diff options
| author | Richard Moore <rich@kde.org> | 2012-09-18 22:06:15 +0100 |
|---|---|---|
| committer | Shane Kearns <shane.kearns@accenture.com> | 2012-09-19 15:43:47 +0200 |
| commit | 3488f1db96dbf70bb0486d3013d86252ebf433e0 (patch) | |
| tree | cf62a3be1882768a335c69d885971ce8303a4fd8 | |
| parent | 95b6785cfd8e89012db3602ae92bf278df2b9300 (diff) | |
Disable SSL compression by default.
Disable SSL compression by default since this appears to be the a likely
cause of the currently hyped CRIME attack.
This is a backport of 5ea896fbc63593f424a7dfbb11387599c0025c74
from qt5.
Change-Id: I8fd01c2a230804d88ffa4599e7fd9293a8af9e0f
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
| -rw-r--r-- | src/network/ssl/qsslsocket_openssl.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp index b8e6c4c3e5..a712a45a5d 100644 --- a/src/network/ssl/qsslsocket_openssl.cpp +++ b/src/network/ssl/qsslsocket_openssl.cpp @@ -277,7 +277,13 @@ init_context: } // Enable all bug workarounds. +#ifdef SSL_OP_NO_COMPRESSION + // If compression is available, then disable it to avoid the CRIME attack + // if it is not available then we're not vulnerable anyway. + q_SSL_CTX_set_options(ctx, SSL_OP_ALL|SSL_OP_NO_COMPRESSION); +#else q_SSL_CTX_set_options(ctx, SSL_OP_ALL); +#endif // Initialize ciphers QByteArray cipherString; |