Score:0

Enable TLS tracing / logging in Firefox Snap 115

cc flag
anx

I am trying to diagnose some TLS bug/feature in Firefox (snap), specifically about mutual authentication while using HTTP/3. Getting it to print some useful data has been challenging for some time. I would like to read logs where Firefox confirms it is parsing the handshake correctly and decides what to do based on what options it has in its certificate store.

What will make Firefox produce relevant logs?

Steps attempted:

  • partial success collecting various internet finds into one giant environment variable:
    • MOZ_LOG="timestamp,pipnss:5,cert_storage::*:5,nsSocketTransport:5,nsHostResolver:5,nsHttp:5,neqo_http3::*:5,neqo_transport::*:5,pkix:5" /snap/bin/firefox >trace.log 2>&1
    • does produce a bunch of messages, specifically pipnss seems highly relevant, but none concerning HTTP/3 certificates/pkix/verification/cert storage
    • maybe I am just missing the correct (correctly spelled?) C/Rust component name here?
  • same operation outside browser context, using tstclnt instead:
    • no such binary shipped with my Firefox, installing libnss3 gives much older version
  • recompile with preprocessor magic (TRACING, possibly?):
Score:0
cc flag
anx

Possibly, the partial success in the question is already the most success one could get. At least I found no further proof that this error indicates missing logs:

I/neqo_common::* [neqo_common::log] Logging initialization error SetLoggerError(())

Maybe it is a bug, or maybe that message was just carefully crafted to confuse unsuspecting would-be log readers. Either way, this would leave the following configuration entirely sufficient to get all the messages that could be emitted from the (Rust) components handling those transports:

about:logging?modules=timestamp,pipnss:5,cert_storage::*:5,nsSocketTransport:5,nsHostResolver:5,nsHttp:5,neqo_http3::*:5,neqo_transport::*:5,pkix:5

Using this URL is even better than the environment variables, because it leaves out all the unwanted mozilla.com connections from the beginning of the log file.

I am starting to suspect the logs I am looking for would be there and be marked SSLGetClientAuthDataHook if only the relevant rust component was to set that up. I may not be seeing those log lines because the thing I want logs from is simply not called for that protocol...


One alternate way to generate logs is is opening up https://profiler.firefox.com to use that sites special permissions to add the profiler button, press that button, load the page a few times, press the button again. That will open a new tab which can show samples matching commma-separated keywords in function names when used via Parent Process > Socket Thread > Call Tree > * > Filter stacks: neqo,nss - Unfortunately, even with the minimal 0.01ms sampling interval, on a reasonably fast machine this will only snapshot 0-1 relevant function calls per request, producing a rather discontiguous & incomplete picture.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.