[GitHub] [ignite-3] PakhomovAlexander commented on a diff in pull request #1792: IGNITE-19037 Improve SSL ciphers validation

["PakhomovAlexander (via GitHub)" <gi...@apache.org>]

PakhomovAlexander commented on code in PR #1792:
URL: https://github.com/apache/ignite-3/pull/1792#discussion_r1137139923


##########
modules/network/src/main/java/org/apache/ignite/internal/network/configuration/SslConfigurationValidatorImpl.java:
##########
@@ -99,9 +99,14 @@ private static void validateCiphers(ValidationContext<AbstractSslView> ctx, Abst
             Set<String> ciphers = Arrays.stream(ssl.ciphers().split(","))
                     .map(String::strip)
                     .collect(Collectors.toSet());
-            if (!supported.containsAll(ciphers)) {
-                ciphers.removeAll(supported);
-                ctx.addIssue(new ValidationIssue(ctx.currentKey(), "There are unsupported cipher suites: " + ciphers));
+
+            // If removeAll returns true, it means that there were at least some supported ciphers.
+            boolean haveSupported = ciphers.removeAll(supported);
+            if (!ciphers.isEmpty()) {
+                if (!haveSupported) {
+                    ctx.addIssue(new ValidationIssue(ctx.currentKey(), "None of the configured cipher suites are supported: " + ciphers));
+                }
+                LOG.info("Some of the configured cipher suites are unsupported: {}", ciphers);

Review Comment:
   We can log here not all ciphers but only those that are unsupported. It will be more informative for users.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org