)]}'
{"nova/console/rfb/authvencrypt.py":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"479c5204db32edbe05bf53b752dc97362b021947","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                server_side\u003dFalse,"},{"line_number":142,"context_line":"                cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":143,"context_line":"                ca_certs\u003dCONF.vnc.vencrypt_ca_certs,"},{"line_number":144,"context_line":"                ssl_version\u003dssl.PROTOCOL_TLSv1_2)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"            LOG.info(\"VeNCrypt security handshake accepted\")"},{"line_number":147,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_32c2f2ea","line":144,"updated":"2018-08-09 15:46:02.000000000","message":"IMHO hardcoding a specific TLS version is pretty undesirable. There is active work to enable TLS 1.3 in all crypto libraries in the very near future, so we really want choice of version to be configurable, to avoid having to make potentially bogus assumptions about which specific versions are desired.\n\nIn Fedora there is a systemwide crypto policy which controls what versions of TLS openssl uses in all apps. IIUC, the original code should honour that global policy, so if the admin turned off TLS 1.0 / 1.1 in global policy Nova would already be doing the right thing.  By explicitly setting a version here, it overrides the system global defaults. IOW if those defaults requested 1.3, this proposed change will in fact cause a regression.","commit_id":"189bc202948a43e8f2b9588ad5f6ab6d574aced7"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"ab6798326cc01ccd6217f599187c67f15f0518a0","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                server_side\u003dFalse,"},{"line_number":142,"context_line":"                cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":143,"context_line":"                ca_certs\u003dCONF.vnc.vencrypt_ca_certs,"},{"line_number":144,"context_line":"                ssl_version\u003dssl.PROTOCOL_TLSv1_2)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"            LOG.info(\"VeNCrypt security handshake accepted\")"},{"line_number":147,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_27c2aeea","line":144,"in_reply_to":"3f79a3b5_32c2f2ea","updated":"2018-08-09 19:25:57.000000000","message":"Interesting. I\u0027ll update the launchpad bug with that info and abandon this. I didn\u0027t realize that underneath, openssl will use the systemwide setting.","commit_id":"189bc202948a43e8f2b9588ad5f6ab6d574aced7"}]}