1612421 - Arbitrary load failures, no response at all. Browser console shows SSL_ERROR_PROTOCOL_VERSION_ALERT

Status: RESOLVED INACTIVE

(NSS :: Libraries, defect, P1)

Description

[derin.korman]

Attachment: Screenshot 2020-01-29 12.42.33.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0

Steps to reproduce:

Hello All, Both my laptop and my desktop (Running Catalina and Mojave respectively) have been plagued with this issue for some months now. I will be browsing normally and suddenly a page won't load. It's not a DNS timeout where it reports loading, it just acts like no request was given. You can try refreshing or even open a new tab or window and paste the address, the same thing happens. If I open a private tab or restart the browser, it will load

I have uninstalled Firefox and wiped all traces of it and started from scratch on both computers but the same thing happens. I have not run into it with other browsers.

There isn't a specific page, in can be google images or some random retailer.

Actual results:

Web Developer console/requests show nothing, but If I pull up the browser console, it will list SSL_ERROR_PROTOCOL_VERSION_ALERT under requests. See screenshots

Expected results:

The page should have loaded

Comment 1

[BugBot [:suhaib / :marco]]

The priority flag is not set for this bug.
:keeler, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Dana Keeler (she/her) [:keeler]]

Can you open about:config and list the values of all of the preferences that start with security.tls? Thanks!

Comment 3

[derin.korman]

Of course, see below, they are the defaults (I don't see how this would explain the sporadic nature where the same site will open if I restart the browser or use private windows)

security.tls.enable_0rtt_data true
security.tls.enable_delegated_credentials false
security.tls.enable_post_handshake_auth false
security.tls.hello_downgrade_check true
security.tls.insecure_fallback_hosts
security.tls.version.enable-deprecated false
security.tls.version.fallback-limit 4
security.tls.version.max 4
security.tls.version.min 1

Comment 4

[Dana Keeler (she/her) [:keeler]]

Thanks! Do you have any kind of antivirus product running? Or are you behind a corporate intercepting proxy? These can often interfere with your network traffic.

Comment 5

[derin.korman]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #4)

Thanks! Do you have any kind of antivirus product running? Or are you behind a corporate intercepting proxy? These can often interfere with your network traffic.
I don't have anything running. I am at a school and but pretty sure I ran into in non-institutional networks as well. The school doesn't have DPI but does have an intercepting proxy.

What would explain what is going on (so I can talk with IT), and why is it limited to firefox? Is it some sort of bad intercept being cached by firefox until restart?

Comment 6

[Dana Keeler (she/her) [:keeler]]

There could be a couple of things going on. The intercepting proxies could be preventing Firefox from properly negotiating TLS 1.3. You could try setting security.tls.version.max to 3. It would also be helpful to see a packet trace if you can get one (you can use Wireshark).
Incidentally, do you have any add-ons?

Comment 7

[derin.korman]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #6)

There could be a couple of things going on. The intercepting proxies could be preventing Firefox from properly negotiating TLS 1.3. You could try setting security.tls.version.max to 3. It would also be helpful to see a packet trace if you can get one (you can use Wireshark).
Incidentally, do you have any add-ons?

Why does it resolve in browser restart / private windows (ie cache cleared?). On the addons. I tried uninstalling Firefox and every trace of it and it still was happening. Is there a particular filter/site you want from wireshark?

Comment 8

[Dana Keeler (she/her) [:keeler]]

(In reply to derin.korman from comment #7)

Why does it resolve in browser restart / private windows (ie cache cleared?).

No clue. Did setting that preference help?

Is there a particular filter/site you want from wireshark?

Any site that fails to load.

Comment 9

[derin.korman]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #8)

(In reply to derin.korman from comment #7)

Why does it resolve in browser restart / private windows (ie cache cleared?).

No clue. Did setting that preference help?

Is there a particular filter/site you want from wireshark?

Any site that fails to load.

It's hard to tell, the error is not constant, and is not limited to a specific site, it can be anything from google images to a random blog. I'll wait until it happens again to get the wireshark output before changing TLS settings

Comment 10

[derin.korman]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #8)

(In reply to derin.korman from comment #7)

Why does it resolve in browser restart / private windows (ie cache cleared?).

No clue. Did setting that preference help?

Is there a particular filter/site you want from wireshark?

Any site that fails to load.

Here's a screenshot of wireshark of what happens if I hit a site, I'm not good at sanitizing wireshark output, I can pm a log if the screenshot is not enough.
https://www.dropbox.com/s/u1gmae0x2y38ufq/Screenshot%202020-02-14%2020.36.32.png?dl=0

Here's just the colored packets
https://www.dropbox.com/s/4ceaexij3m1rt4a/Loadfailpackets.pcapng?dl=1

Comment 11

[BugBot [:suhaib / :marco]]

The priority flag is not set for this bug.
:keeler, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 12

[Dana Keeler (she/her) [:keeler]]

Can you email me the entire packet trace? (filtering on port 443 will sanitize it to some extent, although hostnames and IP addresses will still be present)

Comment 13

[derin.korman]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #12)

Can you email me the entire packet trace? (filtering on port 443 will sanitize it to some extent, although hostnames and IP addresses will still be present)

sent you an email.

Comment 14

[Dana Keeler (she/her) [:keeler]]

Looking at the packet trace, the handshake completes but then the server sends an RST. My guess is the issue is in one of the TLS stacks, or again, an intercepting proxy is throwing in RSTs occasionally.

Comment 15

[Benjamin Beurdouche [:beurdouche]]

Hi Derin, we've looked multiple times and couldn't reproduce at the time. Can you still reproduce this?