1348713 - Certificate Transparency information isn't set on session resumption

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[61.1p57]

Attachment: Screenshot.PNG

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170302120751

Steps to reproduce:

Open a site and check its site info.


Actual results:

The ct indicator normally shows up but sometimes it doesn't.


Expected results:

The indicator should always show up unless it's completely disabled via the settings.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

We don't set the CT status in HandshakeCallback, which means it isn't displayed for session resumption.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: bug 1348713 - ensure CT information is set in the case of session resumption

Review commit: https://reviewboard.mozilla.org/r/122422/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/122422/

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

It's unclear how best to test this. We could add a firefox-ui test, but I'm not too familiar with those (I also don't know if we can ensure we're doing session resumption or not...). Another option would be to extend our built-in CT information to have a debug-only test log that we have the key for (this is similar to what we do with EV). Once we have that, we can add all sorts of integration tests for our CT implementation. That's a fair bit of engineering work, though.

Comment 4

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 8849625 [details]
bug 1348713 - ensure CT information is set in the case of session resumption

https://reviewboard.mozilla.org/r/122422/#review124574

r+. LGTM.

I think we should file a bug to add CT / SCT tests, with a mock log as you suggest. Put it into the backlog and note in there we need to test this bug's change.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks! Try looked good: https://treeherder.mozilla.org/#/jobs?repo=try&revision=66b85ec6062b (I basically just wanted to confirm that it builds on other platforms)

I filed bug 1349312 for the test infrastructure.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/afcb04dafd03
ensure CT information is set in the case of session resumption r=jcj

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/afcb04dafd03