722561 - TLSSocketFactory.java always returns that a socket is secure

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Android Sync, defect, P3)

Description

[David Chan [:dchan]]

Although the spec defines that TLS/SSL sockets are always secure [1], we may want to perform additional checks based on whether setEnabledCipherSuites() failed or not. [2]

[1] - http://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache/http/conn/ssl/SSLSocketFactory.html#isSecure%28java.net.Socket%29
[2] - https://github.com/mozilla-services/android-sync/blob/develop/src/main/java/org/mozilla/gecko/sync/net/TLSSocketFactory.java#L103

Comment 1

[Richard Newman [:rnewman]]

Fixed in develop:

https://github.com/mozilla-services/android-sync/commit/ddae1852b022d27b6e30c8017df5ecd9e1274a86

Comment 2

[Richard Newman [:rnewman]]

wrt the original direction of the bug: I'm pretty happy just allowing the default implementation to decide whether the negotiated connection was secure.

If setting the cipher suites failed, we'll just use a less-preferred one (which is probably the one we prefer, just under a different name). At no point will we negotiate a non-secure connection.

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/6ed5b46b7afe