On Sun, Jan 30, 2011 at 1:32 AM, Nelson B Bolyard <[email protected]> wrote: > > Firefox doesn't send TLS client hellos to servers that fail to complete > ANY handshake with ANY version of SSL or TLS some number of times in a row > when it has tried sending TLS client hellos. Once it decides the server > is incompatible with TLS client hellos, it stops trying to do that > and falls back on some OLD OLD behavior where it sends SSL 3.0 client > hellos encapsulated in SSL 2 records. They're actually SSL3 hellos, > but the point is that the server has failed too many times.
Here is the fallback code (in Firefox 3.0.x) that Nelson mentioned: http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp&rev=1.166&mark=3134-3135,3145-3154#3134 3134 // Let's see if we're trying to connect to a site we know is 3135 // TLS intolerant. 3136 nsCAutoString key; 3137 key = nsDependentCString(host) + NS_LITERAL_CSTRING(":") + nsPrintfCString("%d", port); 3138 3139 if (nsSSLIOLayerHelpers::isKnownAsIntolerantSite(key)) { 3140 if (SECSuccess != SSL_OptionSet(fd, SSL_ENABLE_TLS, PR_FALSE)) 3141 return NS_ERROR_FAILURE; 3142 3143 infoObject->SetAllowTLSIntoleranceTimeout(PR_FALSE); 3144 3145 // We assume that protocols that use the STARTTLS mechanism should support 3146 // modern hellos. For other protocols, if we suspect a site 3147 // does not support TLS, let's also use V2 hellos. 3148 // One advantage of this approach, if a site only supports the older 3149 // hellos, it is more likely that we will get a reasonable error code 3150 // on our single retry attempt. 3151 3152 if (!forSTARTTLS && 3153 SECSuccess != SSL_OptionSet(fd, SSL_V2_COMPATIBLE_HELLO, PR_TRUE)) 3154 return NS_ERROR_FAILURE; 3155 } I think it is fine to delete the SSL_OptionSet(fd, SSL_V2_COMPATIBLE_HELLO, PR_TRUE) call now. Wan-Teh -- dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto
