335859 - "<site> has received an incorrect or unexpected message. Error Code: -12229" when visiting site with SSL2 disabled

Status: VERIFIED FIXED

(Core :: Security: PSM, defect, P1)

Description

[:Gavin Sharp [email: [e-mail]]]

When visiting https://login.pizzapizza.ca/login.html, I get a prompt saying "login.pizzapizza.ca has received an incorrect or unexpected message. Error Code: -12229", and the site doesn't load. If I enable SSL2 by changing security.enable_ssl2 to true using about:config, I can successfully load the page. The page works in Firefox 1.5, regardless of the value of security.enable_ssl2.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Attachment: IRC Log from #developers

Comment 2

[:Gavin Sharp [email: [e-mail]]]

This happens on the 1.8 branch and trunk.

Comment 3

[chris hofmann]

looks like we need to try and narrow the regession window.  kai, any ideas?

Comment 4

[:Gavin Sharp [email: [e-mail]]]

I can try and find a regression window later tonight. I had tried when I first saw this a while ago but ended up with the window where the default value of the SSL2 pref was changed.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

1.8 branch regression range (testing with SSL2 disabled):
http://bonsai.mozilla.org/cvsquery.cgi?branch=MOZILLA_1_8_BRANCH&branchtype=match&date=explicit&mindate=2006-03-21+03%3A00&maxdate=2006-03-22+03%3A00

Seems like this was likely caused by bug 284450. I'm not sure whether that means that this is a bug with the server rather than with Firefox.

Comment 6

[Kai Engert (:KaiE:)]

This is probably the same as bug 338421, which has been fixed on trunk 2006-05-19.

Can you please retest and give an update?

Comment 7

[:Gavin Sharp [email: [e-mail]]]

I still see the error message when visiting https://login.pizzapizza.ca/login.html with todays trunk Windows nightly (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060530 Minefield/3.0a1).

Comment 8

[greg crichton]

*** Bug 340791 has been marked as a duplicate of this bug. ***

Comment 9

[Kai Engert (:KaiE:)]

Attachment: Patch v1

I was able to connect by adding this error code -12229 SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT to the list that can indicate TLS intolerance.

Nelson, do you agree this makes sense?

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 227642 [details] [diff] [review]
Patch v1

yes, I concur.  This is yet another manifestation of TLS intolerance.

Comment 11

[Nelson Bolyard (seldom reads bugmail)]

This bug is yet another argument for fixing PSM's error messages to make them readable (no big negative numbers).  bug 107491

Comment 12

[:Gavin Sharp [email: [e-mail]]]

As I understand it, this bug's solution is to prevent the message from appearing in the first place, not fixing the bad error message (which would be part of bug 107491, I imagine), so removing the late-l10n keyword.

Comment 13

[Robert Relyea]

The error can still occur if the site was not TLS intolerant.
Nelson's point is there are a large number of NSS errors which are translated by PSM. Had this error been translated, then the underlying issue may have been more obvious.

bob

Comment 14

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #13)
> The error can still occur if the site was not TLS intolerant.
> Nelson's point is there are a large number of NSS errors which are translated
> by PSM. Had this error been translated, then the underlying issue may have been
> more obvious.

I realize that - my comment was not a reply to Nelson's, I just wanted to make it clear why I was removing the late-l10n keyword. Since fixing this bug does not require adding any localizable strings, there's no reason for it to have that keyword.

Comment 15

[Kai Engert (:KaiE:)]

Attachment: Patch v2

In bug 333807 comment 1 Nelson asked me to add error code SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE, too. Marking r=nelson

Comment 16

[Kai Engert (:KaiE:)]

fixed on trunk

Comment 17

[Darin Fisher]

Comment on attachment 227733 [details] [diff] [review]
Patch v2

a=darin on behalf of drivers

Comment 18

[Kai Engert (:KaiE:)]

fixed1.8.1

Comment 19

[Nelson Bolyard (seldom reads bugmail)]

*** Bug 333807 has been marked as a duplicate of this bug. ***

Comment 20

[:Gavin Sharp [email: [e-mail]]]

Verified FIXED using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b2) Gecko/20060902 BonEcho/2.0b2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060830 Minefield/3.0a1