viktorsomogyi commented on code in PR #22513:
URL: https://github.com/apache/kafka/pull/22513#discussion_r4414412753
##########
clients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:
##########
@@ -212,6 +213,37 @@ private SSLEngine createSslEngine(ConnectionMode
connectionMode, String peerHost
}
return sslEngine;
}
+
+ // package access for testing
+ static String[] filterCipherSuites(List<String> configured, String[]
supported) {
+ // SSLParameters#getCipherSuites may return null. If the provider does
not report its supported
+ // cipher suites we cannot filter, so use the configured list
unchanged to fall back to the old behavior.
+ if (supported == null) {
+ log.warn("Skipping validation of configured cipher suites {}
because the JDK security provider does not report its supported cipher suites",
configured);
+ return configured.toArray(new String[0]);
+ }
+
+ Set<String> supportedCiphers = Set.of(supported);
Review Comment:
Use `new HashSet<>(Arrays.asList(supported))`. Set.of throws
IllegalArgumentException on a duplicate element and NullPointerException on a
null one. This is fine for the standard provider but might not hold for a third
party FIPS and crash the startup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
