1242926 - TLS insecure fallback fails intermittently

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Masatoshi Kimura [:emk]]

Attachment: update_whitelist

Steps to reproduce:
1. Apply the attachment.
2. Run the following command:
   <path/to/xpcshell> genIntolerantFallbackList.js IntolerantFallbackList.h
3. Search the log file (IntolerantFallbackList.errors) for NS_ERROR_NET_RESET.

Actual result:
Many NS_ERROR_NET_RESET will be found.

Expected result:
No NS_ERROR_NET_RESET should be found. The HTTP handler should handle net reset errors gracefully.

Regression range:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=da1d2c63b068&tochange=0ee0565977e1

Comment 1

[Masatoshi Kimura [:emk]]

Attachment: revert the network.http.request.max-attempts change

If the server is RC4-only and TLS 1.1 intolerant, PSM will generate the fake net reset error three times:
1. for TLS 1.2 without RC4,
2. for TLS 1.2 with RC4, and
3. for TLS 1.1 with RC4.

Moreover, if the 4th request fails due to network glitch, PSM will forget the intolerance info and retry the fallback sequence. That is, three more fake net reset errors.

So network.http.request.max-attempts=3 is a bit too low.

Comment 2

[Patrick McManus [:mcmanus]]

10 is really a ridiculous number for the http logic. I would take a patch at a compromise of 6(?)

even better maybe we ought to change the code to something like ERROR_NET_INTERNAL_RESET in both necko and psm and have that not count against the limit of 3

Comment 3

[Masatoshi Kimura [:emk]]

Attachment: Increase the max retry attempt number

OK, 6 seems to be enough for https.
I made the change minimal because I would like to uplift this to 46.

Comment 4

[Masatoshi Kimura [:emk]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b9ca7f65cdb74dcc0d37e124e40cbfbee28c6cf6
Bug 1242926 - Increase the max retry attempt number. r=mcmanus

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b9ca7f65cdb7

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b9ca7f65cdb7

Comment 7

[Masatoshi Kimura [:emk]]

Comment on attachment 8712625 [details] [diff] [review]
Increase the max retry attempt number

Approval Request Comment
[Feature/regressing bug #]: bug 1236277
[User impact if declined]: Sometimes users will see error page when connecting to outdated https server.
[Describe test coverage new/current, TreeHerder]:
[Risks and why]: Very low, pref change only. The new value is still lower than the pre-bug 1236277 value.
[String/UUID change made/needed]: none

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8712625 [details] [diff] [review]
Increase the max retry attempt number

Minor tweak to number of retries for fallback, please uplift to aurora.

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/c68f5e9a431a