From ca93d4b42d4acc206da50c7a57243f3b6727ffa5 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Mon, 11 Oct 2021 22:16:04 +0000 Subject: [PATCH 1/4] Issue #1831 - Add an option to enable TLS 1.3 "compatibility" mode. Critical note: this potentially reduces the strength of TLS 1.3 and should only be enabled if absolutely necessary to access a site. A browser restart is required for the pref change to take effect as it is set on NSS initialization. Resolves #1831 --- netwerk/base/security-prefs.js | 6 ++++++ security/manager/ssl/nsNSSComponent.cpp | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js index 3700a2ad7c..f22a49444b 100644 --- a/netwerk/base/security-prefs.js +++ b/netwerk/base/security-prefs.js @@ -112,6 +112,12 @@ pref("security.webauth.u2f_enable_usbtoken", false); // OCSP must-staple pref("security.ssl.enable_ocsp_must_staple", true); +// Enable TLS 1.3 compatmode version for bad middleware boxes? +// This is a holdover from the later draft specs and SHOULD NOT be enabled by +// default. ONLY use this when you explicitly need it. You have been warned! +// Restart required. +pref("security.ssl.enable_tls13_compat_mode", false); + // If a request is mixed-content, send an HSTS priming request to attempt to // see if it is available over HTTPS. pref("security.mixed_content.send_hsts_priming", true); diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index d58abde06a..57041d0f26 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1443,6 +1443,7 @@ static const bool FALSE_START_ENABLED_DEFAULT = true; static const bool NPN_ENABLED_DEFAULT = true; static const bool ALPN_ENABLED_DEFAULT = false; static const bool ENABLED_0RTT_DATA_DEFAULT = false; +static const bool TLS13_COMPAT_MODE_DEFAULT = false; static void ConfigureTLSSessionIdentifiers() @@ -1876,6 +1877,11 @@ nsNSSComponent::InitializeNSS() Preferences::GetBool("security.tls.enable_0rtt_data", ENABLED_0RTT_DATA_DEFAULT)); + // Set TLS 1.3 compatibility mode for bad middleware boxes? + SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE, + Preferences::GetBool("security.ssl.enable_tls13_compat_mode", + TLS13_COMPAT_MODE_DEFAULT)); + if (NS_FAILED(InitializeCipherSuite())) { MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n")); From dc4bf9b8237591f7dfdd40b14c14433facf482f9 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 28 Mar 2023 13:36:37 +0200 Subject: [PATCH 2/4] Issue #2180 - Add pref to control NSS TLS 1.3 protocol downgrade sentinel --- netwerk/base/security-prefs.js | 9 +++++++++ security/manager/ssl/nsNSSComponent.cpp | 15 ++++++++++++++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js index f22a49444b..d0adccd879 100644 --- a/netwerk/base/security-prefs.js +++ b/netwerk/base/security-prefs.js @@ -118,6 +118,15 @@ pref("security.ssl.enable_ocsp_must_staple", true); // Restart required. pref("security.ssl.enable_tls13_compat_mode", false); +// Enable TLS 1.3 hello downgrade sentinel? +// One of the key protections offered by TLS 1.3 is preventing protocol downgrades +// as part of the initial handshake. +// Some domains, middleware and transparent routers may try to downgrade connections +// this way (which is a bad thing!). To allow users to connect anyway this +// check can be disabled here. Default is for the sentinel to be enabled, preventing +// bad downgrades of the protocol version. +pref("security.tls.hello_downgrade_check", true); + // If a request is mixed-content, send an HSTS priming request to attempt to // see if it is available over HTTPS. pref("security.mixed_content.send_hsts_priming", true); diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index 57041d0f26..03a7fd7d46 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1444,6 +1444,7 @@ static const bool NPN_ENABLED_DEFAULT = true; static const bool ALPN_ENABLED_DEFAULT = false; static const bool ENABLED_0RTT_DATA_DEFAULT = false; static const bool TLS13_COMPAT_MODE_DEFAULT = false; +static const bool HELLO_DOWNGRADE_CHECK_DEFAULT = true; static void ConfigureTLSSessionIdentifiers() @@ -1857,7 +1858,7 @@ nsNSSComponent::InitializeNSS() SSL_OptionSetDefault(SSL_ENABLE_RENEGOTIATION, SSL_RENEGOTIATE_REQUIRES_XTN); SSL_OptionSetDefault(SSL_ENABLE_EXTENDED_MASTER_SECRET, true); - + SSL_OptionSetDefault(SSL_ENABLE_FALSE_START, Preferences::GetBool("security.ssl.enable_false_start", FALSE_START_ENABLED_DEFAULT)); @@ -1881,6 +1882,13 @@ nsNSSComponent::InitializeNSS() SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE, Preferences::GetBool("security.ssl.enable_tls13_compat_mode", TLS13_COMPAT_MODE_DEFAULT)); + + // Set TLS 1.3 hello downgrade sentinel? + bool enableDowngradeCheck = + Preferences::GetBool("security.tls.hello_downgrade_check", + HELLO_DOWNGRADE_CHECK_DEFAULT); + SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck); + if (NS_FAILED(InitializeCipherSuite())) { @@ -2044,6 +2052,11 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic, if (prefName.EqualsLiteral("security.tls.version.min") || prefName.EqualsLiteral("security.tls.version.max")) { (void) setEnabledTLSVersions(); + } else if (prefName.EqualsLiteral("security.tls.hello_downgrade_check")) { + bool enableDowngradeCheck = + Preferences::GetBool("security.tls.hello_downgrade_check", + HELLO_DOWNGRADE_CHECK_DEFAULT); + SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck); } else if (prefName.EqualsLiteral("security.ssl.require_safe_negotiation")) { bool requireSafeNegotiation = Preferences::GetBool("security.ssl.require_safe_negotiation", From f6f0a495a70a3eb066d8ebdea35fb41d0b40060c Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 28 Mar 2023 17:59:19 +0200 Subject: [PATCH 3/4] Issue #2180 - Follow-up: Move sentinel check up a bit. --- security/manager/ssl/nsNSSComponent.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index 03a7fd7d46..bc660f8a55 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1858,7 +1858,13 @@ nsNSSComponent::InitializeNSS() SSL_OptionSetDefault(SSL_ENABLE_RENEGOTIATION, SSL_RENEGOTIATE_REQUIRES_XTN); SSL_OptionSetDefault(SSL_ENABLE_EXTENDED_MASTER_SECRET, true); - + + // Set TLS 1.3 hello downgrade sentinel? + bool enableDowngradeCheck = + Preferences::GetBool("security.tls.hello_downgrade_check", + HELLO_DOWNGRADE_CHECK_DEFAULT); + SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck); + SSL_OptionSetDefault(SSL_ENABLE_FALSE_START, Preferences::GetBool("security.ssl.enable_false_start", FALSE_START_ENABLED_DEFAULT)); @@ -1883,12 +1889,6 @@ nsNSSComponent::InitializeNSS() Preferences::GetBool("security.ssl.enable_tls13_compat_mode", TLS13_COMPAT_MODE_DEFAULT)); - // Set TLS 1.3 hello downgrade sentinel? - bool enableDowngradeCheck = - Preferences::GetBool("security.tls.hello_downgrade_check", - HELLO_DOWNGRADE_CHECK_DEFAULT); - SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck); - if (NS_FAILED(InitializeCipherSuite())) { From 64bc4788edd64990f3ab845d05847820bd2b569a Mon Sep 17 00:00:00 2001 From: Job Bautista Date: Tue, 28 Mar 2023 16:55:14 +0800 Subject: [PATCH 4/4] [Pale-Moon] Issue MoonchildProductions/UXP#2165 - Follow-up: Simplify OS detection for MOZ_SHARED_ICU check. --- application/palemoon/installer/package-manifest.in | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/application/palemoon/installer/package-manifest.in b/application/palemoon/installer/package-manifest.in index eee4f4699c..74983a803e 100644 --- a/application/palemoon/installer/package-manifest.in +++ b/application/palemoon/installer/package-manifest.in @@ -90,13 +90,7 @@ @RESPATH@/@ICU_DATA_FILE@ #endif #ifdef MOZ_SHARED_ICU -#ifdef XP_WIN -@BINPATH@/icu@MOZ_ICU_VERSION@.dll -#elif defined(XP_MACOSX) -@BINPATH@/icu@MOZ_ICU_VERSION@.dylib -#elif defined(XP_UNIX) -@BINPATH@/libicu@MOZ_ICU_VERSION@.so -#endif +@BINPATH@/@DLL_PREFIX@icu@MOZ_ICU_VERSION@@DLL_SUFFIX@ #endif #ifdef MOZ_GTK3 @BINPATH@/@DLL_PREFIX@mozgtk@DLL_SUFFIX@