From ca93d4b42d4acc206da50c7a57243f3b6727ffa5 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Mon, 11 Oct 2021 22:16:04 +0000 Subject: [PATCH] Issue #1831 - Add an option to enable TLS 1.3 "compatibility" mode. Critical note: this potentially reduces the strength of TLS 1.3 and should only be enabled if absolutely necessary to access a site. A browser restart is required for the pref change to take effect as it is set on NSS initialization. Resolves #1831 --- netwerk/base/security-prefs.js | 6 ++++++ security/manager/ssl/nsNSSComponent.cpp | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js index 3700a2ad7c..f22a49444b 100644 --- a/netwerk/base/security-prefs.js +++ b/netwerk/base/security-prefs.js @@ -112,6 +112,12 @@ pref("security.webauth.u2f_enable_usbtoken", false); // OCSP must-staple pref("security.ssl.enable_ocsp_must_staple", true); +// Enable TLS 1.3 compatmode version for bad middleware boxes? +// This is a holdover from the later draft specs and SHOULD NOT be enabled by +// default. ONLY use this when you explicitly need it. You have been warned! +// Restart required. +pref("security.ssl.enable_tls13_compat_mode", false); + // If a request is mixed-content, send an HSTS priming request to attempt to // see if it is available over HTTPS. pref("security.mixed_content.send_hsts_priming", true); diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index d58abde06a..57041d0f26 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1443,6 +1443,7 @@ static const bool FALSE_START_ENABLED_DEFAULT = true; static const bool NPN_ENABLED_DEFAULT = true; static const bool ALPN_ENABLED_DEFAULT = false; static const bool ENABLED_0RTT_DATA_DEFAULT = false; +static const bool TLS13_COMPAT_MODE_DEFAULT = false; static void ConfigureTLSSessionIdentifiers() @@ -1876,6 +1877,11 @@ nsNSSComponent::InitializeNSS() Preferences::GetBool("security.tls.enable_0rtt_data", ENABLED_0RTT_DATA_DEFAULT)); + // Set TLS 1.3 compatibility mode for bad middleware boxes? + SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE, + Preferences::GetBool("security.ssl.enable_tls13_compat_mode", + TLS13_COMPAT_MODE_DEFAULT)); + if (NS_FAILED(InitializeCipherSuite())) { MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n"));