65142 - SSL3 clients gets EOF from TLS-only server

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Julien Pierre reports that when an NSS-based SSL3 client without 
TLS attempts to contact an NSS-based TLS server without SSL3,
the client gets error -5938 PR_END_OF_FILE_ERROR from PR_Send.
The server reports SSL_ERROR_NO_CYPHER_OVERLAP.

Julien would rather that the client experience something like 
SSL_ERROR_NO_CYPHER_OVERLAP.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

This is easy to fix, I think.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: proposed change to ssl3con.c

Comment 3

[Robert Relyea]

OK, these look good as well.

bob

Comment 4

[Julien Pierre]

Just want to make sure : will these changes address the EOF both for SSL3 client 
connecting to TLS-only server; and TLS client connecting to SSL3-only server 
(in which case the server gets EOF) ?

Thanks.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Julien, these patches change some behavior of both NSS SSL clients
and NSS SSL servers.  Whether the server reports EOF or another
error depends on client behavior.

I would like you to test these changes for me, to ensure they 
accomplish what you expect them to.  I can make a build of these
libs available for you.  Pls call to arrange.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

I have checked in the patch shown above.  
Julien, I'd like you to arrange to test this and let me know
if it's sufficient before I close this bug.

Comment 7

[Julien Pierre]

Nelson,

If you have the patch on a 3.1 build then I can easily rerun my test. But if 
it's on a 3.2 then it might take a while until I get the server to work with it.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

It's only on NSS 3.2.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

I'm marking this fixed.  If Julien later discovers that it's not 
to his satisfaction, this bug can be reopened.

Comment 10

[Julien Pierre]

I verified this as fixed FYI.

Comment 11

[Nelson Bolyard (seldom reads bugmail)]

Thank you!