https://wiki.musl-libc.org has TLS error

[aaron-michaux]

https://wiki.musl-libc.org has TLS error

[somasis]

I can't reproduce this in Firefox, Chromium, on multiple devices. Can you try in a different browser or just use curl or something?

[richfelker]

I can't reproduce it either. "Use curl" is not really a solution, but I don't think this bug report is actionable without more details beyond "some sort of unrecoverable TLS error". Firefox has a feature for looking at details on the error; this needs to be used to make a meaningful report.

[aaron-michaux]

Normally firefox will tell say something like "this page is insecure", and let you view the certificate, etc. However, in this case, the browser gets caught in a loop "connecting" and then "performing TLS handshake", and gives up after about a dozen tries.

The wiki works fine in google-chrome, so I suppose my firefox is corrupted in some way, which is odd, since I only have one plugin (ublock).

[somasis]

The only thing I could think of is that perhaps the algorithms that lighttpd is using are too new for your version of Firefox; what version are you running, exactly?

I'll look into that possibility when I get home later tonight.

@richfelker I didn't mean "use curl" as a solution, rather its output might make the TLS error easier to determine. Plus Firefox could have been doing some weird caching or something...

[aaron-michaux]

Firefox Quantum 64.0b2 (64-bit). Failure takes about 10 seconds. The firefox debug console shows no network activity, so it's failing before the TLS handshake is complete.

I created a new profile, but this does not fix the problem.

I turned on firefox's http logging, and it produces almost 6Mb of logs when attempting to connect to the https wiki.

This is the head of the log:

2018-10-31 14:42:51.289075 UTC - [Parent 32078: Timer]: D/nsSocketTransport STS dispatch [0x7fe6da805500]
2018-10-31 14:42:51.289192 UTC - [Parent 32078: Timer]: D/nsSocketTransport PollableEvent::Signal
2018-10-31 14:42:51.289218 UTC - [Parent 32078: Timer]: D/nsSocketTransport PollableEvent::MarkFirstSignalTimestamp
2018-10-31 14:42:51.289250 UTC - [Parent 32078: Timer]: D/nsSocketTransport PollableEvent::Signal PR_Write 1
2018-10-31 14:42:51.289279 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport     ...returned after 10162 milliseconds
2018-10-31 14:42:51.289314 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6bec46800, timeout=65535s
2018-10-31 14:42:51.289325 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:42:51.289335 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6d1b8f800, timeout=65535s
2018-10-31 14:42:51.289343 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:42:51.289352 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6c3e1fc00, timeout=65535s

This is the tail of the log:

2018-10-31 14:43:01.055900 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6d1b54800, timeout=65535s
2018-10-31 14:43:01.055903 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:43:01.055907 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6bed44000, timeout=65535s
2018-10-31 14:43:01.055910 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:43:01.055914 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6c2a1f400, timeout=65535s
2018-10-31 14:43:01.055917 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:43:01.055921 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport SocketContext::TimeoutIn socket=0x7fe6beca8c00, timeout=65535s
2018-10-31 14:43:01.055924 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport   not engaged
2018-10-31 14:43:01.055928 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport poll timeout: none
2018-10-31 14:43:01.055932 UTC - [Parent 32078: Socket Thread]: D/nsSocketTransport     timeout = -1 milliseconds

[somasis]

This issue should be fixed now. Discussion in #musl irc figured out it was TLSv1.3 causing issues with the handshake. I've disabled TLSv1.3 for now in lighttpd as 1.2 is safe. Hopefully I can enable 1.3 soon, though...