274124 - Proxy: causing problems with accessing HTTPS web pages

Status: RESOLVED INCOMPLETE

(Core :: Networking, defect)

Description

[Vijay Khot]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/0.10 StumbleUpon/1.998
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/0.10 StumbleUpon/1.998

Proxy server causes problems with accessing HTTPS web pages while using the 
Firefox 1.0  and Netscape 6.0  browsers.

We tested it on several sites that use HTTPS Using WinProxy 6.0
We get error <website> could not be found. Please check the name and try again.

1. login.passport.net
2. www.Sourceforge.net
3. www.crystalgraphics.com/marketing/afiliate.main.asp

The error occurs irrespective of Firewall


Reproducible: Always
Steps to Reproduce:
1. Use proxy server (Win Proxy 6)
2. Try to login to webpage that uses HTTPS protocol


Actual Results:  
It should let you access HTTPS pages

Expected Results:  
It showed error <website> could not be found. Please check the name and try again

Comment 1

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

You have a broken user agent, 0.10 was not Gecko/20041107. Is this a custom
build?  I guess Stumbleupon is not playing nice, but it makes it hard to
diagnose things.

Not an exploit, clearing confidential flag.

If the problem is in Netscape then it's core, changing component. If it goes all
the way back to Netscape 6.0 then I suspect the problem is your proxy, not
Mozilla code (Netscape invented ssl).

From their support pages, try these suggestions:
http://www.bluecoat.com/support/self-service/4/secure_site_connection.html

All of their help gives instructions on how to set things up in IE, it's
possible they're relying on MS-only browser features though I couldn't see any
statement that they supported only IE.

Comment 2

[Ben]

I am having the same problem connecting thru Firefox and Bluecoat to any HTTPS 
pages. 

Can't connect to any of them at this time.
IE works fine.  The browser is not sending the CONNECT method out... just 
sitting there after an ACK...

Comment 3

[Darin Fisher]

-> default owner

Comment 4

[Matthias Versen [:Matti]]

Is this still an issue ?

Comment 5

[Radim Kolar]

Yes, i seen it today with Firefox 3.0.10 and Smart Cache HTTP proxy. After some time firefox stops sending CONNECT blahblah:443 HTTP/1.1 to proxy server, it just connects to proxy and hangs. It is not even able to detect that proxy closed connection because of input timeout.

Comment 6

[Jason Duell]

Radim,

Thanks for the report.  Can you be any more specific than "after some time"?  Is this easily reproducible with a deterministic set of steps?  Did you capture the network traffic?  It'd be nice to see a wireshark log.

It'd also be nice to know if this is happening with other proxy servers, so we don't wind up chasing some bug in Smart Cache.  

This bug has been open for almost 5 years without many sightings, so I'll need a little more confirmation of when/where it breaks things before I can devote serious time to it.

Comment 7

[Radim Kolar]

> Thanks for the report.  Can you be any more specific than "after some time"? 
> Is this easily reproducible with a deterministic set of steps? 
No. After starting browsing SSL enabled server, Firefox starts hanging sooner or later, lets say play with paypal account for 10 minutes. 

> Did you capture the network traffic?
No. I tried today but because this issue is timing dependant Firefox will recover after some time (minutes) of inactivity. After i installed wireshark FF worked fine again. I will try luck later.

> It'd also be nice to know if this is happening with other proxy servers, so we
> don't wind up chasing some bug in Smart Cache.  
I am pretty sure that it hangs even without proxy server too because i remember that this kind of errors started with Netscape 4.0, Netscape 3.0 worked fine. Opera have no such problems, so i am using opera for SSL sites.

If FF hangs, reloading page or clicking on links does nothing. Normal (not secure) pages still works fine. Probably something is wrong with managing outgoing SSL connections, FF thinks that connections are busy. I run Smart Cache in console to see what requests it gets from firefox. There are no CONNECT requests in SC console window. It can be 1. FF thinks that all his outgoing connections are busy and doesnt create new connections or aborts existing and reconnect on user page reload request 2. FF just connect() to proxy without sending entire HTTP request. Sadly on windows i cant do wireshare on loopback interface to discover it.
There is also another bug that FF doesnt detects that proxy cache closed SSL connection and still displays waiting for and tries to load page.