Changeset 181073 in webkit

Timestamp:

Mar 5, 2015 1:27:21 AM (9 years ago)

Author:

commit-queue@webkit.org

Message:

[SOUP] Disable RC4
​https://bugs.webkit.org/show_bug.cgi?id=140014

Patch by Michael Catanzaro <Michael Catanzaro> on 2015-03-05
Reviewed by Carlos Garcia Campos.

Disallow RC4-based ciphersuites when performing TLS negotiation,
because it is no longer considered secure.

• NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:

(main):

• WebProcess/EntryPoint/unix/WebProcessMain.cpp:

(main):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp (modified) (1 diff)
• WebProcess/EntryPoint/unix/WebProcessMain.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-03-05  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [SOUP] Disable RC4
+        https://bugs.webkit.org/show_bug.cgi?id=140014
+
+        Reviewed by Carlos Garcia Campos.
+
+        Disallow RC4-based ciphersuites when performing TLS negotiation,
+        because it is no longer considered secure.
+
+        * NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:
+        (main):
+        * WebProcess/EntryPoint/unix/WebProcessMain.cpp:
+        (main):
+
 2015-03-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/WebKit2/NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp

@@ -38 +38 @@
     // GnuTLS or simply stops parsing this variable. We intentionally do not
     // overwrite this priority string if it's already set by the user.
-    // Keep this in sync with WebProcessMain.cpp.
     // https://bugzilla.gnome.org/show_bug.cgi?id=738633
-    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0", 0);
+    // WARNING: This needs to be KEPT IN SYNC with WebProcessMain.cpp.
+    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0:!ARCFOUR-128", 0);
 
     return NetworkProcessMainUnix(argc, argv);

trunk/Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp

@@ -38 +38 @@
     // GnuTLS or simply stops parsing this variable. We intentionally do not
     // overwrite this priority string if it's already set by the user.
-    // Keep this in sync with NetworkProcessMain.cpp.
     // https://bugzilla.gnome.org/show_bug.cgi?id=738633
-    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0", 0);
+    // WARNING: This needs to be KEPT IN SYNC with WebProcessMain.cpp.
+    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0:!ARCFOUR-128", 0);
 
     return WebProcessMainUnix(argc, argv);