973628 - https - The connection was interrupted

Status: RESOLVED DUPLICATE of bug 969479

(Core :: Security: PSM, defect)

Description

[David Clayton]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101 Firefox/27.0 SeaMonkey/2.24 (Beta/Release)
Build ID: 20140203230027

Steps to reproduce:

Auto updated to Sea Monkey 2.24 and Fire Fox 27.0.1.
Attempt to access URL: https://national.virginmedia.com/service-announcements/status


Actual results:

SM:
The connection to national.virginmedia.com has terminated unexpectedly. Some data may have been transferred.
FF:
The connection to national.virginmedia.com was interrupted while the page was loading.


Expected results:

The page continues to load as expected in Internet Explorer 11

Comment 1

[ryuga81]

Same pattern on https://gateway.playneverwinter.com/
It stopped working after 2.24 (Seamonkey) and 27.0.1 (Firefox) updates. No problem in IE or Chrome.

Comment 2

[David Clayton]

I tried this site at home (direct connection), and it worked as expected. The site where I have the problem uses a squid proxy server. As far as I know, no configuration changes were made to the proxy, the browser update is the only thing to have changed. We need to arrange a test case with a virgin install of a previous version, test, upgrade, test, confirm behaviour.

Comment 3

[ryuga81]

1	Browser	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 SeaMonkey/2.24
2	(proxy)	1.1 xx.xx.xx.xx:xx(squid/2.7.STABLE9) <---
→	Server	Apache

I'm connecting through a proxy too. This is definitely something.

Comment 4

[David Clayton]

@ ryuga81 I confirm your https://gateway.playneverwinter.com/ site experiences the same issue, doesn't work in FF or SM, but loads without problem in IE (on Windows 7 PC where problem first experienced). 

Test Case results - Installed virgin FF 26 on spare Windows XP machine, with a proxy bypass rule both sites load properly. updated to FF 27.0.1. both sites continue to load properly.

Removed bypass rule, forcing load from proxy. 

re-installed version 26, again both sites load, updated to 27.0.1 and re-started FF, both sites do not load.

Back on win 7 machine - cleared cached data, made no difference, problem still experienced.

to summarise fault condition exists for both sites only when going via squid proxy and have been upgraded to latest build.

Comment 5

[Boris Zbarsky [:bzbarsky]]

David, ryuga81, would you be willing to create a log following the instructions at https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging and attach it to this bug?

Comment 6

[David Clayton]

Attachment: FF_log_gateway_playneverwinter.txt

Comment 7

[David Clayton]

Attachment: FF_log_national_virginmedia.txt

Comment 8

[David Clayton]

Boris, log files created and attached per your instructions. In each case FF loads google homepage then attempted navigation to the URL exhibiting fault.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Hmm.  So the relevant bit seems to be this:

2014-02-19 07:11:42.987000 UTC - 6524[80f530]: nsHttpConnection::OnSocketWritable [this=c458900] host=national.virginmedia.com
2014-02-19 07:11:42.987000 UTC - 6524[80f530]: nsSocketOutputStream::Write [this=e27bb20 count=0]
2014-02-19 07:11:42.987000 UTC - 6524[80f530]:   calling PR_Write [count=0]
2014-02-19 07:11:42.987000 UTC - 6524[80f530]:   PR_Write returned [n=-1]
2014-02-19 07:11:42.987000 UTC - 6524[80f530]: JIMB: ReleaseFD_Locked: mFDref = 2
2014-02-19 07:11:42.987000 UTC - 6524[80f530]: ErrorAccordingToNSPR [in=-5938 out=804b0047]

0x804b0047 is NS_ERROR_NET_INTERRUPT. -5938 (the NSPR code that led to that nsresult) seems to be PR_END_OF_FILE_ERROR.  So we tried to write to the socket, and got an error return....

David, I assume this doesn't happen for all https sites, just for these two that you've found so far?

Comment 10

[David Clayton]

Correct - the vast majority of https sites load without a problem. I've found another site with the faulty behaviour: https://www.mobileaccountmanagement.com. Will attach log file.

Comment 11

[David Clayton]

Attachment: FF_log_mobileaccountmanagement.txt

Comment 12

[Patrick McManus [:mcmanus]]

I believe this is a dup of bug 969479? brian? dkeeler?

Essentially, I think the sites in question are triggering a failure due to some kind of intolerance with the preferred SSL parameters. Instead of just failing outright, it falls back to trying other parameters.

Unfortunately, 969479 suggests that fallback does not take proxy CONNECT semantics into consideration which is why those sites work without a proxy.

Comment 13

[will69]

We are experiencing this problem (behind MS ISA) with all of the above sites, plus this one:

https://training.sap.com/

Workaround (Caution! Lowers maximum possible security for all HTTPS sites!):

security.tls.version.max=0     (SSL3)
security.tls.version.max=1     (TLS1)

All of these sites seem to support a maximum of TLS 1.0.

Firefox 30 on Linux is also affected.
Chrome 32, IE11 and Opera 12.16 do not exhibit this problem.

We don't have a problem with https://wiki.gnome.org (Bug 969479) which (now?) uses TLS 1.2.

Comment 14

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Yes, this looks like the same as bug 969479.

Comment 15

[will69]

The patch in bug 969479 fixes the problem for us with all of the above sites:

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux/1392939387/

Thanks, guys!