Bug 1035728

Summary:	Use TLS version 1.0 or better
Product:	Red Hat Enterprise Linux 6	Reporter:	David Jaša <djasa>
Component:	spice-gtk	Assignee:	Marc-Andre Lureau <marcandre.lureau>
Status:	CLOSED ERRATA	QA Contact:	Desktop QE <desktop-qa-list>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	cfergeau, dblechte, hkario, marcandre.lureau, pvine, rbalakri, sdenham, thoger
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	spice-gtk-0.22-2.el6	Doc Type:	Bug Fix
Doc Text:	spice-gtk advertises TLS 1.0 as its maximum supported tls version. After this update, spice-gtk will support more recent tls version provided by openssl.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-14 06:46:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1042946, 1057564

Description David Jaša 2013-11-28 10:53:14 UTC

Description of problem:
spice-gtk advertises TLS 1.0 as its maximum supported tls version. Given that TLS 1.0 is already ageing, it should advertise the highest version supported by openssl.

Version-Release number of selected component (if applicable):
spice-gtk-0.20-11.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. start a ssl test server:
openssl s_server -cert /path/to/server-cert.pem -key /path/to/server-key.pem -accept <port> <CIPHER_VERSION>
cipher version is:
   * -tls1   for TLS 1.0
   * -tls1_1 for TLS 1.1
   * -tls1_2 for TLS 1.2
2. start wireshark capture on port the server listens
3. connect using remote-viewer:
remote-viewer --spice-ca-file /path/to/ca-cert.pem [--spice-host-subject SUBJECT] spice://<host>/?tls-port=<port>

Actual results:
Connection is refused for TLS 1.1 and 1.2 (FIN packet or SSL Alert packet is sent in response to ClientHello)

Expected results:
Connection is established for all protocol versions

Additional info:
server bug: bug 1035695

Comment 1 Christophe Fergeau 2013-11-28 11:07:45 UTC

Setting to POST as there are patches on the mailing list

Comment 2 Tomas Hoger 2013-12-05 09:27:41 UTC

(In reply to Christophe Fergeau from comment #1)
> Setting to POST as there are patches on the mailing list

This apparently refers to:
http://lists.freedesktop.org/archives/spice-devel/2013-November/015605.html

Comment 3 Marc-Andre Lureau 2014-03-12 14:35:49 UTC

taking the bug, since we need an assignee, and I will update spice-gtk

Comment 6 errata-xmlrpc 2014-10-14 06:46:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1487.html