1337868 - Add Origin Attribute connection isolation tests for HTTP2, TLS, and WebSockets

Status: NEW

(Core :: DOM: Security, task, P3)

Description

[Tom Ritter [:tjr]]

Bug 1283319 added tests for Connection Isolation in HTTP/1.1, but we should hedge our bets and make some tests for other connection types.

Comment 1

[Tom Ritter [:tjr]]

This might be done for HTTP2 in Bug 1334693. And Alt-Srv in Bug 1334690.  But maybe it hasn't.

Comment 2

[Marion Daly [:mdaly]]

Hi arthur, I see this was promoted from P3 to P1 5 months ago, reasoning?

Comment 3

[Arthur Edelstein [:arthur]]

Hi Marion -- thanks for checking. We're planning to enable HTTP/2 for the next version of Tor Browser and unit tests for FPI (or generally OriginAttribute isolation) would provide stronger assurance.

Comment 4

[Marion Daly [:mdaly]]

Great, thank you for the answer! That makes total sense. I hope you don't mind I moved it to P2. It's still high priority.

Comment 5

[Thorin [:thorin]]

https://trac.torproject.org/projects/tor/ticket/14952#comment:51

Comment 6

[Anne (:annevk)]

Have we made progress on this in light of bug 1673921?

Comment 7

[Tim Huang[:timhuang]]

No, we haven't added tests for H2, and WebSocket.

For TLS, we do have a test here. It tests the TLS resumed state and the connection hash key. But, I think we still need the test for the partitioning of TLS client certificates. Bug 1664998 was opened for it.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.