search

confluentinc / librdkafka

The Apache Kafka C/C++ library
Other
7.37k stars 3.11k forks source link

Make ssl.cipher.suites configurable for TLS1.3 #4643

Open Emeraude opened 3 months ago

Emeraude commented 3 months ago

As of now, it is not possible to setup cipher suites for TLS1.3, as the OpenSSL API uses a different function for those (TLS1.3 ciphers use SSL_CTX_set_ciphersuites while TLS1.2 ciphers use SSL_CTX_set_cipher_list), which means only TLS1.2 ciphers can be configured.

This PR fix this behaviour by discriminating the ciphers set in ssl.cipher.suites and calling the right function accordingly.

Unlike #4336, this PR doesn't propose any changes to the configuration settings, but rather sort the given ciphers into two lists, one for TLS1.2 ciphers and another one for TLS1.3 ciphers.
This behaviour is also more consistent with the broker configuration.

This also solves discussion #4286.

cla-assistant[bot] commented 3 months ago

CLA assistant check
All committers have signed the CLA.