Bug 162906

Summary: [SOUP] Remove SSLPolicyFlags from SoupNetworkSession
Product: WebKit Reporter: Carlos Garcia Campos <cgarcia>
Component: PlatformAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: berto, bugs-noreply, commit-queue, danw, gustavo, ivlev.igor, mcatanzaro, mrobinson
Priority: P2 Keywords: Gtk, Soup
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Carlos Garcia Campos
Reported 2016-10-04 09:04:24 PDT
All soup based ports are setting SSLUseSystemCAFile flag unconditionally, so we can just use that when creating the session like we do for all other construct parameters.
Attachments
Patch (5.41 KB, patch)
2016-10-04 09:06 PDT, Carlos Garcia Campos 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Carlos Garcia Campos
Comment 1 2016-10-04 09:06:28 PDT
Created attachment 290604 [details] Patch
WebKit Commit Bot
Comment 2 2016-10-04 09:56:11 PDT
Comment on attachment 290604 [details] Patch Clearing flags on attachment: 290604 Committed r206772: <http://trac.webkit.org/changeset/206772>
WebKit Commit Bot
Comment 3 2016-10-04 09:56:15 PDT
All reviewed patches have been landed. Closing bug.
Ihor Ivlev
Comment 4 2016-11-05 03:10:12 PDT
Hi Carlos, this patch is setting SOUP_SESSION_SSL_STRICT to FALSE in constructor and removing setSSLPolicy, so is it possible for a user to set it back to TRUE later? If not, does it look like a security issue? Thanks!
Carlos Garcia Campos
Comment 5 2016-11-05 03:59:49 PDT
(In reply to comment #4) > Hi Carlos, > > this patch is setting SOUP_SESSION_SSL_STRICT to FALSE in constructor and > removing setSSLPolicy, so is it possible for a user to set it back to TRUE > later? > If not, does it look like a security issue? > > Thanks! What user do you mean? All users of that API (GTK+ and EFL ports) were setting setSSLPolicy(SoupNetworkSession::SSLUseSystemCAFile); which sets SOUP_SESSION_SSL_STRICT to FALSE. There isn't any change in behavior in this patch. WE have always set that to FALSE, because we handle SSL errors ourselves in ResourceHandleSoup/NetworkDataTaskSoup. Loads will fail with an error in case of SSL errors even if SOUP_SESSION_SSL_STRICT is set to FALSE.
Ihor Ivlev
Comment 6 2016-11-05 04:16:59 PDT
(In reply to comment #5) > (In reply to comment #4) > > Hi Carlos, > > > > this patch is setting SOUP_SESSION_SSL_STRICT to FALSE in constructor and > > removing setSSLPolicy, so is it possible for a user to set it back to TRUE > > later? > > If not, does it look like a security issue? > > > > Thanks! > > What user do you mean? All users of that API (GTK+ and EFL ports) were > setting setSSLPolicy(SoupNetworkSession::SSLUseSystemCAFile); which sets > SOUP_SESSION_SSL_STRICT to FALSE. There isn't any change in behavior in this > patch. WE have always set that to FALSE, because we handle SSL errors > ourselves in ResourceHandleSoup/NetworkDataTaskSoup. Loads will fail with an > error in case of SSL errors even if SOUP_SESSION_SSL_STRICT is set to FALSE. Thank you for the explanation, sorry I didn't realize we're handling ssl errors in ResourceHandleSoup/NetworkDataTaskSoup.
Note You need to log in before you can comment on or make changes to this bug.