wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 00:38:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'origin/tracking' into custom

Browse source
This commit is contained in:
roytam1 2023-03-29 11:07:18 +08:00
commit ead737cb49
3 changed files with 35 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
application/palemoon/installer/package-manifest.in
View file

@ -90,13 +90,7 @@
@RESPATH@/@ICU_DATA_FILE@
#endif
#ifdef MOZ_SHARED_ICU
#ifdef XP_WIN
@BINPATH@/icu@MOZ_ICU_VERSION@.dll
#elif defined(XP_MACOSX)
@BINPATH@/icu@MOZ_ICU_VERSION@.dylib
#elif defined(XP_UNIX)
@BINPATH@/libicu@MOZ_ICU_VERSION@.so
#endif
@BINPATH@/@DLL_PREFIX@icu@MOZ_ICU_VERSION@@DLL_SUFFIX@
#endif
#ifdef MOZ_GTK3
@BINPATH@/@DLL_PREFIX@mozgtk@DLL_SUFFIX@

15
netwerk/base/security-prefs.js
View file

@ -112,6 +112,21 @@ pref("security.webauth.u2f_enable_usbtoken", false);
// OCSP must-staple
pref("security.ssl.enable_ocsp_must_staple", true);
// Enable TLS 1.3 compatmode version for bad middleware boxes?
// This is a holdover from the later draft specs and SHOULD NOT be enabled by
// default. ONLY use this when you explicitly need it. You have been warned!
// Restart required.
pref("security.ssl.enable_tls13_compat_mode", false);
// Enable TLS 1.3 hello downgrade sentinel?
// One of the key protections offered by TLS 1.3 is preventing protocol downgrades
// as part of the initial handshake.
// Some domains, middleware and transparent routers may try to downgrade connections
// this way (which is a bad thing!). To allow users to connect anyway this
// check can be disabled here. Default is for the sentinel to be enabled, preventing
// bad downgrades of the protocol version.
pref("security.tls.hello_downgrade_check", true);
// If a request is mixed-content, send an HSTS priming request to attempt to
// see if it is available over HTTPS.
pref("security.mixed_content.send_hsts_priming", true);

19
security/manager/ssl/nsNSSComponent.cpp
View file

@ -1443,6 +1443,8 @@ static const bool FALSE_START_ENABLED_DEFAULT = true;
static const bool NPN_ENABLED_DEFAULT = true;
static const bool ALPN_ENABLED_DEFAULT = false;
static const bool ENABLED_0RTT_DATA_DEFAULT = false;
static const bool TLS13_COMPAT_MODE_DEFAULT = false;
static const bool HELLO_DOWNGRADE_CHECK_DEFAULT = true;
static void
ConfigureTLSSessionIdentifiers()
@ -1857,6 +1859,12 @@ nsNSSComponent::InitializeNSS()
SSL_OptionSetDefault(SSL_ENABLE_EXTENDED_MASTER_SECRET, true);
// Set TLS 1.3 hello downgrade sentinel?
bool enableDowngradeCheck =
Preferences::GetBool("security.tls.hello_downgrade_check",
HELLO_DOWNGRADE_CHECK_DEFAULT);
SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck);
SSL_OptionSetDefault(SSL_ENABLE_FALSE_START,
Preferences::GetBool("security.ssl.enable_false_start",
FALSE_START_ENABLED_DEFAULT));
@ -1876,6 +1884,12 @@ nsNSSComponent::InitializeNSS()
Preferences::GetBool("security.tls.enable_0rtt_data",
ENABLED_0RTT_DATA_DEFAULT));
// Set TLS 1.3 compatibility mode for bad middleware boxes?
SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE,
Preferences::GetBool("security.ssl.enable_tls13_compat_mode",
TLS13_COMPAT_MODE_DEFAULT));
if (NS_FAILED(InitializeCipherSuite())) {
MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n"));
@ -2038,6 +2052,11 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
if (prefName.EqualsLiteral("security.tls.version.min") ||
prefName.EqualsLiteral("security.tls.version.max")) {
(void) setEnabledTLSVersions();
} else if (prefName.EqualsLiteral("security.tls.hello_downgrade_check")) {
bool enableDowngradeCheck =
Preferences::GetBool("security.tls.hello_downgrade_check",
HELLO_DOWNGRADE_CHECK_DEFAULT);
SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck);
} else if (prefName.EqualsLiteral("security.ssl.require_safe_negotiation")) {
bool requireSafeNegotiation =
Preferences::GetBool("security.ssl.require_safe_negotiation",