New issue
Advanced search Search tips

Issue 783315 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: 2018-02-01
OS: iOS
Pri: 3
Type: Bug
Team-Security-UX



Sign in to add a comment

iOS page load fails with ERR_SSL_PROTOCOL_ERROR when on Captive Portal network

Project Member Reported by michaeldo@chromium.org, Nov 9 2017

Issue description

When navigating to some secure websites, the Captive Portal interstitial is not displayed.

The logic to show the portal is within the IOSSSLErrorHandler class which is only shown if the certificate is incorrect. However, some SSL connections fail before the certificate is analyzed.


What steps will reproduce the problem?
(1) Connect to a Captive Portal network without establishing a network connection.
(2) Navigate to google.com or facebook.com

What is the expected result?
Captive Portal interstitial should be displayed. (As is seen with other websites like 1000bulbs.com.)

What happens instead?
SSL error interstitial is displayed as seen in attached screenshot.

 
IMG_6742.PNG
75.0 KB View Download

Comment 1 by est...@chromium.org, Nov 10 2017

Labels: Hotlist-EnamelAndFriendsFixIt
Summary: iOS page load fails with ERR_SSL_PROTOCOL_ERROR when on Captive Portal network (was: Display Captive Portal Login page when navigating to google.com)
Some captive portals fail when navigating to certain secure websites with an error similar to this:

Error Domain=NSURLErrorDomain Code=-1200
"An SSL error has occurred and a secure connection to the server cannot be made."

UserInfo={
  NSErrorFailingURLKey=https://www.starbucks.com/, 
  NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, 
  _kCFStreamErrorCodeKey=-9802,
  ErrorSource=1,
  NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made.,
  _WKRecoveryAttempterErrorKey=<WKReloadFrameErrorRecoveryAttempter: 0x170820040>, 
  NSErrorFailingURLStringKey=https://www.starbucks.com/, 
  NSUnderlyingError=0x170c4cdb0 {
    Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)"
    UserInfo={
      _kCFStreamPropertySSLClientCertificateState=0, 
      _kCFNetworkCFStreamSSLErrorOriginalValue=-9802,
      _kCFStreamErrorDomainKey=3,
      _kCFStreamErrorCodeKey=-9802
    }
  },
  _kCFStreamErrorDomainKey=3
}

Comment 3 Deleted

The Captive Portal interstitial can be correctly displayed if we do a Captive Portal detection test when we receive this network error. (For example, as in http://crrev.com/c/759169)
Labels: Proj-CaptivePortal
Project Member

Comment 6 by bugdroid1@chromium.org, Nov 30 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a

commit e4c94fbc84ecd3150c696bf819dc4aa33b105d3a
Author: Mike Dougherty <michaeldo@chromium.org>
Date: Thu Nov 30 23:39:28 2017

Add Captive Portal Metrics Tab Helper.

Users on a Captive Portal network without an internet connection may see
an error interstitial or experience timeouts. These metrics will help to
identify users in these scenarios.

Bug: 783315, 785548
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Change-Id: I911b6d9a57a017d2827ee0feeb07d8721acfa849
Reviewed-on: https://chromium-review.googlesource.com/783694
Commit-Queue: Mike Dougherty <michaeldo@chromium.org>
Reviewed-by: Mark Pearson <mpearson@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Reviewed-by: Mike Dougherty <michaeldo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#520748}
[modify] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/ssl/BUILD.gn
[add] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/ssl/captive_portal_metrics.h
[add] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/ssl/captive_portal_metrics_tab_helper.h
[add] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/ssl/captive_portal_metrics_tab_helper.mm
[modify] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/ssl/ios_ssl_error_handler.mm
[modify] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/ios/chrome/browser/tabs/tab_helper_util.mm
[modify] https://crrev.com/e4c94fbc84ecd3150c696bf819dc4aa33b105d3a/tools/metrics/histograms/histograms.xml

NextAction: 2018-02-01
Add follow up date to check logged metrics data.
The NextAction date has arrived: 2018-02-01

Comment 9 by est...@chromium.org, Feb 18 2018

Labels: -Hotlist-EnamelAndFriendsFixIt
Cc: michaeldo@chromium.org
Owner: ----
Status: Available (was: Assigned)
During Feb. 2018, 2.6 million requests (sent by 635 thousand users) that failed with an SSL protocol error were caused by the user being behind a captive portal.

This metric has been turned off behind the "kCaptivePortalMetrics" flag since we already learned how frequent it is in the field. The metrics will remain in order to perform additional metrics collection in the future.

Sign in to add a comment