1069317 - about:neterror does not display with e10s enabled for cert pin violations

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Mark Goodwin [:mgoodwin]]

about:neterror fails to display with e10s.

str:
1) enable e10s
2) cause some condition that will result in about:neterror displaying (e.g. cause a pinning violation by visiting https://google.com/ via a tool like OWASP ZAP with the proxy's root installed)
3) Observe a blank page in place of the neterror page

Comment 1

[Jim Mathies [:jimm]]

Attachment: badaddress.png

Hmm, not able to reproduce using a simple bad address.

Comment 2

[Jim Mathies [:jimm]]

Maybe I'm not testing the right scenario here.. Mark, are you still able to reproduce, and are you sure what you're seeing isn't a result of your test config?

Comment 3

[Jim Mathies [:jimm]]

downed proxies look ok too.

Comment 4

[Mark Goodwin [:mgoodwin]]

(In reply to Jim Mathies [:jimm] from comment #3)
> downed proxies look ok too.

I was testing with certificate pin errors; I'll try to repro again in a bit

Comment 5

[Jim Mathies [:jimm]]

I tried an invalid cert as well here - different about page though.

https://onlinessl.netlock.hu/en/test-center/invalid-ssl-certificate.html

Comment 6

[Mark Goodwin [:mgoodwin]]

OK, I am still able to reproduce. Here are the steps:

1) Create some enviroment in which it's possible to get a pin violation from an otherwise OK chain: e.g.
a) Install a man in the middle proxy (e.g. OWASP ZAP)
b) Install a local CA root (e.g. by using the ZAP dynamic SSL feature)
c) Configure your browser to use the proxy

2) Visit an URL which causes a pin violation to occur (e.g. https://www.google.com)

3) Observe about:neterror failing to display

The same STR works fine with e10s disabled.

Comment 7

[[:mmc] Monica Chew (no longer reading bugmail)]

You can always visit https://pinningtest.appspot.com instead of setting up your proxy.

Comment 8

[Dana Keeler (she/her) [:keeler]]

See also the last few comments in bug 1053456.

Comment 9

[Jim Mathies [:jimm]]

(In reply to [:mmc] Monica Chew (please use needinfo) from comment #7)
> You can always visit https://pinningtest.appspot.com instead of setting up
> your proxy.

sweeeet! thanks!

Comment 10

[Jim Mathies [:jimm]]

Not much to go on except a little log output - 

[JavaScript Error: "NS_NOINTERFACE: Component returned failure code: 0x80004002 (NS_NOINTERFACE) [nsISupports.QueryInterface]"]
[JavaScript Error: "NS_NOINTERFACE: Component returned failure code: 0x80004002 (NS_NOINTERFACE) [nsISupports.QueryInterface]"]
..

Comment 11

[Jim Mathies [:jimm]]

We end up in nsDocShell::DisplayLoadError[1], where we attempt to get security info on the failed channel[2] which fails. We end up with en empty messageStr and bail. 

[1] http://mxr.mozilla.org/mozilla-central/source/docshell/base/nsDocShell.cpp#4815
[2] http://mxr.mozilla.org/mozilla-central/source/docshell/base/nsDocShell.cpp#4812

Comment 12

[Jim Mathies [:jimm]]

On the parent side in HttpChannelParent, we try to serialize security info via NS_SerializeToString, and for some reason this particular channel fails there. So we end up with an empty secInfoSerialization string.

http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/HttpChannelParent.cpp#669

Comment 13

[Jim Mathies [:jimm]]

fixed in 10-18 nightly.