librdkafka icon indicating copy to clipboard operation
librdkafka copied to clipboard

Make ssl.cipher.suites configurable for TLS1.3

Open Emeraude opened this issue 1 year ago • 1 comments

As of now, it is not possible to setup cipher suites for TLS1.3, as the OpenSSL API uses a different function for those (TLS1.3 ciphers use SSL_CTX_set_ciphersuites while TLS1.2 ciphers use SSL_CTX_set_cipher_list), which means only TLS1.2 ciphers can be configured.

This PR fix this behaviour by discriminating the ciphers set in ssl.cipher.suites and calling the right function accordingly.

Unlike #4336, this PR doesn't propose any changes to the configuration settings, but rather sort the given ciphers into two lists, one for TLS1.2 ciphers and another one for TLS1.3 ciphers.
This behaviour is also more consistent with the broker configuration.

This also solves discussion #4286.

Emeraude avatar Mar 12 '24 13:03 Emeraude

CLA assistant check
All committers have signed the CLA.

cla-assistant[bot] avatar Mar 12 '24 13:03 cla-assistant[bot]