Re: [quicwg/base-drafts] Prohibit TLS 1.3 middlebox compatibility mode (#3595)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -1631,6 +1632,21 @@ PROTOCOL_VIOLATION.
 As a result, EndOfEarlyData does not appear in the TLS handshake transcript.
 
 
+## Prohibit TLS Middlebox Compatibility Mode {#compat-mode}
+
+Appendix D.4 of {{!TLS13}} describes an alteration to the TLS 1.3 handshake as
+a workaround for bugs in some middleboxes. The TLS 1.3 middlebox compatibility
+mode involves setting the legacy_session_id field to a 32-byte value in the
+ClientHello and ServerHello, then sending a change_cipher_spec record. Both
+field and record carry no semantic content and are ignored.
+
+This mode has no use in QUIC as it only applies to middleboxes that interfere
+with TLS over TCP. A client MUST NOT request the use of the TLS 1.3
+compatibility mode. A server MUST treat the receipt of a TLS ClientHello that
+requests the use of the TLS 1.3 middlebox compatibility mode as a connection
+error of type PROTOCOL_VIOLATION.

I can do SHOULD.

The way our stack works is that we let TLS consume the ClientHello and then ask it for a response.  That produces a CCS if the client asked for one.  We turn that into an error (we used to crash).  Any implementation could, as I think Kazuho suggests, just drop the CCS, which might be easier in cases where your interface only passes handshake records.  We have a generic record callback, so detecting record type 20 is easy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3595#discussion_r413593052