivaram Jan 28, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: typo success
Also mention that it tests that insecure protocols are not enabled by default.

@nizhikov nizhikov Jan 28, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed.

*/
@Test
public void testTLSDefaults() throws Exception {
final LogContext logContext = new LogContext();

sslServerConfigs = serverCertStores.getTrustingConfig(clientCertStores);
sslClientConfigs = clientCertStores.getTrustingConfig(serverCertStores);

assertEquals(SslConfigs.DEFAULT_SSL_PROTOCOL, sslServerConfigs.get(SslConfigs.SSL_PROTOCOL_CONFIG));
assertEquals(SslConfigs.DEFAULT_SSL_PROTOCOL, sslClientConfigs.get(SslConfigs.SSL_PROTOCOL_CONFIG));
Comment thread
nizhikov marked this conversation as resolved.

channelBuilder = new SslChannelBuilder(Mode.CLIENT, null, false, logContext);
channelBuilder.configure(sslServerConfigs);
selector = new Selector(5000, new Metrics(), time, "MetricGroup", channelBuilder, logContext);
Comment thread
nizhikov marked this conversation as resolved.
Outdated

server = createEchoServer(SecurityProtocol.SSL);
createSelector(sslClientConfigs);

final String node = "0";

InetSocketAddress addr = new InetSocketAddress("localhost", server.port());
selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);

NetworkTestUtils.waitForChannelClose(selector, node, ChannelState.State.READY);
Comment thread
nizhikov marked this conversation as resolved.
Outdated
server.verifyAuthenticationMetrics(1, 0);
Comment thread
nizhikov marked this conversation as resolved.
Outdated
}

/**
* Tests that connections cannot be made with unsupported TLS versions
*/
Expand Down