This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new 2a1a0d7 Issue 49395 - Set the default TLS version min to TLS1.2
2a1a0d7 is described below
commit 2a1a0d732524d2cbd9a7fd208abf3e26ccc89a23
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 16 10:26:29 2020 -0500
Issue 49395 - Set the default TLS version min to TLS1.2
Description: On fedora the NSS default minimum is still TLS1.0,
we need to force the default min to be TLS1.2 unless
explicity set using sslVersionMin in cn=encryption,cn=config
entry.
This is also to comply with our healthcheck tool that
complains about TLS1.0 min setting.
relates:
https://pagure.io/389-ds-base/issue/49395
Reviewed by: firstyear (Thanks!)
---
ldap/servers/slapd/ssl.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 6a07f1a..8365b29 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -48,8 +48,8 @@
* sslVersionMax: max ssl version supported by NSS
******************************************************************************/
-#define DEFVERSION "TLS1.0"
-#define CURRENT_DEFAULT_SSL_VERSION SSL_LIBRARY_VERSION_TLS_1_0
+#define DEFVERSION "TLS1.2"
+#define CURRENT_DEFAULT_SSL_VERSION SSL_LIBRARY_VERSION_TLS_1_2
extern char *slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
@@ -151,7 +151,7 @@ PRBool enableSSL2 = PR_FALSE;
PRBool enableSSL3 = PR_FALSE;
/*
* nsTLS1: on -- enable TLS1 by default.
- * Corresonding to SSL_LIBRARY_VERSION_TLS_1_0 and greater.
+ * Corresonding to SSL_LIBRARY_VERSION_TLS_1_2 and greater.
*/
PRBool enableTLS1 = PR_TRUE;
@@ -1780,7 +1780,11 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
val = slapi_entry_attr_get_ref(e, "sslVersionMin");
if (val) {
+ /* Use the user defined minimum */
(void)set_NSS_version((char *)val, &NSSVersionMin, 1);
+ } else {
+ /* Force our default minimum */
+ (void)set_NSS_version(DEFVERSION, &NSSVersionMin, 1);
}
val = slapi_entry_attr_get_ref(e, "sslVersionMax");
if (val) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.