1713562 - Validate ECH public names

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[Martin Thomson [:mt:]]

The spec has been updated to require that public_name is a series of LDH labels (according to RFC 1023 and RFC 1134 definitions) but the value cannot be an IPv4 address. This is annoying, but necessary. Otherwise, we could end up with different parts of the system not agreeing on whether a name represents a DNS name or an IP address.

The text is not in the version of the draft we support, but the additional validation is worth including ahead of the next draft.

In implementing this, I discovered that we leak on the server if multiple configurations are provided for the same socket, so that's getting fixed too.

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 1713562 - Validate ECH public names, r?bbeurdouche

Depends on D115969

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:mt, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 3

[Martin Thomson [:mt:]]

Just waiting on review, that's all. (Low priority.)

Comment 4

[Martin Thomson [:mt:]]

OK, that was silly, I was just waiting for the release to pass before landing this.

Comment 5

[Martin Thomson [:mt:]]

https://hg.mozilla.org/projects/nss/rev/ac81f721cbbfa013c4abbe83ceb2f67b958c1384

Comment 6

[Martin Thomson [:mt:]]

Attachment: Bug 1713562 - Fix test leak, r?bbeurdouche