1114882 - Allow nsICryptoHash to be used in a content process

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[François Marier [:francois]]

The following doesn't work in under e10s when run in a GeckoProcessType_Content process:

  nsresult rv;
  nsCOMPtr<nsICryptoHash> cryptoHash;
  cryptoHash = do_CreateInstance("@mozilla.org/security/hash;1", &rv);

The last line above triggers this error:

  NS_ERROR("Trying to initialize PSM/NSS in a non-chrome process!");

(from http://dxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsNSSComponent.cpp?from=nsNSSComponent.cpp&case=true#119)

The sub-resource integrity code (bug 992096) uses nsICryptoHash to hash sub-resources and compare that with the expected hash provided in the "integrity" attribute of a script tag.

Comment 1

[François Marier [:francois]]

Attachment: cpp unit test

Here's my attempt at writing a test (possibly wrong) that should work once nsICryptoHash is made available to the content process.

Comment 2

[François Marier [:francois]]

The test can be run like this:

  ./mach cppunittest ./obj-x86_64-unknown-linux-gnu/security/manager/ssl/tests/compiled/TestCryptoHash

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: patch

This should do what we want. The cpp unit test was having some troubles with XPCOM shutdown, I think, so I wrote an xpcshell test that should be sufficient.
Long term, I think NSS initialization should be refactored a bit so that it's easier to understand.

Comment 4

[François Marier [:francois]]

Comment on attachment 8547860 [details] [diff] [review]
patch

I've just tested it with my patch on 992096 and all of my mochitests pass on e10s now.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=55658dc30b00
https://treeherder.mozilla.org/#/jobs?repo=try&revision=ba2994080557

Unfortunately, it looks like the test has to be disabled on b2g due to some test harness/sandboxing interactions. See bug 1124289. In any case:

https://hg.mozilla.org/integration/mozilla-inbound/rev/7811ebf7e321

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: patch as landed

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/5dac49e2f99e for Android S4 failures:

https://treeherder.mozilla.org/logviewer.html#?job_id=5737924&repo=mozilla-inbound

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: patch as landed the second time

Well, I guess there's a similar situation with android.

https://hg.mozilla.org/integration/mozilla-inbound/rev/51ccf5f265f1

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/51ccf5f265f1