public class ConfluentFipsValidator extends Object implements org.apache.kafka.common.security.fips.FipsValidator
This class centralizes FIPS validation for cipher suites, SSL/TLS versions and kafka broker protocols. One of its primary uses is to validate FIPS requirements.
Constructor and Description |
---|
ConfluentFipsValidator() |
Modifier and Type | Method and Description |
---|---|
boolean |
fipsEnabled() |
void |
validateFipsBrokerProtocol(Map<String,org.apache.kafka.common.security.auth.SecurityProtocol> securityProtocolMap)
Validate broker protocol, make sure broker uses either SSL or SASL_SSL protocol.
|
void |
validateFipsTls(Map<String,?> configs)
Validate FIPS requirements on cipher suites, TLS protocols versions.
|
void |
validateFipsTlsCipherSuite(Collection<String> cipherSuites)
Validate cipher suites are FIPS compliant or not.
|
void |
validateFipsTlsCipherSuite(Map<String,?> configs)
Validate cipher suites are FIPS compliant or not.
|
void |
validateFipsTlsVersion(Collection<String> tlsVersions)
Validate TLS versions are FIPS compliant or not.
|
void |
validateFipsTlsVersion(Map<String,?> configs)
Validate TLS versions are FIPS compliant or not.
|
void |
validateRestProtocol(String restProtocol)
Validate rest server protocol, make sure connect uses https protocol.
|
public boolean fipsEnabled()
fipsEnabled
in interface org.apache.kafka.common.security.fips.FipsValidator
public void validateFipsTls(Map<String,?> configs)
validateFipsTls
in interface org.apache.kafka.common.security.fips.FipsValidator
configs
- the configuration contains cipher suites, TLS protocols.InvalidFipsCipherSuiteException
- if cipher suites not FIPS compliant.InvalidFipsTlsVersionException
- if TLS protocols not FIPS compliant.public void validateFipsBrokerProtocol(Map<String,org.apache.kafka.common.security.auth.SecurityProtocol> securityProtocolMap)
validateFipsBrokerProtocol
in interface org.apache.kafka.common.security.fips.FipsValidator
securityProtocolMap
- the Map contains map relationship between listener name and security protocol.InvalidFipsBrokerProtocolException
- if broker protocols not FIPS compliant.public void validateRestProtocol(String restProtocol)
validateRestProtocol
in interface org.apache.kafka.common.security.fips.FipsValidator
restProtocol
- protocol used by rest servers of listeners.InvalidFipsRestProtocolException
- if rest server protocol is not FIPS compliant.public void validateFipsTlsCipherSuite(Map<String,?> configs)
configs
- the configuration contains cipher suites.InvalidFipsCipherSuiteException
- if cipher suites not FIPS compliant.public void validateFipsTlsVersion(Map<String,?> configs)
configs
- the configuration contains TLS versions.InvalidFipsTlsVersionException
- if TLS protocol not FIPS compliant.public void validateFipsTlsCipherSuite(Collection<String> cipherSuites)
cipherSuites
- a collection of cipher suitesInvalidFipsCipherSuiteException
- if cipher suites not FIPS compliant.public void validateFipsTlsVersion(Collection<String> tlsVersions)
tlsVersions
- a collection of TLS protocol version.InvalidFipsTlsVersionException
- if TLS protocol not FIPS compliant.