Cloudflare Developers•10mo ago

How did you get that?

DD5 How did you get that?

az•3/16/25, 12:35 AM

wireshark

az•3/16/25, 12:36 AM

added the SNI from the outer client hello as a column in wireshark

D5OP•3/16/25, 12:36 AM

Okay, interesting

D5OP•3/16/25, 12:37 AM

Looks like
https://dh-sw.net is actually using it.
My subdomains like
https://inicio.dh-sw.net (redirect from main domain)
https://service.dh-sw.net/v1

And others are not using it

DD5 Looks like https://dh-sw.net is actually using it. My subdomains like https://...

Chaika•3/16/25, 12:38 AM

eh I think the https lookup is just lazy

D5OP•3/16/25, 12:38 AM

But they're affected anyways

DD5 Looks like https://dh-sw.net is actually using it. My subdomains like https://...

az•3/16/25, 12:38 AM

ignore nvidia in the middle but both of the subdomains have it enabled for me too

Chaika•3/16/25, 12:38 AM

I don't think the browser blocks for the https record lookup (and its reset if you hard refresh), or something along those lines, it's def supported on the subdomains

CChaika eh I think the https lookup is just lazy

D5OP•3/16/25, 12:38 AM

wdym?

DD5 wdym?

Chaika•3/16/25, 12:39 AM

it has to lookup the https record to see ech support/etc

Aaz ignore nvidia in the middle but both of the subdomains have it enabled for me to...

D5OP•3/16/25, 12:39 AM

Weird. No idea why in some cases it's enabled and others not

CChaika it has to lookup the https record to see ech support/etc

D5OP•3/16/25, 12:40 AM

I did. Still showing without ECH

Chaika•3/16/25, 12:40 AM

chaik@ash:~$ dig inicio.dh-sw.net https +short
1 . alpn="h3,h2" ipv4hint=104.21.16.1,104.21.32.1,104.21.48.1,104.21.64.1,104.21.80.1,104.21.96.1,104.21.112.1 ech=AEX+DQBBOwAgACBbqnLeAhRhhU0+EDxnIOla6O7FndMj8smocxf663njTwAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:3030::6815:1001,2606:4700:3030::6815:2001,2606:4700:3030::6815:3001,2606:4700:3030::6815:4001,2606:4700:3030::6815:5001,2606:4700:3030::6815:6001,2606:4700:3030::6815:7001

Chaika•3/16/25, 12:41 AM

I meant more in the implementation of Firefox though (or whatever browser you're using)

Chaika•3/16/25, 12:41 AM

sometimes I hard refresh/visit for the first time and it isn't ech until reload

Erisa•3/16/25, 12:41 AM

seems counter-intuitive to the purpose of ech lol

Chaika•3/16/25, 12:41 AM

FF docs say

Firefox retrieves this data simultaneously with performing a DNS lookup when connecting to a website, ensuring there's no extra delay during the connection.

wonder what happens if the https record lookup takes longer then the A/AAAA, if it just doesn't use it or something, they specifically say "no extra delay"

D5OP•3/16/25, 12:43 AM

Okay, then I don't understand why some ISPs are able to find what's the hostname or the website you're visiting and other not

az•3/16/25, 12:44 AM

tls 1.3 is a requirement of ech right?

Chaika•3/16/25, 12:44 AM

looks like there's a firefox config setting to make it wait for the https record lookup

network.dns.force_waiting_https_rr Whether to wait for the HTTPS RR lookup to complete before starting a connection. Boolean True True

https://wiki.mozilla.org/Security/Encrypted_Client_Hello
It kinda looks like it's on by default though, so maybe my theory is wrong, will try forcing it...

Chaika•3/16/25, 12:50 AM

ech's always been a little weird. Used to need DoH for a while, only later was relaxed

Chaika•3/16/25, 12:50 AM

looks like for me turning on DoH made it much more consistent, still seems to revert on hard refresh weirdly but meh

Original message was deleted

Chaika•3/16/25, 12:52 AM

part of the reason why DoH is pushed with it

Original message was deleted

Chaika•3/16/25, 12:52 AM

I believe a bunch of CDNs stop that now, I forget if CF does

Chaika•3/16/25, 12:57 AM

Azure's Front door adverts not supporting "Domain Fronting" like it's a feature lol