From Dan Kenigsberg danken@redhat.com:
Dan Kenigsberg has posted comments on this change.
Change subject: ssl: enable tlsv1.2 support ......................................................................
Patch Set 27: Code-Review-1
(3 comments)
https://gerrit.ovirt.org/#/c/72284/27//COMMIT_MSG Commit Message:
Line 8: Line 9: We support all three tlsv1, tlsv1.1 and tlsv1.2 protocols or only Line 10: tlsv1.2. We need to make sure that user is aware of the choices. When Line 11: used tlsv1.2 only the client side uses all three protocols to make sure Line 12: that we are backward compatible with older vdsms. why? by default, we are backward compat. if a user bothered to set tlsv1.2, we can respect his choice and accept only it.
p.s. I am not sure this is the case in the code; it seems that your client side uses a single porotolc (1.2). Line 13: Line 14: During testing I noticed that sslv3 is still enabled on centos7 so we Line 15: need to disable it manually. It is not possible to use ssl.PROTOCOL_TLS Line 16: because it is not available for centos7.
Line 10: tlsv1.2. We need to make sure that user is aware of the choices. When Line 11: used tlsv1.2 only the client side uses all three protocols to make sure Line 12: that we are backward compatible with older vdsms. Line 13: Line 14: During testing I noticed that sslv3 is still enabled on centos7 so we sorry for realizing this so late in the game, but I think that this patch should be improved.
One thing that could have helped me could have been a split of this patch. Making sure that sslv23 means the same on all platforms merits its own patch. Line 15: need to disable it manually. It is not possible to use ssl.PROTOCOL_TLS Line 16: because it is not available for centos7. Line 17: Line 18: Bug-Url: https://bugzilla.redhat.com/1412552
https://gerrit.ovirt.org/#/c/72284/27/lib/vdsm/config.py.in File lib/vdsm/config.py.in:
PS27, Line 227: tlsv1.2 I think this is not what the user wants to happen once tlsv1.3 is out: most users would like to allow the new protocol, and even prefer it.
I think that what we need is to have an *exclude* list here, such as
ssl_protocol=OP_NO_TLSv1,OP_NO_TLSv1_1
vdsm-patches@lists.fedorahosted.org