From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: ssl: enable tlsv1.2 support
......................................................................
Patch Set 29: Code-Review-1
(1 comment)
https://gerrit.ovirt.org/#/c/72284/29/lib/vdsm/sslutils.py
File lib/vdsm/sslutils.py:
Line 262:
Line 263: def create_ssl_context():
Line 264: sslctx = None
Line 265: if config.getboolean('vars', 'ssl'):
Line 266: protocol = config.get('vars', 'ssl_protocol')
I think that it is wrong to let this user-defined string leak so deep into the module. It
is safer to have a conversion function, from ssl_protocol to context_options. the like of
def protocol_name_to_int()
would handle the strings that we must support due to backward compatibility (which are
these? sertainly sslv23). The commit message should express clearly what is expected to
happen if a user misspells the protocol version (I'm for a violent death to vdsm, with
proper log).
Line 267: sslctx = SSLContext(key_file=constants.KEY_FILE,
Line 268: cert_file=constants.CERT_FILE,
Line 269: ca_certs=constants.CA_FILE, protocol=protocol)
--
To view, visit
https://gerrit.ovirt.org/72284
To unsubscribe, visit
https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I8cc83d8cc08349a0ca47ed7d021bb3fc6d1408a6
Gerrit-PatchSet: 29
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Martin Peřina <mperina(a)redhat.com>
Gerrit-Reviewer: Michal Skrivanek <michal.skrivanek(a)redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: Yes