gaborgsomogyi commented on code in PR #29265:
URL: https://github.com/apache/flink/pull/29265#discussion_r4062776869
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -503,15 +503,31 @@ public static Configuration forProvider(Configuration
configuration, String prov
// ------------------------ ssl parameters --------------------------------
- /** SSL protocol version to be supported. */
+ /** SSL protocol version(s) to be supported. */
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_PROTOCOL =
key("security.ssl.protocol")
.stringType()
.defaultValue("TLSv1.2")
.withDescription(
- "The SSL protocol version to be supported for the
ssl transport. Note that it doesn’t"
- + " support comma separated list.");
+ Description.builder()
+ .text(
+ "The comma separated list of SSL
protocol versions to be supported for"
+ + " the ssl transport,
e.g. %s. The highest protocol version"
+ + " supported by both
communication endpoints is negotiated; if"
+ + " none of the listed
protocols has a matching cipher suite (see"
+ + " %s), the connection
falls back to a lower listed protocol"
+ + " instead of failing.",
+ code("TLSv1.2,TLSv1.3"),
+ code("security.ssl.algorithms"))
+ .linebreak()
+ .text(
+ "When %s is set to %s, a
non-contiguous list also enables the protocol"
+ + " version(s) in between
the lowest and highest listed one,"
+ + " because the underlying
engine only supports contiguous"
+ + " protocol ranges.",
+ code("security.ssl.provider"),
code("OPENSSL"))
Review Comment:
Nice catch, added. This brought up a real assumption which was not true.
Luckily it had effect on the documentation and not the production code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
