88244 - Need a way to re-try SSL connections w/ TLS turned off

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Javier Delgadillo]

This bug is a result of Bug 87902

Basically, the current necko/PSM architecture makes it very hard to re-try a
connection the failed because the server on the other end does not implement TLS
(aka SSL v3.1) correctly.

In the PSM layer, we won't know if we're talking to a TLS intolerant site until
the first write.  At this point the server will have shut down the connection so
we'd like to set an error (ie NS_ERROR_TLS_INTOLERANT_SERVER) and have necko
re-try the connection only it tells us to turn off TLS before establishing the
connection a second time.

That will make it easier to support TLS intolerant servers when talking through
a proxy and will allow us to get rid of the current work around in the PSM layer.

Comment 1

[Bob Lord]

The other option is to use evangelism rather than code to fix the problem. 
We're exploring this option.

Comment 2

[Darin Fisher]

we already have code which automatically restarts an HTTP transaction if the
first socket read returns EOF (0 bytes read with PR_SUCCESS), which can happen
even after writing out data to the socket.  so, it might be possible for PSM to
simply force a premature EOF, which would make HTTP retry with a new socket.

so, all we'd need to figure out is how to tell PSM to not use TLS.  suggestions?

is there any way that PSM can keep a list of TLS intolerant servers?

Comment 3

[Javier Delgadillo]

We'd have to add a method to the nsISSLSocketControl interface disableTLS that
would get called on the second socket that is created.  Also we could do a
PR_SetError with a new error code so you'd know this was a TLS intolerant server.

Seems like that should be enough.

Comment 4

[Doug Turner (:dougt)]

moving milestone.  Javi, if you have a patch, we can try to get this into 0.9.2.

Comment 5

[Doug Turner (:dougt)]

err.0.9.3

Comment 6

[Javier Delgadillo]

->PSM

Comment 7

[Javier Delgadillo]

taking bug.

Comment 8

[Javier Delgadillo]

Setting priority.

Comment 9

[Javier Delgadillo]

*** Bug 88381 has been marked as a duplicate of this bug. ***

Comment 10

[Stephane Saux]

*** Bug 88142 has been marked as a duplicate of this bug. ***

Comment 11

[Javier Delgadillo]

Attachment: Patch to let necko re-try the connection.

Comment 12

[Bradley Baetz (:bbaetz)]

It looks fine to me, from the necko side of things. darin?

Comment 13

[David P. Drinan]

r=ddrinan.

Comment 14

[Darin Fisher]

the communication to necko looks good to me.

Comment 15

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 16

[Javier Delgadillo]

patch checked in.

TLS is no longer turned off for all proxied SSL connections.

Comment 17

[John Unruh]

Mass assigning QA to ckritzer.

Comment 18

[John Unruh]

Verified on 8/2 WinNT trunk.