[ovs-git] [openvswitch/ovs] 55a1f8: stream-ssl: Don't enable new TLS versions by defau...

GitHub noreply at github.com
Sat Aug 4 00:09:50 UTC 2018


  Branch: refs/heads/branch-2.7
  Home:   https://github.com/openvswitch/ovs
  Commit: 55a1f896869233ae712f80bc435bf04cdc38914e
      https://github.com/openvswitch/ovs/commit/55a1f896869233ae712f80bc435bf04cdc38914e
  Author: Timothy Redaelli <tredaelli at redhat.com>
  Date:   2018-08-03 (Fri, 03 Aug 2018)

  Changed paths:
    M lib/stream-ssl.c

  Log Message:
  -----------
  stream-ssl: Don't enable new TLS versions by default

Currently protocol_flags is populated by the list of SSL and TLS
protocols by hand. This means that when a new TLS version is added to
openssl (in this case TLS v1.3 is added to openssl 1.1.1 beta)
ovsdb-server automatically enable support to it with the default ciphers.
This can be a security problem (since other ciphers can be enabled) and it
also makes a test (SSL db: implementation) to fail.

This commit changes the 'protocol_flags' to use the list of all protocol
flags as provided by openssl library (SSL_OP_NO_SSL_MASK) so there is no
need to keep the list updated by hand.

Signed-off-by: Timothy Redaelli <tredaelli at redhat.com>
Signed-off-by: Ben Pfaff <blp at ovn.org>



      **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.


More information about the git mailing list