20
What does network.http.http3.sni-slicing do in Firefox?
(programming.dev)
A place to discuss the news and latest developments on the open-source browser Firefox.
1. Adhere to the instance rules
2. Be kind to one another
3. Communicate in a civil manner
If you would like to bring an issue to the moderators attention, please use the "Create Report" feature on the offending comment or post and it will be reviewed as time allows.
So I am not entirely sure. I did find the code for it however if you want to take a look.
In Firefox it uses the variable for the neqo library, which is the the Mozilla Firefox implementation of QUIC in Rust.
Line #284: https://github.com/mozilla-firefox/firefox/blob/57e6d88cb3ad7f9777145f2d4fba11d4fc9de369/netwerk/socket/neqo_glue/src/lib.rs#L284
code:
In the neqo library it's used here: https://github.com/mozilla/neqo/blob/9e52e922343609dba5171c0adb869cff7bd8d3a0/neqo-transport/src/crypto.rs#L1594
code:
After a quick look, looks like it tries to split the (unencrypted) hostname into multiple packets, or at least scramble it slightly. I'm not sure how much it helps in practice, but it might help against naïve filtering/scanning, as the hostname is either sent in different packets, or split and sent unordered in the same packet. It probably only helps if encrypted client hello isn't supported.
TL;DR: If I've understood everything correctly, it just moves chunks of the plaintext hostname around & tries to split it into multiple packets.
Note: Mostly based on comments, as it's late & I'm too tired to parse too much cryptography code.
Full source of the
limit_chunks
function, formatted with Rustfmt:Same, but for
write_chunk
:Link to the MIT license file