1128763 - Do insecure fallback after PR_CONNECT_RESET_ERROR for whitelisted sites only

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Masatoshi Kimura [:emk]]

Attachment: 1127285_whitelist_rst_intolerance

+++ This bug was initially created as a clone of Bug #1127285 +++

Accroding to bug 1084025 comment #99, only one of ~211k sites failed with PR_CONNECT_RESET_ERROR due to intolerance. We should consider removing PR_CONNECT_RESET_ERROR from fallback reasons. It will reduce accidental fallbacks due to network glitches.

Comment 1

[Masatoshi Kimura [:emk]]

Please apply the patch from bug 1116891 first (it is already r+'ed). I'll land it along with this bug because it will loosen security without a fix for this bug.

Comment 2

[Masatoshi Kimura [:emk]]

And I kept bug 1116891 separate because I consider to uplift bug 1116891 to branches, but this bug depends on bug 1084025 which was rejected to land beta.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 8558221 [details] [diff] [review]
1127285_whitelist_rst_intolerance

Review of attachment 8558221 [details] [diff] [review]:
-----------------------------------------------------------------

Ok - r=me with comment addressed.
As an aside, I think a more informative summary for this bug might be something like "do insecure fallback after PR_CONNECT_RESET_ERROR for whitelisted sites only" (much like the comment in nsNSSIOLayer.cpp).

::: netwerk/base/security-prefs.js
@@ +15,4 @@
>  # bug 1126652, www.animate-onlineshop.jp
>  # bug 1126654, www.gamers-onlineshop.jp
> +# bug 1127611, www.utahbar.org
> +pref("security.tls.insecure_fallback_hosts", "www.kredodirect.com.ua,web3.secureinternetbank.com,cmypage.kuronekoyamato.co.jp,www.timewarnercable.com,wayfarer.timewarnercable.com,airportwifi.com,cart.pcpitstop.com,books.wwnorton.com,emaildvla.direct.gov.uk,www.gosignmeup.com,m.getawaytoday.com,cualerts.dupaco.com,www.animate-onlineshop.jp,www.gamers-onlineshop.jp,www.utahbar.org");

Let's keep changes to this list separate from functionality changes.

Comment 4

[Masatoshi Kimura [:emk]]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #3)
> Let's keep changes to this list separate from functionality changes.

I simply removed the security-prefs.js change. It will be moot once bug 1128227 is landed anyway.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=69e7e86ec809

https://hg.mozilla.org/integration/mozilla-inbound/rev/b202f0f65da5

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b202f0f65da5

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Landed as part of a roll-up patch in bug 1128227.
https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa