Uploaded image for project: 'Kafka'
  1. Kafka
  2. KAFKA-8381

SSL factory for inter-broker listener is broken

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: 2.3.0
    • Fix Version/s: 2.3.0
    • Component/s: security
    • Labels:
      None

      Description

      From a system test failure:

      [2019-05-17 15:48:12,453] ERROR [KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
      org.apache.kafka.common.KafkaException: org.apache.kafka.common.config.ConfigException: Invalid value javax.net.ssl.SSLHandshakeException: General SSLEngine problem for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings.
              at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:162)
              at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:146)
              at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:85)
              at kafka.network.Processor.<init>(SocketServer.scala:747)
              at kafka.network.SocketServer.newProcessor(SocketServer.scala:388)
              at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:282)
              at scala.collection.immutable.Range.foreach$mVc$sp(Range.scala:158)
              at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:281)
              at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:244)
              at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:241)
              at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
              at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
              at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
              at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:241)
              at kafka.network.SocketServer.startup(SocketServer.scala:120)
              at kafka.server.KafkaServer.startup(KafkaServer.scala:293)
      

      Looks like the changes under https://github.com/apache/kafka/commit/0494cd329f3aaed94b3b46de0abe495f80faaedd added validation for inter-broker SSL factory with hostname verification enabled and `localhost` as the hostname. As a result, integration tests pass, but system tests fail.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                rsivaram Rajini Sivaram
                Reporter:
                rsivaram Rajini Sivaram
                Reviewer:
                Manikumar
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: