Change in vdsm[master]: fix 186c8574: When using SSL, use the original host

danken at redhat.com danken at redhat.com
Mon Apr 4 05:33:28 UTC 2016


Dan Kenigsberg has submitted this change and it was merged.

Change subject: fix 186c8574: When using SSL, use the original host
......................................................................


fix 186c8574: When using SSL, use the original host

When a connection to a remote is perform and encryption (SSL) is
enabled, the original target host should be used for the connection and
not a resolved one.

This bug has been detected when trying to connect to a remote IPv4 host,
with a hostname as the target host and SSL enabled.
The host got resolved before calling connect, and therefore the
certificate has not been matched correctly (expected a hostname but used
a resolved IPv4 address).

When M2C is dropped, we can easily use the server_hostname arg of
https://docs.python.org/2/library/ssl.html#ssl.SSLContext.wrap_socket
and avoid the duplicate name resolution.

Change-Id: Ibd54bcddd5ab676d94f7a5965a061d1a3cb1f40a
Signed-off-by: Edward Haas <edwardh at redhat.com>
Reviewed-on: https://gerrit.ovirt.org/55620
Continuous-Integration: Jenkins CI
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M lib/vdsm/utils.py
1 file changed, 1 insertion(+), 1 deletion(-)

Approvals:
  Jenkins CI: Passed CI tests
  Dan Kenigsberg: Looks good to me, approved
  Edward Haas: Verified



-- 
To view, visit https://gerrit.ovirt.org/55620
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ibd54bcddd5ab676d94f7a5965a061d1a3cb1f40a
Gerrit-PatchSet: 5
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Edward Haas <edwardh at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: gerrit-hooks <automation at ovirt.org>


More information about the vdsm-patches mailing list