1396487 - TLS record size limit extension

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P2)

Description

[Martin Thomson [:mt:]]

This was recently adopted by the TLS working group and is fairly trivial to implement.

Comment 1

[Martin Thomson [:mt:]]

https://phabricator.services.mozilla.com/D23

I need to implement a check for the size limit on receipt.  The code doesn't currently reject too-large records if it receives them.

Comment 2

[Phabricator Automation]

Comment on attachment 8904125 [details]
Refactor 1/n-1 record splitting code

Eric Rescorla (:ekr) has approved the revision.

https://phabricator.services.mozilla.com/D21#1441

Comment 3

[Martin Thomson [:mt:]]

Record splitting: https://hg.mozilla.org/projects/nss/rev/27bfdd0ee644c33d3445a844d17d9042e0210035

Comment 4

[Phabricator Automation]

Comment on attachment 8904124 [details]
Refactor DTLS handshake record fragmentation

Eric Rescorla (:ekr) has approved the revision.

https://phabricator.services.mozilla.com/D20#2973

Comment 5

[Phabricator Automation]

Comment on attachment 8905464 [details]
Extra test case for ACK, fragmentation and reassembly

Eric Rescorla (:ekr) has approved the revision.

https://phabricator.services.mozilla.com/D39#3421

Comment 6

[Phabricator Automation]

Attachment: Bug 1396487 - Disable record size limiting extension, r?ekr

Until we have an assigned codepoint, we should not be sending this
extension.  However, we want to land the code and keep it tested, so this
is what we have.  This uses an option value of 0 as a sentinel, disabling
the extension almost entirely.  Both client and server reject this
extension if it appears in messages other than ClientHello/
EncryptedExtensions in TLS 1.3 as well.  So the disabling isn't perfect,
but it should be good enough if the assigment isn't far away (and the
draft is almost done, so that seems possible).

Changing the option in any way enables the extension with the experimental
codepoint that was chosen.  Tests use this to test the feature.

This change is made as a separate commit so that it is easy to revert.
I've tried to keep the changes as discreet as possible.

Comment 7

[Martin Thomson [:mt:]]

Got a codepoint today: 28

https://hg.mozilla.org/projects/nss/rev/bde45e406ea449f0a6259814587b8508539802d5