harmadasg commented on code in PR #22513:
URL: https://github.com/apache/kafka/pull/22513#discussion_r4415454522
##########
clients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:
##########
@@ -212,6 +213,37 @@ private SSLEngine createSslEngine(ConnectionMode
connectionMode, String peerHost
}
return sslEngine;
}
+
+ // package access for testing
+ static String[] filterCipherSuites(List<String> configured, String[]
supported) {
+ // SSLParameters#getCipherSuites may return null. If the provider does
not report its supported
+ // cipher suites we cannot filter, so use the configured list
unchanged to fall back to the old behavior.
+ if (supported == null) {
+ log.warn("Skipping validation of configured cipher suites {}
because the JDK security provider does not report its supported cipher suites",
configured);
+ return configured.toArray(new String[0]);
+ }
+
+ Set<String> supportedCiphers = Set.of(supported);
Review Comment:
Good catch, I changed the code to use the proposed solution
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
