Open Bug 1102632 Opened 8 years ago Updated 5 years ago

Remove SSL_ERROR_UNSUPPORTED_VERSION from insecure-fallback-enabled error code list


(Core :: Security: PSM, defect, P5)




Tracking Status
firefox35 --- unaffected
firefox36 --- unaffected
firefox37 + wontfix
firefox38 + disabled


(Reporter: emk, Assigned: emk)


(Whiteboard: [psm-assigned])


(2 files)

Before bug 1084986:
We disables SSLv2, so NSS will never return this error.

After bug 1084986:
If NSS returns this error, it means that the server sent back a ServerHello message with a negotiated version.
The server didn't disconnect abruptly, it didn't send an alert. In other words, the server negotiated the version securely.
Therefore it's a waste of time to fallback with lower max versions.
Assignee: nobody → VYV03354
Attachment #8526740 - Flags: review?(dkeeler)
Comment on attachment 8526740 [details] [diff] [review]
Stop triggering non-secure fallback for SSL_ERROR_UNSUPPORTED_VERSION

Review of attachment 8526740 [details] [diff] [review]:

OK - seems reasonable. Let's monitor telemetry after bug 1084986 to make sure we're not encountering this error in this code (if the 0 bucket starts collecting hits, it'll probably be because of this).
Attachment #8526740 - Flags: review?(dkeeler) → review+
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
Backed out because 111 of 561 sites couldn't connect without this fallback reason.
My assumption in comment #0 was wrong :(
Resolution: FIXED → ---
> 111 of 561 sites
The list of 561 sites is bug 1084025 comment #96.
Attached patch backout patchSplinter Review
Approval Request Comment
[Feature/regressing bug #]: 1102632 (this bug)
[User impact if declined]: Users can no longer connect some sites without enabling SSLv3.
[Describe test coverage new/current, TreeHerder]: Manually tested
[Risks and why]: Very low. Just a backout of one line removal.
[String/UUID change made/needed]: none
Attachment #8557473 - Flags: approval-mozilla-aurora?
Comment on attachment 8557473 [details] [diff] [review]
backout patch

Aurora+ for the backout.
Attachment #8557473 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
I take it that this needs to be backed out of 38 as well. Can you please confirm?
Flags: needinfo?(VYV03354)
Already backed out from Nightly (38):
Flags: needinfo?(VYV03354)
:emk - is this a wontfix? Or are we going to move forward with this in the future?
Flags: needinfo?(VYV03354)
I consider to add telemetry to check what intolerance reason is used for a successful fallback connection to find unused intolerance reason.
Flags: needinfo?(VYV03354)
Whiteboard: [psm-assigned]
P1 because this is assigned.
Priority: -- → P1
Priority: P1 → P5
You need to log in before you can comment on or make changes to this bug.