ESNI option not working
Categories
(Core :: Networking, defect)
Tracking
()
People
(Reporter: ruben.mcms, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Steps to reproduce:
Downloaded and installed firefox, and did this configuration:
network.security.esni.enabled = True
network.trr.mode = 2 (tried 3 also)
Actual results:
Results from the website https://www.cloudflare.com/ssl/encrypted-sni/:
Secure DNS: You are using encrypted DNS transport with 1.1.1.1
DNSSEC: Your resolver validates DNS responses with DNSSEC.
TLS 1.3: Your browser supports TLS 1.3, which encrypts the server certificate.
Encrypted SNI: Your browser did not encrypt the SNI when visiting this page.
Expected results:
SNI should be encrypted.
|
||
Comment 1•5 years ago
|
||
Hi Rúben,
Setting up the preferences (used option 3 for trr.mode) will encrypt SNI on my side. Also, works with "2' as well.
Did you restart Firefox after setting up the preferences? I am on the latest Firefox Release 80.0.1 (64-bit) on Windows 10.
(In reply to Timea Cernea [:tbabos] from comment #1)
Hi Rúben,
Setting up the preferences (used option 3 for trr.mode) will encrypt SNI on my side. Also, works with "2' as well.
Did you restart Firefox after setting up the preferences? I am on the latest Firefox Release 80.0.1 (64-bit) on Windows 10.
Hi Timea,
Thanks for the reply. I am also on the latest Firefox Release 80.0.1 (64-bit), Windows 10.
Restarted both firefox and the computer. It didn't work.
|
|
||
Comment 3•5 years ago
|
||
Do you have any addons installed? If yes, please disable them, restart and check it out once more.
(In reply to Timea Cernea [:tbabos] from comment #3)
Do you have any addons installed? If yes, please disable them, restart and check it out once more.
No addons Timea. It is a fresh install of Firefox and the first time Firefox is installed in this computer.
Therefore, I posted this on bugzilla, it is such a straightforward and easy configuration to do, I see no reason for it not to work. It works for so many people apparently, it must be something on my end, but what?
I am not very technical at networks, but I read that ESNI works at the application layer of the TCP/IP stack, so I guess it can’t be related to some configuration in my router, since it’s invisible to layer 3. Still, I have tried also using my smartphone internet (hotspot) but got the same result (I did not forget to configure DNS of the wifi card to 1.1.1.1).
|
|
||
Comment 5•5 years ago
|
||
Thanks Ruben, sorry for the back and forth questions but we had to eliminate custom settings and addons as a possible cause.
Moving this over to a component so developers will take a look at this and recommend further investigations/solutions.
In the meantime, you could take a look at https://bugzilla.mozilla.org/show_bug.cgi?id=1608405#c8 as it seems to resolve a similar ESNI issue. Would like to try it out myself but I can't reproduce so not much I can do on my side to help this more.
|
||
Comment 6•5 years ago
|
||
We are working on a new version of this feature that is called ECH. ESNI in thee original form did not work well, ECH is an improve version of the feature (bug 1654332).
Description
•