Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ipatests: fix healthcheck test for ipahealthcheck.ds.encryption #5442

Closed
wants to merge 1 commit into from
Closed

ipatests: fix healthcheck test for ipahealthcheck.ds.encryption #5442

wants to merge 1 commit into from

Conversation

flo-renaud
Copy link
Contributor

389ds is combining the value set in dse.ldif and the current crypto
policy to evaluate the min TLS version that it will be using.
The test needs to change the crypto policy to LEGACY in order to allow
TLS 1.0, because the DEFAULT policy prevents TLS 1.0 on fc33+.

Fixes: https://pagure.io/freeipa/issue/8670

Signed-off-by: Florence Blanc-Renaud flo@redhat.com

@flo-renaud
ipatests: fix healthcheck test for ipahealthcheck.ds.encryption
e37295e 
389ds is combining the value set in dse.ldif and the current crypto
policy to evaluate the min TLS version that it will be using.
The test needs to change the crypto policy to LEGACY in order to allow
TLS 1.0, because the DEFAULT policy prevents TLS 1.0 on fc33+.

Fixes: https://pagure.io/freeipa/issue/8670

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
@flo-renaud flo-renaud added ipa-4-8 Mark for backport to ipa 4.8 ipa-4-9 Mark for backport to ipa 4.9 labels Jan 19, 2021
@kaleemsiddiqu
Copy link
Contributor

@flo-renaud
How about a new test case that dsconf does not works for --tls-protocol-min if protocol is not minimum as specified by crypto-policies by default?

@flo-renaud
Copy link
Contributor Author

@flo-renaud
How about a new test case that dsconf does not works for --tls-protocol-min if protocol is not minimum as specified by crypto-policies by default?

@kaleemsiddiqu
It would be more relevant in 389ds source base IMO. And I wouldn't say that it doesn't work, because according to https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/configuration_command_and_file_reference/core_server_configuration_reference#sslVersionMin:

The sslVersionMin parameter sets the minimum version of the TLS protocol Directory Server uses. However, by default, Directory Server sets this parameter automatically based on the system-wide crypto policy. If you set the crypto policy profile in the /etc/crypto-policies/config file to:

DEFAULT, FUTURE, or FIPS, Directory Server sets sslVersionMin to TLS1.2
LEGACY, Directory Server sets sslVersionMin to TLS1.0

Alternatively, you can manually set sslVersionMin to higher value than the one defined in the crypto policy.

The doc is clear that only a higher value would be taken into account.

@kaleemsiddiqu
Copy link
Contributor

LGTM, temp commit can be removed.

@flo-renaud
Copy link
Contributor Author

Thanks for the review, temp commit removed.

@kaleemsiddiqu kaleemsiddiqu added the ack Pull Request approved, can be merged label Jan 20, 2021
@flo-renaud flo-renaud added the pushed Pull Request has already been pushed label Jan 20, 2021
@flo-renaud
Copy link
Contributor Author

master:

  • 279d8b7 ipatests: fix healthcheck test for ipahealthcheck.ds.encryption

@flo-renaud flo-renaud closed this Jan 20, 2021
This was referenced Jan 20, 2021
Closed
Closed
@flo-renaud flo-renaud deleted the t8670 branch January 20, 2021 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
ack Pull Request approved, can be merged ipa-4-8 Mark for backport to ipa 4.8 ipa-4-9 Mark for backport to ipa 4.9 pushed Pull Request has already been pushed
Projects
None yet
Milestone
No milestone
2 participants
@flo-renaud @kaleemsiddiqu