936818 - Adds tests for insecure TLS fallback (bug 839310 and 901718)

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #839310 +++
+++ This bug was initially created as a clone of Bug #733647 +++
+++ This bug was initially created as a clone of Bug #565047 +++

The tests in bug 839310 were never checked in because the NSS patches that they depend on haven't been r+d yet. I'm filing this bug so we can close bug 839310. The patches are still attached to bug 839310.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: tls-intolerance-integration-tests.patch

Rebased the patches on current mozilla-inbound and on top of the new patch for bug 909162.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: add-connection-close-case.patch

Comment 3

[Honza Bambas (:mayhemer)]

Comment on attachment 831297 [details] [diff] [review]
add-connection-close-case.patch

Review of attachment 831297 [details] [diff] [review]:
-----------------------------------------------------------------

Studied https://bugzilla.mozilla.org/page.cgi?id=splinter.html&bug=936818&attachment=830014 and http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/tests/unit/head_psm.js#142 few minutes to give r+

r=honzab

Comment 4

[Amm]

I am using Firefox 28.0.(windows and linux)

Here is a SSLv3 site:
https://www.mahaconnect.com

This site works in Firefox for windows.

But it does not work on Firefox for Linux.

It works if I change max tls version to 1.

But in windows it works even if max tls version is 3.

On Linux I am using OpenSSL v1.0.1e (but patched for heartbleed). I am not sure if Firefox uses system OpenSSL.

What could be the reason?

(PS. I filed this bug just 2min back in other ticket without realizing its closed so re-posting here)

Comment 5

[Amm]

Sorry site is:
https://www.mahaconnect.in

Comment 6

[Daniel Mota Leite]

site https://www.mahaconnect.in works for me, with firefox aurora (30.a2) on linux (slackware 64). firefox don't use openssl, so no problem there.

Comment 7

[Amm]

I found the reason. Here is what was happening.

I have a squid proxy with sslbump set up. Which mimics certificate. (squid does not work with that site because it tries TLS1.2 and site fails)

If I start firefox with proxy and access that site, it would fail.

Then I set "No proxy". But it fails with "no_cypher_overlap" error. Possibly because Firefox had already "cached" something in memory.

Now I restart Firefox (keeping no proxy option). And then if I access the site, it opened fine.

So it looks like if you access the site with proxy on then it fails, and it fails even after you disable proxy. If you restart Firefox with "no proxy" then site starts working!

Dont know if its a bug or that is how its supposed to happen.

Comment 8

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Not really worthwhile after bug 1084025 is fixed.