From Dan Kenigsberg danken@redhat.com:
Dan Kenigsberg has posted comments on this change.
Change subject: ssl: enable tlsv1.2 support ......................................................................
Patch Set 29: Code-Review-1
(1 comment)
https://gerrit.ovirt.org/#/c/72284/29/lib/vdsm/sslutils.py File lib/vdsm/sslutils.py:
Line 262: Line 263: def create_ssl_context(): Line 264: sslctx = None Line 265: if config.getboolean('vars', 'ssl'): Line 266: protocol = config.get('vars', 'ssl_protocol') I think that it is wrong to let this user-defined string leak so deep into the module. It is safer to have a conversion function, from ssl_protocol to context_options. the like of
def protocol_name_to_int()
would handle the strings that we must support due to backward compatibility (which are these? sertainly sslv23). The commit message should express clearly what is expected to happen if a user misspells the protocol version (I'm for a violent death to vdsm, with proper log). Line 267: sslctx = SSLContext(key_file=constants.KEY_FILE, Line 268: cert_file=constants.CERT_FILE, Line 269: ca_certs=constants.CA_FILE, protocol=protocol)
vdsm-patches@lists.fedorahosted.org