912582 - false start rc4 and rsa accomodations need exact principal matches

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Patrick McManus [:mcmanus]]

the rc4/rsa history mechanisms used for false start currently allow subdomain matches. As false start is a transport optimization the tracking should be on a exact host basis. see 658222 comment 43

Comment 1

[Patrick McManus [:mcmanus]]

Attachment: false start rc4 and rsa accomodations need exact principal matches

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 799651 [details] [diff] [review]
false start rc4 and rsa accomodations need exact principal matches

Review of attachment 799651 [details] [diff] [review]:
-----------------------------------------------------------------

As I understand it, this is correct.
I take it we don't have the test infrastructure to test this yet?

Comment 3

[Patrick McManus [:mcmanus]]

(In reply to David Keeler (:keeler) from comment #2)
> Comment on attachment 799651 [details] [diff] [review]
> false start rc4 and rsa accomodations need exact principal matches
> 
> Review of attachment 799651 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> As I understand it, this is correct.
> I take it we don't have the test infrastructure to test this yet?

not meaningfully, no. But I did handtest the positive and negative cases.

Comment 4

[Patrick McManus [:mcmanus]]

https://tbpl.mozilla.org/?tree=Try&rev=df67771a7c06

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/8628391a5a8b

thanks!

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/8628391a5a8b

Comment 6

[Patrick McManus [:mcmanus]]

Comment on attachment 799651 [details] [diff] [review]
false start rc4 and rsa accomodations need exact principal matches

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 658222
User impact if declined: weakening of a security in depth approach. No known vulnerabilty.
Testing completed (on m-c, etc.): on m-c.. hand tested with facebook and google
Risk to taking this patch (and alternatives if risky): low risk modest change. alternatives would be to just live with it on 25 or pref off in 25 - but its a significant performance feature and imo the patch is low risk.
String or IDL/UUID changes made by this patch: none.

Comment 7

[Alex Keybl [:akeybl]]

Comment on attachment 799651 [details] [diff] [review]
false start rc4 and rsa accomodations need exact principal matches

Low risk fix while we're still on Aurora.

Patrick, please bring QA into the loop if you need help with testing - especially if there's specific areas of possible regression.

Comment 8

[Patrick McManus [:mcmanus]]

remote:   https://hg.mozilla.org/releases/mozilla-aurora/rev/2b62d8449fa0

Comment 9

[u279076]

RE comment 7 is there any QA needed here?

Comment 10

[Patrick McManus [:mcmanus]]

I don't think anything special is called for here, but if you'd like to verify the bug based on the info here please be my guest.