iceweasel: Added parameter to optionally disable automatic https-upgrades - default behaviour is unchanged

modules/utilities/unix/web_browsers/iceweasel/manifests/config.pp

@@ -4,7 +4,7 @@ class iceweasel::config {
   $autostart = str2bool($secgen_params['autostart'][0])
   $start_pages = $secgen_params['start_page']
   $disable_proxy = str2bool($secgen_params['disable_proxy'][0])
-
+  $disable_https_upgrade = str2bool($secgen_params['disable_proxy'][0])
   # Setup IW for each user account
   $accounts.each |$raw_account| {
     $account = parsejson($raw_account)

modules/utilities/unix/web_browsers/iceweasel/secgen_metadata.xml

@@ -31,6 +31,10 @@
     <value>true</value>
   </default_input>
 
+  <default_input into="disable_https_upgrade">
+    <value>false</value>
+  </default_input>
+
   <requires>
     <type>update</type>
   </requires>

modules/utilities/unix/web_browsers/iceweasel/templates/user.js.erb

@@ -79,4 +79,13 @@ user_pref("browser.shell.checkDefaultBrowser", false);
 // Conditional proxy settings
 <% if @disable_proxy -%>
 user_pref("network.proxy.type", 0);
-<% end-%>
+<% end-%>
+
+<% if @disable_https_upgrade -%>
+user_pref("dom.security.https_only_mode", false);
+user_pref("dom.security.https_only_mode_ever_enabled", false);
+user_pref("dom.security.https_only_mode_pbm", false);
+user_pref("dom.security.https_first", false);
+user_pref("dom.security.https_first_pbm", false);
+user_pref("network.stricttransportsecurity.preloadlist", false);
+<% end %>

scenarios/security_audit/team_project.xml

@@ -217,6 +217,9 @@
       <input into="start_page">
         <datastore access="1">IP_addresses</datastore>
       </input>
+      <input into="disable_https_upgrade">
+        <value>true</value>
+      </input>
     </utility>
 
     <utility module_path=".*/handy_cli_tools"/>