918120 - Reduce the OCSP timeout values

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Comment 1

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 806958 [details] [diff] [review]
reduce-ocsp-timeout

Review of attachment 806958 [details] [diff] [review]:
-----------------------------------------------------------------

As part of this, I think you should revert the patch that landed in bug 404059.

::: security/manager/ssl/src/nsNSSComponent.cpp
@@ +930,5 @@
>    CERT_SetOCSPFailureMode( ocspRequired ?
>                             ocspMode_FailureIsVerificationFailure
>                             : ocspMode_FailureIsNotAVerificationFailure);
> +  if (ocspRequired) {
> +    CERT_SetOCSPTimeout(5);

I'm not sure it's worth setting a different timeout in the case of require ocsp (particularly since all of 2 people have it set). I'd be open to discussion, though.

Comment 3

[Camilo Viecco (:cviecco)]

(In reply to David Keeler (:keeler) from comment #2)
> Comment on attachment 806958 [details] [diff] [review]
> reduce-ocsp-timeout
> 
> Review of attachment 806958 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> As part of this, I think you should revert the patch that landed in bug
> 404059.
It is tempting to remove, but that patch affects all HTTP requests issued
on behalf of NSS. I just want to affect the OCSP timeouts. (which
are dominated only by latency/network reachability).

> 
> ::: security/manager/ssl/src/nsNSSComponent.cpp
> @@ +930,5 @@
> >    CERT_SetOCSPFailureMode( ocspRequired ?
> >                             ocspMode_FailureIsVerificationFailure
> >                             : ocspMode_FailureIsNotAVerificationFailure);
> > +  if (ocspRequired) {
> > +    CERT_SetOCSPTimeout(5);
> 
> I'm not sure it's worth setting a different timeout in the case of require
> ocsp (particularly since all of 2 people have it set). I'd be open to
> discussion, though.

Actually we discussed it with bsmith yesterday and deiced to leave the timeout
at 10 secs for users with required ocsp. And it was .1% of users of that study
which is a few hundred thousand (not including to TBB).

Comment 4

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout (v1.1)

Comment 5

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout (alt v1)

Comment 6

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout (alt v1.1)

Comment 7

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout (alt v1.2)

Comment 8

[Camilo Viecco (:cviecco)]

Comment on attachment 808024 [details] [diff] [review]
reduce-ocsp-timeout (alt v1.2)

Review of attachment 808024 [details] [diff] [review]:
-----------------------------------------------------------------

what do you think of this alternative... I think it is clearer but if you think the other one is better please let me know.

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 808024 [details] [diff] [review]
reduce-ocsp-timeout (alt v1.2)

Review of attachment 808024 [details] [diff] [review]:
-----------------------------------------------------------------

I like this alternative better.

::: security/manager/ssl/src/nsNSSComponent.cpp
@@ +930,5 @@
>    CERT_SetOCSPFailureMode( ocspRequired ?
>                             ocspMode_FailureIsVerificationFailure
>                             : ocspMode_FailureIsNotAVerificationFailure);
>  
> +  int OCSPTimeoutSecs = 2;

Maybe ocspTimeoutSeconds?

Comment 10

[Camilo Viecco (:cviecco)]

Attachment: reduce-ocsp-timeout

Comment 11

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 815576 [details] [diff] [review]
reduce-ocsp-timeout

Review of attachment 815576 [details] [diff] [review]:
-----------------------------------------------------------------

I looked at how Microsoft's stack does things, which is a 15 second timeout:
http://blogs.msdn.com/b/ieinternals/archive/2011/04/07/enabling-certificate-revocation-check-failure-warnings-in-internet-explorer.aspx
http://technet.microsoft.com/en-us/library/ee619754%28v=ws.10%29.aspx

I support doing this as a stepping stone to turning OCSP fetching off by default. This patch will have a similar affect as that for people who have very, very slow networks, and I don't think the the speed of your network should be much of a factor here. So, if you agree with turning OCSP fetching off by default for everybody soon, go ahead and check in this patch.

You didn't include a test for this change. How did you test it?

Comment 12

[Camilo Viecco (:cviecco)]

I tested it via wireshark...  With the current code in central I could test it via a mochitest site (to EV verification and time the time it takes to fallback to dv) or wait until the thin certverify idl lands and do more testing there. I agree lack of tests is not the best.

Do you want to up the timeout to 15 secs when ocsp is required?

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5ee559599846

Comment 14

[Doug Turner (:dougt)]

Comment on attachment 815576 [details] [diff] [review]
reduce-ocsp-timeout

[Approval Request Comment]
Bug caused by (feature/regressing bug #): None.
User impact if declined: None.
Testing completed (on m-c, etc.): None.
Risk to taking this patch (and alternatives if risky): Very little.
String or IDL/UUID changes made by this patch: None.

Basically this will reduce the OCSP timeout for people that haven't made OCSP required.  This is good because we have data that shows that some TLS handshakes are waiting for this timeout to continue! :(

Comment 15

[Ryan VanderMeulen [:RyanVM]]

This landed on Aurora.
https://hg.mozilla.org/releases/mozilla-aurora/rev/639866593563

Comment 16

[Tracy Walker [:tracy]]

Can you provide STR's to verify this, please?

Comment 17

[Ada [:adalucinet]]

Can you please answer to comment 16 so that QA can verify this as soon as possible?

Comment 18

[Camilo Viecco (:cviecco)]

1. Chose any non-ev site. 
2. Load it in FF, view the certificate and note the hostname in the OCSP URL iformation (this is located under the  Authority Information Access extension of the ceritifate
3. Modify the /etc/hosts file (in OSX, Linux. I think there is an equivalent in windows) so that the hostname for the ocsp is routed to your localmachine (127.0.0.1).
4. Stop FF/
5. Start a packet capture
6. Start Firefox and go to the site chosen in step 1.
7. Stop the capture
8. Open wireshark.
9. Verify that the ocsp reqest is going to your machine. 
10. Notice the timing between the server hello message and the time actual data is being sent in the tls/ssl protected stream. It should be more than 2 and less than 4 seconds.

Comment 19

[Camilo Viecco (:cviecco)]

Note: a value slightly higher than 4 is also acceptable.

Comment 20

[Ada [:adalucinet]]

Thank you for the STR!

I couldn't reproduce the initial issue with the provided steps and navigating to http://www.linkedin.com/. Could you please advice what else can I try in order to reproduce this issue?

On Firefox 26 beta 8 (Build ID: 20131125215016) on Windows 7 64bit, Ubuntu 12.04 64bit and Mac OS X 10.8.5 I get the following results:
- Windows: the timing between the server hello message and the time actual data is being sent is 4.313 seconds
- Ubuntu: the timing is 0.306 seconds
- Mac OS X: the timing is 3.013 seconds
On all 3 platforms the OCSP Request is going to my machine.
Could you please confirm based on this screenshot: http://goo.gl/H8MWKY that the values (marked with red line) are the good ones? Although, the timing for Ubuntu is way too small.

Comment 21

[Camilo Viecco (:cviecco)]

The values from the screenshot look good. My guess for the difference between ubuntu and others is that you have an actual server http server running on your box or you are sending a tcp rst packet. Making the connection close fast, for windows and OSX my guess is that there is nothing waiting for the tcp-syn and thus firefox need to wait for the actual timeouts.

Comment 22

[Ada [:adalucinet]]

(In reply to Camilo Viecco (:cviecco) from comment #21)
> My guess for the difference
> between ubuntu and others is that you have an actual server http server
> running on your box or you are sending a tcp rst packet. 

On Firefox 26 beta 10 (Build ID: 20131202182626) I get the same results as in comment 20: on Windows and Mac OS X the values are good and on Ubuntu is under 1.

Since I cannot get a value between 2 and 4, can you please take a look on Ubuntu to confirm that this is verified ? Thanks.

Comment 23

[Camilo Viecco (:cviecco)]

Ubuntu is fine (from M-C). Thank you Alexandra

Comment 24

[Ioana (away)]

Removing the keyword since QA can't reproduce, ergo verify this.