1680249 - Can not open some website with firefox and without any additional error information shown

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[ovearj]

Attachment: screenshots-weibo.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0

Steps to reproduce:

1)Install firefox 83.0 stable or firefox nightly
2)open weibo.com

Hi,
Today, i found i can not access some websites, and Firefox didn't provide any specific error message like error code etc...(both firefox developer tools and error page itself).
Please help me troubleshoot this problem, thanks. Screenshots are attached below.

PS:
1.Using windows defender only(and without any intercept log)
2.Not work on new profile either
3.Other browsers work without any problem.
4.Firefox nightly still have this problem.
5.Tried with another computer with fresh windows&firefox installation, but still not work.

Actual results:

The page navigate to passport.weibo.com and then firefox show a error page without any additional information about what really happened.

Expected results:

This website should load successfully without any problem.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Dave Townsend [:mossop]]

The screenshots show the error page "Secure Connection Failed" so sounds like an SSL issue.

Comment 3

[ovearj]

(In reply to Dave Townsend [:mossop] from comment #2)

The screenshots show the error page "Secure Connection Failed" so sounds like an SSL issue.

Hi,
Thanks for you reply. I used "copy as curl" to resend this request through curl, but all things works.
Is there any method to know which ip that firefox try to connect and throw this error?

Thanks

Comment 4

[Dragana Damjanovic [:dragana]]

Can you make a HTTP log: https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

(please used clean profile, logs may contain cookies, and they will contain URIs)

Comment 5

[ovearj]

(In reply to Dragana Damjanovic [:dragana] from comment #4)

Can you make a HTTP log: https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

(please used clean profile, logs may contain cookies, and they will contain URIs)

Hi Dragana,
Here are the logs i captured follow the instructions you provided. Hope this could help you diagnose this problem

Thanks

Comment 6

[ovearj]

Attachment: firefox-logs-weibo-20201203-requested-by-dragana.zip

Comment 7

[Dragana Damjanovic [:dragana]]

The stream is reset by the server with error 0x1 (PROTOCOL_ERROR).
We are not sanding any strange headers and a different stream with same headers has already succeeded.

Does it work with an older version of Firefox, e.g. 82?

Comment 8

[ovearj]

Hi,
Have tried Firefox 82.0/81.0/80.0/70.0/60.0/50.0/40.0, all of these still perform same as 84.0.
How can i know which ip that firefox choose to use and what headers firefox send? These information may helps us diagnose this problem.

It is possible that firefox choose wrong ip to send request, and some of server may close those "bad request" directly (e.g return 444 by nginx).
I have also send another bug report for that, but no response currently.
https://bugzilla.mozilla.org/show_bug.cgi?id=1680253

Comment 9

[Kershaw Chang [:kershaw]]

From the log, I found this line:

2020-12-03 12:59:12.000000 UTC - [Parent 15784: Socket Thread]: V/nsHttp FindCoalescableConnectionByHashKey() found match conn=000001D3C9912400 key=::~.:443/[]viaDNS newCI=.S......[tlsflags0x00000000]passport.weibo.com:443 matchedCI=.S......[tlsflags0x00000000]weibo.com:443 join ok

So, this is a dup of bug 1420777.

Comment 10

[ovearj]

Hi Kershaw,
Please kindly check the logs attached here.

2020-12-03 12:59:12.000000 UTC - [Parent 15784: Socket Thread]: V/nsHttp FindCoalescableConnectionByHashKey() found match conn=000001D3C9912400 key=::~.:443/[]viaDNS newCI=.S......[tlsflags0x00000000]passport.weibo.com:443 matchedCI=.S......[tlsflags0x00000000]weibo.com:443 join ok

key=::~.:443

The log you quoted shows that Firefox try to reuse a connection that has not been successfully connected. Please also notice this is a unreachable address("::" is a reserved IPv6 address that can not be connected).
This action not only broke RFC 7540 section 9.1.1, Connection reuse, but also failed fast fallback which is already implemented by firefox.

Comment 11

[Kershaw Chang [:kershaw]]

(In reply to ovearj from comment #10)

Hi Kershaw,
Please kindly check the logs attached here.

2020-12-03 12:59:12.000000 UTC - [Parent 15784: Socket Thread]: V/nsHttp FindCoalescableConnectionByHashKey() found match conn=000001D3C9912400 key=::~.:443/[]viaDNS newCI=.S......[tlsflags0x00000000]passport.weibo.com:443 matchedCI=.S......[tlsflags0x00000000]weibo.com:443 join ok

key=::~.:443

The log you quoted shows that Firefox try to reuse a connection that has not been successfully connected. Please also notice this is a unreachable address("::" is a reserved IPv6 address that can not be connected).
This action not only broke RFC 7540 section 9.1.1, Connection reuse, but also failed fast fallback which is already implemented by firefox.

Ok, I see the where the problem is. Both weibo.com and passport.weibo.com have this coalescing key: [::~.:443/[]viaDNS]. But this key is actually invalid, since it uses an reserved ipv6 address.

2020-12-03 12:59:11.812000 UTC - [Parent 15784: Socket Thread]: V/nsHttp nsHttpConnectionMgr::nsHalfOpenSocket::OnTransportStatus STATUS_CONNECTING_TO Established New Coalescing Key # 4 for host weibo.com [::~.:443/[]viaDNS]
2020-12-03 12:59:11.999000 UTC - [Parent 15784: Socket Thread]: V/nsHttp nsHttpConnectionMgr::nsHalfOpenSocket::OnTransportStatus STATUS_CONNECTING_TO Established New Coalescing Key # 1 for host passport.weibo.com [::~.:443/[]viaDNS]

Comment 12

[Kershaw Chang [:kershaw]]

Attachment: Bug 1680249 - Don't create the coalescing key if the ip address is 0.0.0.0 or ::

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f3567ecdf5e1
Don't create the coalescing key if the ip address is 0.0.0.0 or :: r=necko-reviewers,dragana

Comment 14

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/f3567ecdf5e1

Comment 15

[Oana Botisan, Desktop QA]

I can't seem to be able to reproduce this issue using Windows 10 x64. Can you please check to see if you can still reproduce it on Firefox beta 85?
Thank you.

Comment 16

[ovearj]

Hi,
It works perfectly after install Firefox 85.0b4, thanks all of you kind guys.

2020-12-21 15:53:23.858000 UTC - [Parent 17124: Socket Thread]: V/nsHttp HalfOpenSocket: skip creating Coalescing Key for host [weibo.com]

The logs also shows the new policy works.

Comment 17

[Oana Botisan, Desktop QA]

Thank you for your answer.
Considering comment 15 and comment 16, I will mark this bug as veirfied fixed.