Bug 2219047 - Can't load captive portal to connect to public WiFi
Summary: Can't load captive portal to connect to public WiFi
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: firefox
Version: 38
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Gecko Maintainer
QA Contact: Fedora Extras Quality Assurance
URL: https://stagecoach.on.icomera.com/?ur...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-07-01 11:22 UTC by Sam Morris
Modified: 2023-07-01 11:39 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Sam Morris 2023-07-01 11:22:04 UTC
Firefox detects the URL of the captive portal, but is unable to load the URL.

https://stagecoach.on.icomera.com/?url=http%3A%2F%2Fdetectportal.firefox.com%2Fcanonical.html

I get an SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM error.

Reproducible: Always

Steps to Reproduce:
1. Go to https://stagecoach.on.icomera.com/?url=http%3A%2F%2Fdetectportal.firefox.com%2Fcanonical.html in Firefox

Actual Results:  
SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM error

Expected Results:  
Page should load

'openssl s_client -connect stagecoach.on.icomera.com:443' works fine.

The page also loads fine with chromium.

I am using the DEFAULT:DH-SIZE crypto policy. /etc/crypto-policies/modules/DH-SIZE.pmod contains:

    # https://lists.fedorahosted.org/archives/list/devel@lists.fedoraproject.org/message/QWIVDHSPRM3H7W4ZOCGMVOQ2XXRSAT44/
    min_dh_size = 2047

The default min DH size is 2048, so this relaxes that requiremnt; as such it should not be related to this problem.

Comment 1 Sam Morris 2023-07-01 11:39:15 UTC
If I change the crypto policy to simply "DEFAULT" then OpenSSL rejects the connection just like Firefox:

    $ curl 'https://stagecoach.on.icomera.com/?url=http%3A%2F%2Fdetectportal.firefox.com%2Fcanonical.html'
    curl: (35) OpenSSL/3.0.9: error:0A000172:SSL routines::wrong signature type

Setting it back to DEFAULT:DH-SIZE gets OpenSSL/curl working again.

So perhaps the problem is that Firefox/NSS don't obey the min_dh_size crypto-policies option?

    $ update-crypto-policies --show
    DEFAULT:DH-SIZE

    $ /usr/lib64/nss/unsupported-tools/tstclnt -b -D -h stagegoach.on.icomera.com
    tstclnt: read from socket failed: SSL_ERROR_UNSUPPORTED_VERSION: Peer using unsupported version of security protocol.

    $ curl -sS -I 'https://stagecoach.on.icomera.com/?url=http%3A%2F%2Fdetectportal.firefox.com%2Fcanonical.html' | head -n1
    HTTP/1.1 200 OK


Note You need to log in before you can comment on or make changes to this bug.