wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-02 21:37:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1831 - Add an option to enable TLS 1.3 "compatibility" mode.

Browse source 
Critical note: this potentially reduces the strength of TLS 1.3 and
should only be enabled if absolutely necessary to access a site.
A browser restart is required for the pref change to take effect as it
is set on NSS initialization.

Resolves #1831
This commit is contained in:
Moonchild 2021-10-11 22:16:04 +00:00 • committed by roytam1
commit ca93d4b42d
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
netwerk/base/security-prefs.js
View file

@ -112,6 +112,12 @@ pref("security.webauth.u2f_enable_usbtoken", false);
// OCSP must-staple // OCSP must-staple
pref("security.ssl.enable_ocsp_must_staple", true); pref("security.ssl.enable_ocsp_must_staple", true);
// Enable TLS 1.3 compatmode version for bad middleware boxes?
// This is a holdover from the later draft specs and SHOULD NOT be enabled by
// default. ONLY use this when you explicitly need it. You have been warned!
// Restart required.
pref("security.ssl.enable_tls13_compat_mode", false);
// If a request is mixed-content, send an HSTS priming request to attempt to // If a request is mixed-content, send an HSTS priming request to attempt to
// see if it is available over HTTPS. // see if it is available over HTTPS.
pref("security.mixed_content.send_hsts_priming", true); pref("security.mixed_content.send_hsts_priming", true);

6
security/manager/ssl/nsNSSComponent.cpp
View file

@ -1443,6 +1443,7 @@ static const bool FALSE_START_ENABLED_DEFAULT = true;
static const bool NPN_ENABLED_DEFAULT = true; static const bool NPN_ENABLED_DEFAULT = true;
static const bool ALPN_ENABLED_DEFAULT = false; static const bool ALPN_ENABLED_DEFAULT = false;
static const bool ENABLED_0RTT_DATA_DEFAULT = false; static const bool ENABLED_0RTT_DATA_DEFAULT = false;
static const bool TLS13_COMPAT_MODE_DEFAULT = false;
static void static void
ConfigureTLSSessionIdentifiers() ConfigureTLSSessionIdentifiers()
@ -1876,6 +1877,11 @@ nsNSSComponent::InitializeNSS()
Preferences::GetBool("security.tls.enable_0rtt_data", Preferences::GetBool("security.tls.enable_0rtt_data",
ENABLED_0RTT_DATA_DEFAULT)); ENABLED_0RTT_DATA_DEFAULT));
// Set TLS 1.3 compatibility mode for bad middleware boxes?
SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE,
Preferences::GetBool("security.ssl.enable_tls13_compat_mode",
TLS13_COMPAT_MODE_DEFAULT));
if (NS_FAILED(InitializeCipherSuite())) { if (NS_FAILED(InitializeCipherSuite())) {
MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n")); MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n"));