194141 - missing calls to SSL_ClearSessionCache

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Nelson Bolyard (seldom reads bugmail)]

Any time that PSM calls PK11_LogoutAll, it should also call SSL_ClearSessionCache.
This helps ensure that no authenticated SSL sessions are reused after the Logout.

Also, any time that the user changes the set of enable SSL2/ssl3/TLS versions,
or changes the set of ciphersuites permitted for any of those versions, PSM 
should call SSL_ClearSessionCache after making the change.  This ensures that
ALL SSL sessions used after the change follow the newly established preferences.

Comment 1

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

*** Bug 285440 has been marked as a duplicate of this bug. ***

Comment 3

[Mike Connor [:mconnor]]

Attachment: fix first part (call SSL_ClearSessionCache after PK11_LogoutAll)

Comment 4

[Daniel Veditz [:dveditz]]

This needs to block 1.8b4 if bug 285440 does.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 190538 [details] [diff] [review]
fix first part (call SSL_ClearSessionCache after PK11_LogoutAll)

sr=dveditz
Let's get nelson's r= on this.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 190538 [details] [diff] [review]
fix first part (call SSL_ClearSessionCache after PK11_LogoutAll)

Yes, looks right to me.  r=nelson.bolyard
I also checked that SSL_ClearSessionCache will not crash 
even if NSS has not yet been initialized.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Many thanks to Mike and Dan and Benjamin.

Comment 8

[Christian :Biesinger (don't email me, ping me on IRC)]

should a new bug be filed on the second part of comment 0?

Comment 9

[Mike Connor [:mconnor]]

dveditz's take was no, if users want to clear existing sessions they have the
ability to directly do this themself now.  We can take that discussion to a new
bug though.

We also don't have UI for these now, so we're talking about watching a lot of
prefs for changes.

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

This bug began life as a PSM bug.  When the PSM "product" was removed,
most PSM bugs got changed to "Core: Security UI", even if they were not 
UI bugs at all.  This is an example.

Some mozilla products no longer have UI to change individual cipher suites.
But PSM still has code to do so, and that code is deficient in that it 
fails to clear the SSL session cache after such changes.  

I will open another PSM bug (not UI bug) about that.  

Comment 11

[Nelson Bolyard (seldom reads bugmail)]

Note that FF and Tbird DO still have UI to change the versions of SSL that
are enabled. When those are changed, the changes do not take immediate 
effect because the cache is not cleared.  I filed bug 302803 about that.