415033 - Enable TLS session ticket extension in FF

Status: RESOLVED FIXED

Description

[Nagendra Modadugu]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: 

Bug 403563 describes a feature enhancement to TLS implementation in NSS: the TLS Session Ticket Extension, as specified in rfc4507bis.

This bug tracks an enhancement to FF that enables the Session Ticket Extension for all secure connections.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Nagendra Modadugu]

Created attachment 300602 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

I think this belongs to product: "core", component: "Security: PSM".

Comment 3

[timeless]

please include -p in your diff flags.

is there something that explains why we're adding the feature? (a requirements document...)

Comment 4

[Nagendra Modadugu]

Created attachment 300736 [details] [diff] [review]
 Enable TLS Session Ticket Extension in FF (v2)

Shortened SSL_ENABLE_SESSION_TICKET_EXTENSION to SSL_ENABLE_SESSION_TICKETS.

Comment 5

[Nagendra Modadugu]

(In reply to comment #3)
> please include -p in your diff flags.
> 
> is there something that explains why we're adding the feature? (a requirements
> document...)
> 

This feature is not listed in the FF3 PRD; I am describing the feature below.  Please let me know this description should also appear elsewhere.
--
The TLS Session Ticket Extension (described in RFC4507bis), allows servers to pass SSL session state to clients in the form of an encrypted ticket.  This feature allows browsers to resume connections with load balanced server pools without placing requirements on server affinity.  Note that server affinity for SSL means that load balancers need to terminate TCP connections, read the SSL session ID, and then forward the connection appropriately.  The session ticket extension allows servers and load-balancers to be state-less, at least from an SSL perspective.

Higher SSL resume rates imply lower average handshake latency (by one round trip), and lower CPU load on servers that results from avoiding public key operations.  Hopefully lower latency and CPU load will encourage service providers to increase their use of SSL.

From a security perspective, client side impact is minimal -- clients treat tickets as opaque data afterall (most of the changes are server side -- creation and usage of tickets).

We have tested interoperability with OpenSSL, which included support for the Session Ticket Extension as of the 0.9.8g release.

Comment 7

[Nagendra Modadugu]

Created attachment 304926 [details] [diff] [review]
  Enable TLS Session Ticket Extension in FF (v3)

* Added an about:config item for the TLS session ticket extension

Comment 8

[Wan-Teh Chang]

Comment on attachment 304926 [details] [diff] [review]
  Enable TLS Session Ticket Extension in FF (v3)

Kai, could you also take a look at this patch?

This patch modifies three files.

1. mozilla/netwerk/base/public/security-prefs.js

The change is good.

2. mozilla/security/manager/ssl/src/nsNSSComponent.cpp

The changes look good, except that I'm not sure if we
need to clear the session cache when the user toggles
the TLS session tickets preference setting.

Nagendra, did you set clearSessionCache = PR_TRUE
deliberately, or did you copy it from the SSL_ENABLE_TLS
code above inadvertently?

Do you think we should clear the session cache?

By the way, does your editor automatically delete blank
lines at the end of files?

3. mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp

I believe the change is now incorrect because of the
use of preference setting.  We need to delete this
code.

Comment 9

[Nagendra Modadugu]

(In reply to comment #8)
> (From update of attachment 304926 [details] [diff] [review])
> Kai, could you also take a look at this patch?
> 
> This patch modifies three files.
> 
> 1. mozilla/netwerk/base/public/security-prefs.js
> 
> The change is good.
> 
> 2. mozilla/security/manager/ssl/src/nsNSSComponent.cpp
> 
> The changes look good, except that I'm not sure if we
> need to clear the session cache when the user toggles
> the TLS session tickets preference setting.
> 
>
> Nagendra, did you set clearSessionCache = PR_TRUE
> deliberately, or did you copy it from the SSL_ENABLE_TLS
> code above inadvertently?
> 
> Do you think we should clear the session cache?
>

I decided to clear the session cache so that session ticket behavior will change immediately, but you are right -- there is no need to clear the session cache as tickets will not be sent if the option is disabled.  I have reverted this line.

> By the way, does your editor automatically delete blank
> lines at the end of files?

Yes, emacs seems to be clever that way.  I've fixed this.

> 
> 3. mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp
> 
> I believe the change is now incorrect because of the
> use of preference setting.  We need to delete this
> code.
> 

Reverted these changes.  Patch to follow shortly.

Comment 10

[Nagendra Modadugu]

Created attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

Addressing Wan-Teh's comments.  

I built Minefield using this patch and the option shows up in the about:config page as expected.

Comment 11

[Robert Sayre]

wtc, Nagendra, we're really interested in getting this for FF3. Thanks so much.

Comment 12

[Wan-Teh Chang]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

r=wtc

Comment 13

[Robert Relyea]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

r+ please add kai to the CC list, though.

bob

Comment 14

[Wan-Teh Chang]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

I don't know if two module peer's reviews are enough for a PSM
patch, or we need at least one module owner's review.

Comment 15

[Kai Engert (:kaie:)]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

r=kengert

You do not need superreview if you have two or more PSM peer/module owner reviews.

Comment 16

[Wan-Teh Chang]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

Requesting approval to check in the patch on the Mozilla trunk
for Firefox 3 Beta 4.

This patch adds a hidden preference for enabling or disabling
the TLS session ticket extension.  The preference is on by
default.  The preference has no effect if the NSS libraries
don't support this TLS extension.  This allows us to work with
different versions of (bundled or system) NSS.

Comment 17

[Damon Sicore (:damons)]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

a1.9+=damons

Comment 18

[Wan-Teh Chang]

Comment on attachment 305117 [details] [diff] [review]
Enable TLS Session Ticket Extension in FF (v3.1)

I checked in the patch on the Mozilla trunk for FF 3 Beta 4.

Checking in netwerk/base/public/security-prefs.js;
/cvsroot/mozilla/netwerk/base/public/security-prefs.js,v  <--  security-prefs.js
new revision: 1.20; previous revision: 1.19
done
Checking in security/manager/ssl/src/nsNSSComponent.cpp;
/cvsroot/mozilla/security/manager/ssl/src/nsNSSComponent.cpp,v  <--  nsNSSComponent.cpp
new revision: 1.158; previous revision: 1.157
done

Comment 19

[Joe Drew (not getting mail)]

Looks like this landed, and so I'm closing it.