Closed Bug 1652677 Opened 4 years ago Closed 4 years ago

Use ECH keys from HTTPSSVC records

Categories

(Core :: Networking: HTTP, task, P2)

task

Tracking

()

RESOLVED FIXED
83 Branch

People

(Reporter: dragana, Assigned: kershaw)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

This functionality should be control by a separate pref independent from pref in bug 1652655.
When this feature is turned on:

  • nsHttpChannel should always prefetch an HTTPSSVC record along side a A/AAAA requests.
  • nsHttpTransaction should do the following:
    1. Check whether there is an already open connection that can accommodate the request (a open connection to the origin or the request can be coalesce to another connection (RFC8336 and Section 9.1.1 in RFC7540)). If there is such a connection dispatch the transaction
    2. Otherwise, before making a new connection request an HTTPSSVC record
    3. If complete results for the HTTPSSVC query are received, make a connection to the SvcDomainName with highest priority. If there are SvcDomainNames that advertise ECH keys, such results should have higher priority than results without ECH keys.
    4. If a partial result for the HTTPSSVC query are received, made a connection to one of the SvcDomainName from a ServiceForm record only if at least one IP address for the SvcDomainName is present and ECHO keys are advertised for the SvcDomainName.
    5. Otherwise wait for more responses from the HTTPSSVC query and choose a SvcDomainName as in step iii. or iv.
    6. If any connection that meets requirements set in step 1 becomes available dispatch the transaction to the connection [Note: this should be covered by current code already]

When opening a new connection SvcDomainName and port will be added as RoutedHost and RoutedPort to nsHttpConnectionInfo as well as echconfig and IP record. nsSocketTransport will use the IP address record and echconfig to make a connection to SvcDomainName. For echconfig we will adapt already existing esniTxt

If connection to the SvcDomainName fails or the host is not authorized, fallback to a connection to the origin. A proper fallback will be implemented in the follow up bugs.

Do not use AltSvc mapping table (this line) if this feature in turned on. This optimization will implemented as a follow up bug.

Assignee: nobody → kershaw
Status: NEW → ASSIGNED

Depends on D89454

Pushed by kjang@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/435ff20fa8c6 P1: Prefer to use records with ECH config r=dragana https://hg.mozilla.org/integration/autoland/rev/7df7bfbfbc6e P2: Implement necko part of echconfig r=dragana
Pushed by kjang@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/df6bdf8157b1 P1: Prefer to use records with ECH config r=dragana https://hg.mozilla.org/integration/autoland/rev/4a66e4016c18 P2: Implement necko part of echconfig r=dragana
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 83 Branch
Regressions: 1667801
Status: RESOLVED → REOPENED
Flags: needinfo?(kershaw)
Resolution: FIXED → ---
Target Milestone: 83 Branch → ---
Flags: needinfo?(kershaw)
Pushed by kjang@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/499f651214e0 P1: Prefer to use records with ECH config r=dragana https://hg.mozilla.org/integration/autoland/rev/a1b4cd84b3bc P2: Implement necko part of echconfig r=dragana
Status: REOPENED → RESOLVED
Closed: 4 years ago4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 83 Branch
Regressions: 1630974
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: