[389-commits] [389-ds-base] branch 389-ds-base-1.4.3 updated: Issue 51060 - unable to set sslVersionMin to TLS1.0

This is an automated email from the git hooks/post-receive script.

mreynolds pushed a commit to branch 389-ds-base-1.4.3
in repository 389-ds-base.

The following commit(s) were added to refs/heads/389-ds-base-1.4.3 by this push:
     new a514aba  Issue 51060 - unable to set sslVersionMin to TLS1.0
a514aba is described below

commit a514aba497a5cb756b104d23d8412945e24f2958
Author: Mark Reynolds <mreynolds(a)redhat.com&gt;
AuthorDate: Wed Apr 29 16:07:38 2020 -0400

    Issue 51060 - unable to set sslVersionMin to TLS1.0
    
    Description:  When processing the "sslVersionMin" attribute we were
incorrectly
                  setting it to TLS1.2 (current default level)
    
    fixes: https://pagure.io/389-ds-base/issue/51060
    
    Reviewed by: firstyear(Thanks!)
---
 dirsrvtests/tests/suites/tls/ssl_version_test.py | 12 ++++++++++++
 ldap/servers/slapd/ssl.c                         |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/dirsrvtests/tests/suites/tls/ssl_version_test.py
b/dirsrvtests/tests/suites/tls/ssl_version_test.py
index acc8b23..d9dae5a 100644
--- a/dirsrvtests/tests/suites/tls/ssl_version_test.py
+++ b/dirsrvtests/tests/suites/tls/ssl_version_test.py
@@ -19,10 +19,12 @@ def test_ssl_version_range(topo):
         1. Get current default range
         2. Set sslVersionMin and verify it is applied after a restart
         3. Set sslVersionMax and verify it is applied after a restart
+        4. Sanity test all the min/max versions
     :expectedresults:
         1. Success
         2. Success
         3. Success
+        4. Success
     """
 
     topo.standalone.enable_tls()
@@ -47,6 +49,16 @@ def test_ssl_version_range(topo):
     max = enc.get_attr_val_utf8('sslVersionMax')
     assert max == default_min
 
+    # Sanity test all the min/max versions
+    for attr, versions in [('sslVersionMin', ['TLS1.0', 'TLS1.1',
'TLS1.2', 'TLS1.0']),
+                           ('sslVersionMax', ['TLS1.0', 'TLS1.1',
'TLS1.2'])]:
+        for version in versions:
+            # Test that the setting is correctly applied after a restart
+            enc.replace(attr, version)
+            topo.standalone.restart()
+            current_val = enc.get_attr_val_utf8(attr)
+            assert current_val == version
+
 
 if __name__ == '__main__':
     # Run isolated
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 2d7ba3e..846106b 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -1373,7 +1373,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
                                    val, emin);
                     (*rval) = enabledNSSVersions.min;
                 } else {
-                    (*rval) = CURRENT_DEFAULT_SSL_VERSION;
+                    (*rval) = SSL_LIBRARY_VERSION_TLS_1_0;
                 }
             } else {
                 if (enabledNSSVersions.max < CURRENT_DEFAULT_SSL_VERSION) {
@@ -1384,7 +1384,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
                                    val, emax);
                     (*rval) = enabledNSSVersions.max;
                 } else {
-                    (*rval) = CURRENT_DEFAULT_SSL_VERSION;
+                    (*rval) = SSL_LIBRARY_VERSION_TLS_1_0;
                 }
             }
         } else if (tlsv < 1.2f) { /* TLS1.1 */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.