Add Android ECH support#9573
Conversation
|
@swankjesse my biggest question is how to deal with NetworkSecurityPolicy for both I previously ended up with EchModes (disabled, strict and so on) read from the policy |
| private val network: Network? = null, | ||
| /** | ||
| * True to also query the `HTTPS` record for service metadata such as ECH. Set this to false to | ||
| * save a query when only IP addresses are needed. |
There was a problem hiding this comment.
I wonder if there’s a way to phrase this documentation to encourage people to keep it on.
‘Set this to false to omit the service metadata query. This will disable privacy features in the HTTPS call.’
There was a problem hiding this comment.
I think maybe we end up defaulting to the networkSecurityConfig, but let developers opt-out, or opt-in.
For now, likely opt-in while we confirm it works.
GREASE means it should never cause failures just by being enabled.
There was a problem hiding this comment.
I'll ask tomorrow if that mode still exists.
| private val executor: Executor = Executor { it.run() }, | ||
| ) : Dns { | ||
| /** | ||
| * Resolves addresses only, for callers using the legacy blocking API. This delegates to |
There was a problem hiding this comment.
Does this do a service metadata query?
There was a problem hiding this comment.
Yep, good catch.
If it's enabled, but you use lookup, we just filter it out.
|
|
||
| /** | ||
| * Cancels a query. The system resolver doesn't call back once canceled, so this completes the | ||
| * query itself to keep the state machine from stalling. |
There was a problem hiding this comment.
Yeah, I hope this wasn’t too painful to discover.
(I believe calling back after cancelation is the only reasonable behavior)
| val echConfig = | ||
| try { | ||
| EchConfigList.fromBytes(echConfigList.toByteArray()) | ||
| } catch (_: InvalidEchDataException) { |
There was a problem hiding this comment.
This ain’t great. Reducing privacy on misconfigured data is a bad look.
Just let this throw all the way to the caller instead?
There was a problem hiding this comment.
But this is (or was) a policy in Android.
They removed the required mode? So maybe enabled is now required?
There was a problem hiding this comment.
Throw for now until we have a policy
There was a problem hiding this comment.
No wait, this was the one I meant.
My preference is we assume DNS is where this should be configured. If there’s a ECH parameter on the TYPE_HTTPS record we should use it, and if there isn’t then we should assume the site operators don‘t care. Configuring it on the client is too difficult for large organizations, because the team that ships services and apps is far detached from the team that manages DNS and HTTPS. |
But there is a developer API that we should honour. https://developer.android.com/privacy-and-security/security-config#EncryptedClientHelloSummary |
Initial version before dealing with NetworkSecurityPolicy, instead just activated by developer using AndroidDns, and a server having HTTPS records with ECH.
|
Still tests to go |
2 participants
Initial version before dealing with NetworkSecurityPolicy,
instead just activated by developer using AndroidDns, and a server having HTTPS records with ECH.