From b3edf3990b32c700a300b14e5278ce95f0d78d07 Mon Sep 17 00:00:00 2001 From: Ismael Juma Date: Tue, 20 Jul 2021 13:42:47 -0700 Subject: [PATCH 1/2] MINOR: Fix testTlsDefaults failure due to TLS 1.0/1.1 being disabled (#11092) The latest JDKs no longer support TLS 1.0/1.1 causing the test to fail. We have already fixed this in trunk and 3.0, so this is for 2.8 and older branches. The relevant trunk commit is 530224e4fe. We had another test with the same issue and it was fixed for all branches via #10922. Reviewers: Rajini Sivaram --- .../kafka/common/network/SslTransportLayerTest.java | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java index fc90c393a40b8..7ea96978699cd 100644 --- a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java +++ b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java @@ -552,7 +552,7 @@ public void testInvalidKeyPassword() throws Exception { } /** - * Tests that connection success with the default TLS version. + * Tests that connection succeeds with the default TLS version. */ @Test public void testTLSDefaults() throws Exception { @@ -571,12 +571,6 @@ public void testTLSDefaults() throws Exception { NetworkTestUtils.checkClientConnection(selector, "0", 10, 100); server.verifyAuthenticationMetrics(1, 0); selector.close(); - - checkAuthentiationFailed("1", "TLSv1.1"); - server.verifyAuthenticationMetrics(1, 1); - - checkAuthentiationFailed("2", "TLSv1"); - server.verifyAuthenticationMetrics(1, 2); } /** Checks connection failed using the specified {@code tlsVersion}. */ From 07f02da417f6bce33112f5548a8a45adf580b84c Mon Sep 17 00:00:00 2001 From: Andrew Egelhofer Date: Tue, 27 Jul 2021 10:17:22 -0700 Subject: [PATCH 2/2] MINOR: Remove tests testTLSDefaults and checkAuthentiationFailed Revert #275 Removed These tests - As per discussion in #602 these can be left out. --- .../common/network/SslTransportLayerTest.java | 34 ------------------- 1 file changed, 34 deletions(-) diff --git a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java index 7ea96978699cd..1f1fa690e1335 100644 --- a/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java +++ b/clients/src/test/java/org/apache/kafka/common/network/SslTransportLayerTest.java @@ -551,40 +551,6 @@ public void testInvalidKeyPassword() throws Exception { server.verifyAuthenticationMetrics(0, 1); } - /** - * Tests that connection succeeds with the default TLS version. - */ - @Test - public void testTLSDefaults() throws Exception { - sslServerConfigs = serverCertStores.getTrustingConfig(clientCertStores); - sslClientConfigs = clientCertStores.getTrustingConfig(serverCertStores); - - assertEquals(SslConfigs.DEFAULT_SSL_PROTOCOL, sslServerConfigs.get(SslConfigs.SSL_PROTOCOL_CONFIG)); - assertEquals(SslConfigs.DEFAULT_SSL_PROTOCOL, sslClientConfigs.get(SslConfigs.SSL_PROTOCOL_CONFIG)); - - server = createEchoServer(SecurityProtocol.SSL); - createSelector(sslClientConfigs); - - InetSocketAddress addr = new InetSocketAddress("localhost", server.port()); - selector.connect("0", addr, BUFFER_SIZE, BUFFER_SIZE); - - NetworkTestUtils.checkClientConnection(selector, "0", 10, 100); - server.verifyAuthenticationMetrics(1, 0); - selector.close(); - } - - /** Checks connection failed using the specified {@code tlsVersion}. */ - private void checkAuthentiationFailed(String node, String tlsVersion) throws IOException { - sslClientConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, Arrays.asList(tlsVersion)); - createSelector(sslClientConfigs); - InetSocketAddress addr = new InetSocketAddress("localhost", server.port()); - selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE); - - NetworkTestUtils.waitForChannelClose(selector, node, ChannelState.State.AUTHENTICATION_FAILED); - - selector.close(); - } - /** * Tests that connections cannot be made with unsupported TLS cipher suites */