On Mon, Aug 06, 2018 at 12:23:27PM -1000, Han Zhou wrote:
> On Mon, Aug 6, 2018 at 12:07 PM, Ben Pfaff <b...@ovn.org> wrote:
> >
> > 10 of the travis builds are failing such as
> > TESTSUITE=1 KERNEL=3.16.54 for gcc and clang.
> >
> > I don't know why SSL_OP_NO_SSL_MASK doesn't include SSL_OP_NO_SSLv2,
> > but it doesn't in my copy of the appropriate header file.
> >
> > Fixes: ab16d2c2871b ("stream-ssl: Don't enable new TLS versions by
> default")
> > CC: Timothy Redaelli <tredae...@redhat.com>
> > Signed-off-by: Darrell Ball <dlu...@gmail.com>
> > Signed-off-by: Ben Pfaff <b...@ovn.org>
> > ---
> > lib/stream-ssl.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/lib/stream-ssl.c b/lib/stream-ssl.c
> > index f3d623c035f8..bd4f2ff50dbc 100644
> > --- a/lib/stream-ssl.c
> > +++ b/lib/stream-ssl.c
> > @@ -1188,6 +1188,11 @@ stream_ssl_set_protocols(const char *arg)
> > }
> >
> > /* Start with all the flags off and turn them on as requested. */
> > +#ifndef SSL_OP_NO_SSL_MASK
> > + /* For old OpenSSL without this macro, this is the correct value. */
> > +#define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | \
> > + SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2)
> > +#endif
> > long protocol_flags = SSL_OP_NO_SSL_MASK;
> >
> > char *s = xstrdup(arg);
> > --
> > 2.16.1
> >
> > _______________________________________________
> > dev mailing list
> > d...@openvswitch.org
> > https://mail.openvswitch.org/mailman/listinfo/ovs-dev
>
> Hi Ben,
>
> In my environment I see it as:
>
> #define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|\
> SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2)
>
> My openssl version is:
> Version : 1.0.2m
I've got headers for 1.1.0e here.
I guess that adding NO_SSLv2 should be harmless. v2 coming up...
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
