[ovs-git] [openvswitch/ovs] ab16d2: stream-ssl: Don't enable new TLS versions by defau...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: ab16d2c2871b82d1f71c652657791acd9ca51161
      https://github.com/openvswitch/ovs/commit/ab16d2c2871b82d1f71c652657791acd9ca51161
  Author: Timothy Redaelli <tredaelli at redhat.com>
  Date:   2018-08-03 (Fri, 03 Aug 2018)

  Changed paths:
    M lib/stream-ssl.c

  Log Message:
  -----------
  stream-ssl: Don't enable new TLS versions by default

Currently protocol_flags is populated by the list of SSL and TLS
protocols by hand. This means that when a new TLS version is added to
openssl (in this case TLS v1.3 is added to openssl 1.1.1 beta)
ovsdb-server automatically enable support to it with the default ciphers.
This can be a security problem (since other ciphers can be enabled) and it
also makes a test (SSL db: implementation) to fail.

This commit changes the 'protocol_flags' to use the list of all protocol
flags as provided by openssl library (SSL_OP_NO_SSL_MASK) so there is no
need to keep the list updated by hand.

Signed-off-by: Timothy Redaelli <tredaelli at redhat.com>
Signed-off-by: Ben Pfaff <blp at ovn.org>



      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.