Changeset 216915 in webkit

Timestamp:

May 16, 2017 12:44:41 AM (7 years ago)

Author:

Michael Catanzaro

Message:

[SOUP] Remove LATEST_RECORD_VERSION from GnuTLS priority string
​https://bugs.webkit.org/show_bug.cgi?id=172153

Based on discussion with Nikos in ​https://bugzilla.gnome.org/show_bug.cgi?id=782218, we
should remove LATEST_RECORD_VERSION from our GnuTLS priority string. This causes GnuTLS to
use the latest TLS record version (the record format is separate from the TLS protocol
version), which we needed a couple years ago (after dropping SSLv3) for maximum
compatibility with broken web servers. But it's not needed anymore, and is causing new
compatibility problems with other broken web servers, so let's get rid of it.

Reviewed by Carlos Garcia Campos.

• NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:

(main):

• WebProcess/EntryPoint/unix/WebProcessMain.cpp:

(main):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp (modified) (1 diff)
• WebProcess/EntryPoint/unix/WebProcessMain.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2017-05-16  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [SOUP] Remove LATEST_RECORD_VERSION from GnuTLS priority string
+        https://bugs.webkit.org/show_bug.cgi?id=172153
+
+        Based on discussion with Nikos in https://bugzilla.gnome.org/show_bug.cgi?id=782218, we
+        should remove LATEST_RECORD_VERSION from our GnuTLS priority string. This causes GnuTLS to
+        use the latest TLS record version (the record format is separate from the TLS protocol
+        version), which we needed a couple years ago (after dropping SSLv3) for maximum
+        compatibility with broken web servers. But it's not needed anymore, and is causing new
+        compatibility problems with other broken web servers, so let's get rid of it.
+
+        Reviewed by Carlos Garcia Campos.
+
+        * NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp:
+        (main):
+        * WebProcess/EntryPoint/unix/WebProcessMain.cpp:
+        (main):
+
 2017-05-15  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebKit2/NetworkProcess/EntryPoint/unix/NetworkProcessMain.cpp

@@ -40 +40 @@
     // https://bugzilla.gnome.org/show_bug.cgi?id=738633
     // WARNING: This needs to be KEPT IN SYNC with WebProcessMain.cpp.
-    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0:!ARCFOUR-128", 0);
+    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:!VERS-SSL3.0:!ARCFOUR-128", 0);
 
     return NetworkProcessMainUnix(argc, argv);

trunk/Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp

@@ -40 +40 @@
     // https://bugzilla.gnome.org/show_bug.cgi?id=738633
     // WARNING: This needs to be KEPT IN SYNC with WebProcessMain.cpp.
-    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:%LATEST_RECORD_VERSION:!VERS-SSL3.0:!ARCFOUR-128", 0);
+    setenv("G_TLS_GNUTLS_PRIORITY", "NORMAL:%COMPAT:!VERS-SSL3.0:!ARCFOUR-128", 0);
 
     return WebProcessMainUnix(argc, argv);