1355144 - Disable TLS 1.3 for Firefox 53 release

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Eric Rescorla (:ekr)]

TLS 1.3 is on in Firefox Beta, but we want it off in release pending verification.

See bug 1342082 for the corresponding 52 uplift.

Comment 1

[Eric Rescorla (:ekr)]

Attachment: Disable TLS 1.3 for FF52 Release

Comment 2

[Eric Rescorla (:ekr)]

Attachment: Bug 1355144 - Disable TLS 1.3 for FF53 Release.

Review commit: https://reviewboard.mozilla.org/r/128556/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/128556/

Comment 3

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8856602 [details]
Bug 1355144 - Disable TLS 1.3 for FF53 Release.

https://reviewboard.mozilla.org/r/128556/#review130968

Comment 4

[Eric Rescorla (:ekr)]

Comment on attachment 8856602 [details]
Bug 1355144 - Disable TLS 1.3 for FF53 Release.

This is for approval on 53-release candidate, not on 52.

Approval Request Comment
[Feature/Bug causing the regression]: bug 1310516 enabled TLS 1.3 by default
[User impact if declined]: interoperability concerns, iiuc
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: no - this is for 53 only
[Needs manual test from QE? If yes, steps to reproduce]: no, but you could test by going to https://www.cloudflare.com/, opening the page info dialog, going to the security tab, and checking that under "Technical Details" it says TLS 1.2 and not TLS 1.3
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: it just changes the default to a previously-known good value
[String changes made/needed]: none

Try push at: 
https://treeherder.mozilla.org/#/jobs?repo=try&revision=bbed84e3004e05d9faaddf3dc38081d7c86ac17d&selectedJob=90194954

Comment 5

[Eric Rescorla (:ekr)]

Liz, per our discussion today. I'll mark this a? once Keeler has r+ed.

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking for 53 - last minute change that we need in the RC.  

I'd like this to land on m-r today, after the beta to release merge is done, and before the RC build.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/213b1f8f240974b34ebd46021df3423e2b20a434

Comment 8

[Andrei Vaida [:avaida]]

(In reply to Eric Rescorla (:ekr) from comment #4)
> [Is this code covered by automated tests?]: yes
> [Has the fix been verified in Nightly?]: no - this is for 53 only
> [Needs manual test from QE? If yes, steps to reproduce]: no, but you could
> test by going to https://www.cloudflare.com/, opening the page info dialog,
> going to the security tab, and checking that under "Technical Details" it
> says TLS 1.2 and not TLS 1.3

Let's make sure this works as intended on 53.0-build1, just to be safe.

Comment 9

[Alexandru Simonca [:asimonca], Release Desktop QA]

Build ID: 20170410140322
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0

Verified as fixed on Firefox RC 53.0 on Windows 10 x64, Windows 7 x64, Mac OS X 10.12 and Ubuntu 16.04 x64.

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8856602 [details]
Bug 1355144 - Disable TLS 1.3 for FF53 Release.

This landed on m-b before the merge, so is fixed in 53. Clearing the approval flag for m-r.

Comment 11

[Eric Rescorla (:ekr)]

OK that's fine too :)

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

Oh, except I got it exactly backwards and it landed on m-r just after the merge. Right, thanks ryan. The crucial thing is that it landed and is in the RC build...