1720118 - SSL token cache doesn't handle connections with overridden errors well

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect, P3)

Description

[David Balažic]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0

Steps to reproduce:

Visit a (non-public) website that uses HTTPS and has it's certificate expired.
Try to view certificate information (Page Info -> View Certificate)

Actual results:

this URL is opened: about:certificate? page is empty

Expected results:

actual certificate information should be shown

Comment 1

[David Balažic]

MS Edge behaves similar (I did not explore it, I'm still getting used to its GUI).

MS IE shows the certificate info normally.

Additional information:

• the web page itself is displayed by FF, as I added an exception for the invalid site certificate
• the web page allows client certificate authentication, which I use
• the site certificate is from a private (self signed) CA
• the site certificate expired in december 2020

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Security' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Johann Hofmann [:johannh]]

Works for me on https://expired.badssl.com/, can you share the full URL of the about:certificate? page?

Comment 4

[David Balažic]

this is the actual URL used: about:certificate?

There is no more of it. It ends at the question mark.

Comment 5

[David Balažic]

It also works for me correctly on https://expired.badssl.com/
Must be something else than expiration affecting it.

Strange, I visited another very similar internal website, that also has an expired certificate from the same CA and it does not show this problem.
Wait, now I tried again (with the second website), and it happened: the opened URL is about:certificate? and it shows and empty page

Strange. Can't see what makes a difference.

Comment 6

[David Balažic]

Another thing: my website is an older development server and it uses weak encryption, TLS 1.0 , RSA AES 128 CBC SHA 128bit key

Comment 7

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Hi,
Thanks for your report. https://expired.badssl.com/ is working on my end as well.
Could you please answer the following questions in order to further investigate this issue?

1- Does this issue happen with a new profile? Here is a link on how to create a new profile: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles
2- Are you using add-ons? If so could you please list them? (you can try the issue while in Safe Mode. You can find helpful info here : https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode .)
3- Does this issue occur in the latest nightly version of firefox? Here is a link from where you can download it: https://www.mozilla.org/en-US/firefox/channel/desktop/

Thanks!
Clara

Comment 8

[Johann Hofmann [:johannh]]

Okay, thanks for reporting this, it would be great if we had a way to reproduce this on a public page :)

Comment 9

[David Balažic]

(In reply to Clara Guerrero from comment #7)

Hi,
Thanks for your report. https://expired.badssl.com/ is working on my end as well.
Could you please answer the following questions in order to further investigate this issue?

1- Does this issue happen with a new profile? Here is a link on how to create a new profile: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles

Yes, it does. But again, not on first try. I opened the "Page Info" dialog several times, browsed around on the expired website, onyl after about 5 tries did the certificate info show up empty.

2- Are you using add-ons? If so could you please list them? (you can try the issue while in Safe Mode. You can find helpful info here : https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode .)

Settings/Plugins shows:
OpenH264 Video Codec provided by Cisco Systems, Inc.
Widevine Content Decryption Module provided by Google Inc.

Settings/Extensions shows nothing.

If add-ons are another category of things, please say where they are listed.

3- Does this issue occur in the latest nightly version of firefox? Here is a link from where you can download it: https://www.mozilla.org/en-US/firefox/channel/desktop/

Will test. The above is using 90.0.

Comment 10

[David Balažic]

Nightly test:

could not reproduce (it can not be reliably reproduced on regular release either, but I tried about 10 times... so)

Another thing: if I open https://expired.badssl.com/ , the page info shows a certificate issued by ESET (the antivirus software I have installed), while https://www.ssllabs.com/ssltest/analyze.html?d=expired.badssl.com shows the issuer is COMODO. The same thing happens with Intenet Explorer (it shows ESET instead of COMODO)

Comment 11

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Are you not getting the empty page anymore?
Best,
Clara

Comment 12

[David Balažic]

v90.0.2: yes, I get it
nightly: after installing Nightly and starting it, actually a new window of Firefox 90.0.2 opens. I installed Nightly 3 times in last month and it worked until fine now. Please remind me in a few days and I'll try Nightly again then.

Comment 13

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Hi David, please let me know if is still working fine on Nightly. If that's the case it means that this bug has already been resolved and it will eventually work on future Firefox Release versions.
When Release reaches Beta's actual version (92), you'll be able to see the fix. As per the Firefox Release Calendar, Release is expected to ship on 2021-09-07. You can find more info here: https://wiki.mozilla.org/Release_Management/Calendar
I'll wait for your confirmation to mark this ticket as resolved since once the natural cycle is complete you wouldn't have this bug.
Best,
Clara

Comment 14

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Attachment: issuer1.JPG

Comment 15

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Attachment: issuer2.JPG

Comment 16

[Clara Guerrero ( Need Info Brindusa Tot Please)]

(In reply to David Balažic from comment #10)

Nightly test:

could not reproduce (it can not be reliably reproduced on regular release either, but I tried about 10 times... so)

Another thing: if I open https://expired.badssl.com/ , the page info shows a certificate issued by ESET (the antivirus software I have installed), while https://www.ssllabs.com/ssltest/analyze.html?d=expired.badssl.com shows the issuer is COMODO. The same thing happens with Intenet Explorer (it shows ESET instead of COMODO)

I'm seeing COMODO for both examples, screenshots above

Comment 17

[Clara Guerrero ( Need Info Brindusa Tot Please)]

(In reply to Clara Guerrero from comment #13)

Hi David, please let me know if is still working fine on Nightly. If that's the case it means that this bug has already been resolved and it will eventually work on future Firefox Release versions.
When Release reaches Beta's actual version (92), you'll be able to see the fix. As per the Firefox Release Calendar, Release is expected to ship on 2021-09-07. You can find more info here: https://wiki.mozilla.org/Release_Management/Calendar
I'll wait for your confirmation to mark this ticket as resolved since once the natural cycle is complete you wouldn't have this bug.
Best,
Clara

I'm marking this as Resolved-Incomplete due to lack of response. If the issue is still reproducible with the latest Firefox version, feel free to reopen the bug with more information.

Regards, Clara.

Comment 18

[David Balažic]

I got this again.

Firefox version 102.0 64-bit

Clean profile.

Steps:

• start Firefox with newly created profile (note: Firefox using other older profile still running in my case)
• open https://expired.badssl.com/
• click "Advanced... Accept the risk.." until the page is shown
• left of URL bar click the padlock icon to open the menu and then open the Page Info dialog
• in the dialog click "View Certificate"
• close the certificate info tab and the Page Info dialog
• click around in the web page (no links there, just to "shake" things)
• open page source by ctrl+u
• close the page source tab
• reload by F5, then ctrl+F5
• repeat the steps 4 and 5 to get the certificate info tab

Result:
after a few tries the certificate info tab will be empty, and its URL will be about:certificate?

Comment 19

[Dana Keeler (she/her) (use needinfo) [:keeler]]

The SSL token cache doesn't really handle situations where certificate errors have been overridden. For example, it doesn't save and restore the failed cert chain, which is what you're seeing here. It also doesn't save the error bits, which could be useful in terms of getting rid of the old mechanism that saves the cert error bits across resumed connections (RememberCertErrorsTable).
Kershaw - thoughts on how to approach this?

Comment 20

[Kershaw Chang [:kershaw]]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #19)

The SSL token cache doesn't really handle situations where certificate errors have been overridden. For example, it doesn't save and restore the failed cert chain, which is what you're seeing here. It also doesn't save the error bits, which could be useful in terms of getting rid of the old mechanism that saves the cert error bits across resumed connections (RememberCertErrorsTable).
Kershaw - thoughts on how to approach this?

I'd be happy to make toke cache store error bits and the failed cert chain.
I might add two following members in SessionCacheInfo.

  Maybe<nsTArray<nsTArray<uint8_t>>> mFailedCertChainBytes;
  Maybe<CertStateBits> mErrorBits;

Do you think if this is enough?

Comment 21

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Yes, that sounds good. Like I mentioned in the meeting, bug 1781104 may have an effect on this if it lands first, though.

Comment 22

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1720118 - always use the TLS token cache r?kershaw

Comment 23

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1720118 - store certificate error override and failed certificate chain information in the TLS token cache r?kershaw!,jschanck!

Depends on D158792

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/57b8a6400749
always use the TLS token cache r=kershaw,necko-reviewers,ci-and-tooling,jmaher
https://hg.mozilla.org/integration/autoland/rev/af570580e2f7
store certificate error override and failed certificate chain information in the TLS token cache r=kershaw,jschanck,necko-reviewers

Comment 26

[Cristian Tuns]

Backed out for causing Hybrid bustages on nsHashtablesFwd.h

• Backout link
• Push with failures
• Failure Log
• Failure line: /builds/worker/workspace/obj-build/dist/include/nsHashtablesFwd.h:83:1: error: implicit instantiation of undefined template 'mozilla::detail::nsKeyClass<nsCStringHashKey>'

Comment 27

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ce139e6cb2ca
always use the TLS token cache r=kershaw,necko-reviewers,ci-and-tooling,jmaher
https://hg.mozilla.org/integration/autoland/rev/81de17138505
store certificate error override and failed certificate chain information in the TLS token cache r=kershaw,jschanck,necko-reviewers

Comment 28

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/ce139e6cb2ca
https://hg.mozilla.org/mozilla-central/rev/81de17138505