2035411 - Add a warning to about:neterror when SSLKEYLOGFILE is in use

Status: RESOLVED FIXED

(Core :: Networking, enhancement, P2)

Description

[Valentin Gosu [:valentin]]

It seems a bunch of AV are using SSLKEYLOGFILE to decrypt TLS traffic - and sometimes break it in unusual ways.
On Windows about 10% of users have the env var set.

@mt:

if we can detect SSLKEYLOGFILE being set, we should add something to every network error page we show.  "It looks like someone is snooping on your communications.  If you are having trouble getting online, consider disabling features.  <See su.mo for details, where we list software that engages in these practices and describe how to disable each.>"

Comment 1

[Valentin Gosu [:valentin]]

More suggestions:

• Show the warning in devtools
• Show the warning in the shield status - because if SSLKEYLOGFILE is in use, it is possible someone is decrypting your connection.

Comment 2

[Jan Brasna [:janbrasna]]

+1 to also having some alternatives, as "to every network error page we show" could be either too late, or the consumer never reached the error page in case they're stuck in some empty result / zombie connection.

Comment 3

[Valentin Gosu [:valentin]]

Attachment: Bug 2035411 - Add a warning to about:neterror when SSLKEYLOGFILE is in use r=#necko,manuel

Comment 4

[Valentin Gosu [:valentin]]

Attachment: Bug 2035411 - Add test for about:neterror with SSLKEYLOGFILE present r=manuel

Comment 5

[Valentin Gosu [:valentin]]

Screenshots of proposed warning: https://drive.google.com/drive/u/1/folders/1KINByYi8oSRTiRyqC5_ImdzQIseTHzUR

Comment 6

[Valentin Gosu [:valentin]]

Background for this bug:

SSLKEYLOGFILE is an environment variable used to make Firefox dump the encryption keys used for HTTPS connections into a file.
This is useful for debugging, or inspecting connection data with Wireshark.
However in bug 2035411, and bug 1188660 we also noticed that some anti-virus software injects this variable into Firefox to be able to decrypt HTTPS connections. In doing so, they sometimes break the connections.
Bug 2035411 is going to display a warning in network/TLS error pages when SSLKEYLOGFILE is present, telling users that software on their machine might be monitoring their connection and linking to the sumo article.
The KB article should instruct users who are seeing networking issues to check their antivirus/firewall software before filing a Firefox bug. And when filing the bug they should specify which anti-virus solution they are using.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8e47249cdf92
https://hg.mozilla.org/integration/autoland/rev/3a5e6db410aa
Add a warning to about:neterror when SSLKEYLOGFILE is in use r=necko-reviewers,fluent-reviewers,desktop-theme-reviewers,frontend-codestyle-reviewers,bolsson,jesup,emz,Itiel
https://github.com/mozilla-firefox/firefox/commit/dd4c72c8e1b0
https://hg.mozilla.org/integration/autoland/rev/3408202d5db2
Add test for about:neterror with SSLKEYLOGFILE present r=emz

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9a4b4546ae19
https://hg.mozilla.org/integration/autoland/rev/9e53c563125a
Revert "Bug 2035411 - Add test for about:neterror with SSLKEYLOGFILE present r=emz" for causing xpcshells and mochitests failures at dom/security

Comment 9

[Silaghi Andreea]

Backout for causing xpcshells and mochitests failures at dom/security

push with failure
xpcshells
mochitests

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/061f081d2f51
https://hg.mozilla.org/integration/autoland/rev/c96a8eabf2ce
Add a warning to about:neterror when SSLKEYLOGFILE is in use r=necko-reviewers,fluent-reviewers,desktop-theme-reviewers,frontend-codestyle-reviewers,bolsson,jesup,emz,Itiel
https://github.com/mozilla-firefox/firefox/commit/63e65ddf9c65
https://hg.mozilla.org/integration/autoland/rev/47b90175fca9
Add test for about:neterror with SSLKEYLOGFILE present r=emz

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/417ef791ded2
https://hg.mozilla.org/integration/autoland/rev/cec52348e329
Revert "Bug 2035411 - Add test for about:neterror with SSLKEYLOGFILE present r=emz" for causing build bustages.

Comment 12

[Serban Stanca [:SerbanS]]

Reverted this because it was causing build bustages.

• Revert link
• Push with failures
• Failure Log
• Failure line: gmake[2]: *** No rule to make target 'backend.FasterMakeBackend', needed by 'pre-export'.

Please also check this.

Comment 13

[BugBot [:suhaib / :marco]]

There are some r+ patches which didn't land and no activity in this bug for 1 week.
:valentin, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2dcdae873fef
https://hg.mozilla.org/integration/autoland/rev/7a378c1ff778
Add a warning to about:neterror when SSLKEYLOGFILE is in use r=necko-reviewers,fluent-reviewers,desktop-theme-reviewers,frontend-codestyle-reviewers,bolsson,jesup,emz,Itiel
https://github.com/mozilla-firefox/firefox/commit/6bb9d9a0bf1b
https://hg.mozilla.org/integration/autoland/rev/3000d68ae25d
Add test for about:neterror with SSLKEYLOGFILE present r=emz

Comment 15

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/7a378c1ff778
https://hg.mozilla.org/mozilla-central/rev/3000d68ae25d