Change in vdsm[master]: ssl: m2crypto removal

danken at redhat.com danken at redhat.com
Thu May 7 20:50:38 UTC 2015


Dan Kenigsberg has posted comments on this change.

Change subject: ssl: m2crypto removal
......................................................................


Patch Set 4:

(2 comments)

https://gerrit.ovirt.org/#/c/39990/4/lib/vdsm/sslutils.py
File lib/vdsm/sslutils.py:

Line 64: 
Line 65: 
Line 66: class SSLInfo(object):
Line 67:     def __init__(self, cert_file, key_file, ca_certs=None,
Line 68:                  protocol=ssl.PROTOCOL_TLSv1):
> I'm not sure if we should keep the sslv23 - it should prefer tlsv1 anyway (
It's worse than that - we must keep sslv23 in order to support older Engines, that did not have TLSv1.

This change affects only the default value of this entity, but still it deserves its own patch. Good catch, Yaniv.
Line 69:         self.cert_file = cert_file
Line 70:         self.key_file = key_file
Line 71:         self.ca_certs = ca_certs
Line 72:         self.protocol = protocol


https://gerrit.ovirt.org/#/c/39990/4/vdsm/clientIF.py
File vdsm/clientIF.py:

Line 177:         if config.getboolean('vars', 'ssl'):
Line 178:             truststore_path = config.get('vars', 'trust_store_path')
Line 179:             protocol = (
Line 180:                 ssl.PROTOCOL_TLSv1
Line 181:                 if config.get('vars', 'ssl_protocol') == 'sslv23'
this is particularly confusing. We are to use tlsv1, but ONLY when the user asked us to use sslv23?
Line 182:                 else ssl.PROTOCOL_SSLv23
Line 183:             )
Line 184:             sslinfo = SSLInfo(
Line 185:                 key_file=os.path.join(truststore_path, 'keys', 'vdsmkey.pem'),


-- 
To view, visit https://gerrit.ovirt.org/39990
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I3f2688b6c00eadd3f15be0ced926a397b55c1f33
Gerrit-PatchSet: 4
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Adam Litke <alitke at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Dima Kuznetsov <dkuznets at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Ido Barkan <ibarkan at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Juan Hernandez <juan.hernandez at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Sandro Bonazzola <sbonazzo at redhat.com>
Gerrit-Reviewer: Simone Tiraboschi <stirabos at redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: Yeela Kaplan <ykaplan at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list