1306985 - Re-disable TLS 1.3 by default

Status: RESOLVED FIXED

(NSS :: Build, defect)

Description

[Eric Rescorla (:ekr)]

Attachment: 0001-Disable-TLS-1.3-by-default.patch

We are seeing people who appear to be using the max version even though TLS 1.3 is still experimental. This patch just disables 1.3 and we can back out the build changes when we make TLS 1.3 non-experiment.

Comment 1

[Eric Rescorla (:ekr)]

Attachment: 0001-Disable-TLS-1.3-by-default.patch

Comment 2

[Eric Rescorla (:ekr)]

https://hg.mozilla.org/projects/nss-try/rev/0c3dcd8eef8b

Comment 3

[Martin Thomson [:mt:]]

Comment on attachment 8796969 [details] [diff] [review]
0001-Disable-TLS-1.3-by-default.patch

Review of attachment 8796969 [details] [diff] [review]:
-----------------------------------------------------------------

I see that you landed this already.

You (still) really need to fix that context problem.

Comment 4

[Eric Rescorla (:ekr)]

No, I didn't land it. That was on try.

Comment 5

[Eric Rescorla (:ekr)]

Landed at: https://hg.mozilla.org/projects/nss/rev/037236dd19a9

Comment 6

[Wan-Teh Chang]

Comment on attachment 8796969 [details] [diff] [review]
0001-Disable-TLS-1.3-by-default.patch

Review of attachment 8796969 [details] [diff] [review]:
-----------------------------------------------------------------

Please see my comment about external_tests/ssl_gtest/ssl_auth_unittest.cc.

I find it confusing to have both NSS_ENABLE_TLS_1_3 and NSS_DISABLE_TLS_1_3
as makefile variables. I probably would prefer having only NSS_ENABLE_TLS_1_3,
but I can live with having both.

::: external_tests/ssl_gtest/Makefile
@@ +40,3 @@
>  ifdef NSS_DISABLE_TLS_1_3
>  # Run parameterized tests only, for which we can easily exclude TLS 1.3
>  CPPSRCS := $(filter-out $(shell grep -l '^TEST_F' $(CPPSRCS)), $(CPPSRCS))

IMPORTANT: external_tests/ssl_gtest/ssl_auth_unittest.cc still
has code that tests the NSS_ENABLE_TLS_1_3 macro:

#ifdef NSS_ENABLE_TLS_1_3
TEST_P(TlsConnectTls13, SignatureAlgorithmServerUnsupported) {
  ...
}

TEST_P(TlsConnectTls13, SignatureAlgorithmClientUnsupported) {
  ...
}
#endif

Ideally we should change #ifdef NSS_ENABLE_TLS_1_3 to
#ifndef NSS_DISABLE_TLS_1_3.