Change in vdsm[ovirt-3.5]: ssl: Force client to use TLSv1 when using secure connection.

danken at redhat.com danken at redhat.com
Thu Apr 16 16:11:24 UTC 2015


Dan Kenigsberg has posted comments on this change.

Change subject: ssl: Force client to use TLSv1 when using secure connection.
......................................................................


Patch Set 3:

(2 comments)

https://gerrit.ovirt.org/#/c/39944/3//COMMIT_MSG
Commit Message:

Line 9: wrap_socket() selects protocol=SSLv23 when no protocol parameter is
Line 10: passed. This parameter means different things on python2.6 vs 2.7.
Line 11: On python 2.7 it means the connection will use the highest of SSLv2,
Line 12: SSLv3, TLSv1 that is supported by both parties.
Line 13: On python 2.6, TLSv1 is not part of protocols ssl module will negotiate
Is this statement depends only on the docs, or on python code review? I'm asking because I recall that years ago SSLv23 meant "anything but SSLv1" and included TLSv1.
Line 14: so we'll end up with SSLv3 at best, which is no longer considered
Line 15: secure.
Line 16: 
Line 17: LABEL: OVIRT-3.5 ONLY


Line 13: On python 2.6, TLSv1 is not part of protocols ssl module will negotiate
Line 14: so we'll end up with SSLv3 at best, which is no longer considered
Line 15: secure.
Line 16: 
Line 17: LABEL: OVIRT-3.5 ONLY
Why is that? Just because we no longer support el6 on master? If so, please don't diverge. We'd like to remove el6-specific code from master, but if vdsClient-on-el7 supports only TLSv4 on ovirt-3.5, it should not revert to accepting everything on 3.6.
Line 18: 
Line 19: Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1212344
Line 20: Change-Id: If25a6472b0f54076d423cbc3c98bedad2683adce


-- 
To view, visit https://gerrit.ovirt.org/39944
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: If25a6472b0f54076d423cbc3c98bedad2683adce
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Dima Kuznetsov <dkuznets at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list