This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.4.3 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.4.3 by this push: new a514aba Issue 51060 - unable to set sslVersionMin to TLS1.0 a514aba is described below commit a514aba497a5cb756b104d23d8412945e24f2958 Author: Mark Reynolds <mreynolds(a)redhat.com&gt; AuthorDate: Wed Apr 29 16:07:38 2020 -0400 Issue 51060 - unable to set sslVersionMin to TLS1.0 Description: When processing the "sslVersionMin" attribute we were incorrectly setting it to TLS1.2 (current default level) fixes: https://pagure.io/389-ds-base/issue/51060 Reviewed by: firstyear(Thanks!) --- dirsrvtests/tests/suites/tls/ssl_version_test.py | 12 ++++++++++++ ldap/servers/slapd/ssl.c | 4 ++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/dirsrvtests/tests/suites/tls/ssl_version_test.py b/dirsrvtests/tests/suites/tls/ssl_version_test.py index acc8b23..d9dae5a 100644 --- a/dirsrvtests/tests/suites/tls/ssl_version_test.py +++ b/dirsrvtests/tests/suites/tls/ssl_version_test.py @@ -19,10 +19,12 @@ def test_ssl_version_range(topo): 1. Get current default range 2. Set sslVersionMin and verify it is applied after a restart 3. Set sslVersionMax and verify it is applied after a restart + 4. Sanity test all the min/max versions :expectedresults: 1. Success 2. Success 3. Success + 4. Success """ topo.standalone.enable_tls() @@ -47,6 +49,16 @@ def test_ssl_version_range(topo): max = enc.get_attr_val_utf8('sslVersionMax') assert max == default_min + # Sanity test all the min/max versions + for attr, versions in [('sslVersionMin', ['TLS1.0', 'TLS1.1', 'TLS1.2', 'TLS1.0']), + ('sslVersionMax', ['TLS1.0', 'TLS1.1', 'TLS1.2'])]: + for version in versions: + # Test that the setting is correctly applied after a restart + enc.replace(attr, version) + topo.standalone.restart() + current_val = enc.get_attr_val_utf8(attr) + assert current_val == version + if __name__ == '__main__': # Run isolated diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 2d7ba3e..846106b 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -1373,7 +1373,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin) val, emin); (*rval) = enabledNSSVersions.min; } else { - (*rval) = CURRENT_DEFAULT_SSL_VERSION; + (*rval) = SSL_LIBRARY_VERSION_TLS_1_0; } } else { if (enabledNSSVersions.max < CURRENT_DEFAULT_SSL_VERSION) { @@ -1384,7 +1384,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin) val, emax); (*rval) = enabledNSSVersions.max; } else { - (*rval) = CURRENT_DEFAULT_SSL_VERSION; + (*rval) = SSL_LIBRARY_VERSION_TLS_1_0; } } } else if (tlsv < 1.2f) { /* TLS1.1 */ -- To stop receiving notification emails like this one, please contact the administrator of this repository.