Closed Bug 1751877 Opened 3 years ago Closed 3 years ago

Firefox appears to race ECH and non-ECH connections

Categories

(NSS :: Libraries, defect, P3)

Product:
NSS
Component:
Libraries
Version:
3.74
Type:
defect

Tracking

(firefox98 affected)

Status:
RESOLVED DUPLICATE of bug 1750413
Tracking Flags:
Tracking Status
firefox98 --- affected

People

(Reporter: djackson, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

firefox_ech_packets.pcapng
19.19 KB, application/octet-stream
Details

Current Behaviour:

When testing ECH with Firefox Nightly and crypto.cloudflare.com, Firefox appears to race two TLS connections (one with ECH, one without). The initial page load uses the ECH connection and subsequent page loads use the unprotected connection.

A packet capture is attached.

Expected Behaviour:

Firefox should not fallback from ECH unless the server securely disables ECH.

Attached file ech-firefox.pcap (obsolete) —

[Tracking Requested - why for this release]:

Severity: -- → N/A
status-firefox98: --- → affected
Priority: -- → P1
Status: NEW → RESOLVED
Closed: 3 years ago
Priority: P1 → P3
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: