1779234 - ECH (Retry-)Config bugs

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Leander Schwarz]

• NSS client does not check that server ECH extensions containing retry configs are only allowed in the EncryptedExtensions message (and therefore can only be sent by TLS > 1.3 servers).

• NSS client does not check if a server illegally sent an ECH extension containing retry configs even though it accepted ECH.

• NSS fails when setting an ECH config containing an unsupported mandatory extensions instead of just skipping it and trying to set possible further extensions.

Comment 1

[Leander Schwarz]

Attachment: Bug 1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing. r?djackson

Depends on D151489

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:lschwarz, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 4

[Dennis Jackson]

https://hg.mozilla.org/projects/nss/rev/80f19247055fd8cf7f4210694aa42f05935ff8b3