1896625 - Support creating TLS tunnel for WebrtcTCPSocket

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Kershaw Chang [:kershaw]]

See bug 1885594 #comment 22.
necko needs to make some change in order to support setting TLS tunnel for WebrtcTCPSocket

Comment 1

[Kershaw Chang [:kershaw]]

Attachment: Bug 1896625 - When using HTTPS proxy, setup TLS tunnel for CONNECT only request, r=#necko

Comment 2

[Byron Campen [:bwc]]

What do you think about the possibility of allowing this even for HTTP proxies (see https://bugzilla.mozilla.org/show_bug.cgi?id=1885594#c33)?

Comment 3

[Kershaw Chang [:kershaw]]

(In reply to Byron Campen [:bwc] from comment #2)

What do you think about the possibility of allowing this even for HTTP proxies (see https://bugzilla.mozilla.org/show_bug.cgi?id=1885594#c33)?

I think it'd doable, but we need another flag to let necko know when to setup a tunnel when using HTTP proxy.
If you think we should support it, I can add such a flag.

Comment 4

[Byron Campen [:bwc]]

Yeah, I think it is reasonable to be able to tunnel TLS through an HTTP proxy, even though it is a bit weird.

Comment 5

[brian.m.pettis]

Let me know if I can help / test / assist / gather logs if needed.

Comment 6

[Kershaw Chang [:kershaw]]

(In reply to brian.m.pettis from comment #5)

Let me know if I can help / test / assist / gather logs if needed.

I've create a try push that ensures a TLS tunnel is always set up when a proxy is used.
Could you test if it works?
You could also find the instructions for downloading a build in bug 1885594 #comment 34.

Thanks.

Comment 7

[Kershaw Chang [:kershaw]]

Attachment: Bug 1896625 - Add a new flag to allow to always setup TLS tunnel, r=#necko

Comment 8

[Kershaw Chang [:kershaw]]

Attachment: Bug 1896625 - Allow WebrtcTCPSocket to setup tls tunnel for all proxy, r=bwc

Comment 9

[brian.m.pettis]

I was able to get some testing done today on my macOS and Windows 11.
Looks like Secure TURN (TLS) through an HTTP Proxy works on this try build you provided.

Appreciate all the work on this!

Comment 10

[brian.m.pettis]

Would it be possible to get a build that includes this fix for tunneling via HTTP proxy AND the fix in bug 1885594, to test with?

Comment 11

[Byron Campen [:bwc]]

I just pushed this to try. It should probably work.

Comment 12

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/jobs?repo=try&revision=8e69ae94bfded33f360b6ed01f844cd0d28ae37b

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9bce31ff0746
When using HTTPS proxy, setup TLS tunnel for CONNECT only request, r=necko-reviewers,jesup
https://hg.mozilla.org/integration/autoland/rev/6acbf1daad22
Add a new flag to allow to always setup TLS tunnel, r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/693839ae57f9
Allow WebrtcTCPSocket to setup tls tunnel for all proxy, r=bwc

Comment 14

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/9bce31ff0746
https://hg.mozilla.org/mozilla-central/rev/6acbf1daad22
https://hg.mozilla.org/mozilla-central/rev/693839ae57f9

Comment 15

[Byron Campen [:bwc]]

What do you think about an ESR 128 uplift for this? Our webex contact says about 10% of Firefox users on webex are running into problems because they don't have this fix.

Comment 16

[Kershaw Chang [:kershaw]]

(In reply to Byron Campen [:bwc] from comment #15)

What do you think about an ESR 128 uplift for this? Our webex contact says about 10% of Firefox users on webex are running into problems because they don't have this fix.

I think these are low-risk changes, so yes, let's uplift these patches to esr 128.
I'll create a squashed patch to make uplift easier.

Comment 17

[Byron Campen [:bwc]]

Thanks!

Comment 18

[Kershaw Chang [:kershaw]]

Attachment: Bug 1896625 - Support creating TLS tunnel for WebrtcTCPSocket,

Comment 19

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Webrtc connection fail.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low
• Explanation of risk level: This patch is verfified.
• String changes made/needed: N/A
• Is Android affected?: yes

Comment 20

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/f80574ecc837