1027720 - Restrict HTTP/2 connections to AEAD ciphers only

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[u408661]

The spec now requires only AEAD ciphers. That requires some PSM plumbing before we can make the HTTP/2 code enforce that work.

Patrick, can you do the PSM plumbing bits? I think we just need to make sure that nsISSLStatus.cipherName is set when we get to ConfirmTLSProfile (and we may also need to make sure that we have access to an nsISSLStatus object at that point). It may be easier to just add another field to nsISSLSocketControl instead.

Comment 1

[Patrick McManus [:mcmanus]]

Attachment: enforce h2 requirement that sever uses aead

Comment 2

[u408661]

Comment on attachment 8466450 [details] [diff] [review]
enforce h2 requirement that sever uses aead

Review of attachment 8466450 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, but let's make sure we interop with this applied before landing. I'll give this a shot w/webtide after ensuring existing h2-14 stuff works with it (which will come once they re-enable it)

Comment 3

[Patrick McManus [:mcmanus]]

fwiw I did test this live with twitter.com and h2-13

Comment 4

[u408661]

Good enough for me, then.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8466450 [details] [diff] [review]
enforce h2 requirement that sever uses aead

Review of attachment 8466450 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM.

::: netwerk/socket/nsISSLSocketControl.idl
@@ +82,5 @@
>      const short SSL_VERSION_UNKNOWN = -1;
>  
>      [infallible] readonly attribute short SSLVersionUsed;
> +
> +    /* These values match the NSS defined values */

Might be nice to include "in sslt.h"

Comment 6

[Patrick McManus [:mcmanus]]

https://tbpl.mozilla.org/?tree=Try&rev=d1c0679fd4bc

Comment 7

[Patrick McManus [:mcmanus]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/972daa5dd3c5

Comment 8

[Ed Morley [:emorley]]

Backed out for build failures:
https://tbpl.mozilla.org/php/getParsedLog.php?id=45174214&tree=Mozilla-Inbound

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/0324cae16300

Comment 9

[Patrick McManus [:mcmanus]]

apparently clang has no problem with: nsISSLSocketControl::nsISSLSocketControl::SSL_MAC_AEAD  :)

Comment 10

[Patrick McManus [:mcmanus]]

https://tbpl.mozilla.org/?tree=Try&rev=334e8af5a218

Comment 11

[Patrick McManus [:mcmanus]]

Attachment: enforce h2 requirement that sever uses aead

Comment 12

[Patrick McManus [:mcmanus]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/d023f02eecac

Comment 13

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d023f02eecac