From 03dc5a061cc0281d479991e053b0dffbd635245e Mon Sep 17 00:00:00 2001 From: jkonisa Date: Mon, 15 Dec 2025 13:58:37 -0800 Subject: [PATCH] Update cassandra-stress to support TLS 1.3 by default by auto-negotiation This is a backport of 9d89b47c68a6b476135c04b633e7d080a8ebe65f to cassandra-5.0 branch. patch by Rishabh Saraswat; reviewed by Jyothsna Konisa, Brad Schoening for CASSANDRA-21007 --- CHANGES.txt | 1 + .../cassandra/stress/settings/SettingsTransport.java | 9 ++++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 4c79e1cd5a..5ff7427a39 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 5.0.8 + * Update cassandra-stress to support TLS 1.3 by default by auto-negotiation (CASSANDRA-21007) * Ensure schema created before 2.1 without tableId in folder name can be loaded in SnapshotLoader (CASSANDRA-21173) Merged from 4.1: Merged from 4.0: diff --git a/tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java b/tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java index cf62999822..211cedd56a 100644 --- a/tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java +++ b/tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java @@ -54,8 +54,10 @@ public class SettingsTransport implements Serializable .withTrustStore(options.trustStore.value()) .withTrustStorePassword(options.trustStorePw.setByUser() ? options.trustStorePw.value() : credentials.transportTruststorePassword) .withAlgorithm(options.alg.value()) - .withProtocol(options.protocol.value()) - .withCipherSuites(options.ciphers.value().split(",")); + .withProtocol(options.protocol.value()); + + if (options.ciphers.value() != null) + encOptions = encOptions.withCipherSuites(options.ciphers.value().split(",")); if (options.keyStore.present()) { encOptions = encOptions @@ -87,8 +89,9 @@ public class SettingsTransport implements Serializable TRANSPORT_KEYSTORE_PASSWORD_PROPERTY_KEY), false); final OptionSimple protocol = new OptionSimple("ssl-protocol=", ".*", "TLS", "SSL: connection protocol to use", false); final OptionSimple alg = new OptionSimple("ssl-alg=", ".*", null, "SSL: algorithm", false); + // Null is to auto-negotiate final OptionSimple ciphers = new OptionSimple("ssl-ciphers=", ".*", - "TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA", + null, "SSL: comma delimited list of encryption suites to use", false); @Override