disable-SSL-compression-by-default

Gbp-Pq: Name disable-SSL-compression-by-default.patch

diff --git a/src/network/ssl/qssl.cpp b/src/network/ssl/qssl.cpp
index e22598458376dfc61383afdee4ec5c5b67df7d0d..322bbaea8f81c18995df0e9cc804a4d3e841fb93 100644 (file)
--- a/src/network/ssl/qssl.cpp
+++ b/src/network/ssl/qssl.cpp
@@ -148,8 +148,9 @@ QT_BEGIN_NAMESPACE
 
     By default, SslOptionDisableEmptyFragments is turned on since this causes
     problems with a large number of servers. SslOptionDisableLegacyRenegotiation
-    is also turned on, since it introduces a security risk. The other options
-    are turned off.
+    is also turned on, since it introduces a security risk.
+    SslOptionDisableCompression is turned on to prevent the attack publicised by
+    CRIME. The other options are turned off.
 
     Note: Availability of above options depends on the version of the SSL
     backend in use.

diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp
index 0eb01b85c80ca2e641a7c0850fc1e5e1304c6bc6..968b3f6ee2dd7ab10986f335b3238e169ac738b7 100644 (file)
--- a/src/network/ssl/qsslconfiguration.cpp
+++ b/src/network/ssl/qsslconfiguration.cpp
@@ -201,7 +201,9 @@ bool QSslConfiguration::isNull() const
             d->privateKey.isNull() &&
             d->peerCertificate.isNull() &&
             d->peerCertificateChain.count() == 0 &&
-            d->sslOptions == (QSsl::SslOptionDisableEmptyFragments|QSsl::SslOptionDisableLegacyRenegotiation));
+            d->sslOptions == ( QSsl::SslOptionDisableEmptyFragments
+                              |QSsl::SslOptionDisableLegacyRenegotiation
+                              |QSsl::SslOptionDisableCompression));
 }
 
 /*!

diff --git a/src/network/ssl/qsslconfiguration_p.h b/src/network/ssl/qsslconfiguration_p.h
index b2a76d4564b7d200c2da7377eb391d5ca23a2219..7ee34ea6e1d5e53177f3c27d7eefaaea03f7caf2 100644 (file)
--- a/src/network/ssl/qsslconfiguration_p.h
+++ b/src/network/ssl/qsslconfiguration_p.h
@@ -83,7 +83,9 @@ public:
         : protocol(QSsl::SecureProtocols),
           peerVerifyMode(QSslSocket::AutoVerifyPeer),
           peerVerifyDepth(0),
-          sslOptions(QSsl::SslOptionDisableEmptyFragments|QSsl::SslOptionDisableLegacyRenegotiation)
+          sslOptions(QSsl::SslOptionDisableEmptyFragments
+                     |QSsl::SslOptionDisableLegacyRenegotiation
+                     |QSsl::SslOptionDisableCompression)
     { }
 
     QSslCertificate peerCertificate;