Recent changes to ECH include a change that allows the PSK extension to appear in CHOuter. This minimizes the extent to which CHOuter can be distinguished as such. This will make the message larger, but should make it less obvious when PSKs are used.

We can do this by keeping the PSK extension (we currently trim it off). To avoid leaking information (other than the PSK ID length), the values can be replaced with random garbage.

I don't think that it is great that we leak the PSK ID length in this way, but we don't have any good information about that, and the length isn't protected by padding in CHInner. Overall, it's probably safest to keep the length for the bogus extension.

Depends on D115852

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:mt, could you have a look please?
For more information, please visit auto_nag documentation.

In Draft 13, clients can now compress extensions which are non-contiguous but in-order.
This changeset removes the logic handling this.

Previously, we only tracked whether we'd advertised an extension at all. This change allows us to track the advertisements for both the Outer and Inner Client Hello seperately. If the server accepts ECH but includes an extension we only offered in the Outer Client Hello, we will send an alert.

As a side-effect, if the client offers an extension in the ClientHelloInner which is not offered in the ClientHelloOuter and the server accepts, we will send the same alert. It is unclear whether this is desirable behavior or not - since if we did not alert this would allow a network observer to distinguish whether ECH was used.

• Update the test custom extension injectors to create large (1024 byte) extensions
• Update the compression tests to verify that compression ocurrs correctly.
• Add tests to ensure that when accepting ECH, the client rejects Xtns which are only
  valid for the CHO and vice versa

Depends on D130698

https://hg.mozilla.org/projects/nss/rev/d41c0fcdcf85118f1866880d10ac7bf15d7edc5f
https://hg.mozilla.org/projects/nss/rev/beef1385132760879b9b8c9cecd4e0bb9d8b8efe
https://hg.mozilla.org/projects/nss/rev/daf5bc69425a16a809c4feeed4f0ab4ecee80400
https://hg.mozilla.org/projects/nss/rev/b8623fde307c21bf50e753b36416ad94fe8fd227