From f432bcc925a97cbf323540a3fa0776072f078d52 Mon Sep 17 00:00:00 2001 From: Eric Windisch Date: Wed, 10 Jun 2015 13:37:31 -0400 Subject: [PATCH] Remove RC4 from the list of registry cipher suites The registry client's TLS configuration used the default cipher list, including RC4. This change copies the default cipher list from Golang 1.4 and removes RC4 from that list. RC4 ciphers are considered weak and vulnerable to a number of attacks. Uses the tlsconfig package to define allowed ciphers. Signed-off-by: Eric Windisch --- docs/registry.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/registry.go b/docs/registry.go index 8b78af96..fb08e5bd 100644 --- a/docs/registry.go +++ b/docs/registry.go @@ -20,6 +20,7 @@ import ( "github.com/docker/docker/autogen/dockerversion" "github.com/docker/docker/pkg/parsers/kernel" "github.com/docker/docker/pkg/timeoutconn" + "github.com/docker/docker/pkg/tlsconfig" "github.com/docker/docker/pkg/transport" "github.com/docker/docker/pkg/useragent" ) @@ -141,6 +142,7 @@ func NewTransport(timeout TimeoutType, secure bool) http.RoundTripper { // Avoid fallback to SSL protocols < TLS1.0 MinVersion: tls.VersionTLS10, InsecureSkipVerify: !secure, + CipherSuites: tlsconfig.DefaultServerAcceptedCiphers, } tr := &http.Transport{