2001932 - Set SNI correctly when ECH Configs are available but disabled (e.g. by TLS version policy)

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Jacky Murda]

Attachment: ech.pcap.gz PCAP file from attachment shows what happens when trying to connect site behind cloudflare-ech.com, and two other test sites (tls-ech.dev, tls.browserleaks.com) that does not fail just because they bind public SNI to the same server and has va

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0

Steps to reproduce:

Disable TLS 1.3:
security.tls.version.max 3

Keep ECHConfig enabled (default):
network.dns.echconfig.enabled true

Actual results:

Firefox still trying to connect using public (outer) SNI from DNS ECHConfig which lead to Fatal Bad Certificate error if the server doesn't handle public SNI same way as inner SNI (sites behind Cloudflare ECH stop working).

Expected results:

Should connect using default SNI (same as network.dns.echconfig.enabled false)

Comment 1

[Jacky Murda]

pcap attach contains what happens trying to connect site behind cloudflare-ech.com, and two other test sites (tls-ech.dev, tls.browserleaks.com) that does not fail just because they bind Outer SNI to the same server and has valid certs for them (hopefully this bug does not break HTTP/1.1 host or HTTP/2 :authority).

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: DNS' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Dennis, is this something we should address in NSS or Necko?

Comment 4

[Dennis Jackson]

Attachment: Bug 2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled. r=mt,#nss-reviewers

Comment 5

[Dennis Jackson]

Thank you for this bug report, which is incredibly helpful. I don't quite know how we missed this, but this will definitely have been causing problems for users with TLS 1.3 disabled.

The bug is in some logic in our cryptography library, so the fix will take a little while to get into Firefox Nightly.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/b208024bafa0
Fix incorrect logic for SNI selection when ECH is available but disabled. r=mt,nss-reviewers