1404915 - Modify JSON schema in certificates collections to allow OneCRL to block by subject and Public Key Hash

Status: RESOLVED WONTFIX

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Mark Goodwin [:mgoodwin]]

I happened to notice that the xml schema for https://settings-writer.prod.mozaws.net/v1/buckets/staging/collections/certificates (and for the corresponding collection in the blocklists bucket) lacks the necessary attributes for revoking certificates by subject and public key.

This is supported by the client (see https://dxr.mozilla.org/mozilla-central/source/services/common/blocklist-clients.js#360) since well before the kinto mechanism - so maybe we should also modify amo2kinto accordingly.

Comment 1

[Mark Goodwin [:mgoodwin]]

https://github.com/mozilla-services/amo2kinto/issues/70

Comment 2

[Rémy Hubscher (:natim)]

Do you know how the XML entry should look like for previous clients?

The current record looks like that:

    <certItem issuerName="MGYxCzAJBgNVBAYTAlVTMRYwF...IC0gRzM=">
        <serialNumber>L79XLVO2ZmtAu7FAG8Wmzw==</serialNumber>
    </certItem>

Comment 3

[Mark Goodwin [:mgoodwin]]

(In reply to Rémy Hubscher (:natim) from comment #2)
> Do you know how the XML entry should look like for previous clients?
yes: From the old test_cert_blocklist.js, I see:

<certItem subject='MCIxIDAeBgNVBAMMF0Fub3RoZXIgVGVzdCBFbmQtZW50aXR5' pubKeyHash='VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8='>
</certItem>

Comment 4

[Mark Goodwin [:mgoodwin]]

The attributes for the JSON object have the same name as the XML attributes.

Comment 5

[Mark Goodwin [:mgoodwin]]

(In reply to Mark Goodwin [:mgoodwin] from comment #3)
> (In reply to Rémy Hubscher (:natim) from comment #2)
> > Do you know how the XML entry should look like for previous clients?
> yes: From the old test_cert_blocklist.js, I see:
> 
> <certItem subject='MCIxIDAeBgNVBAMMF0Fub3RoZXIgVGVzdCBFbmQtZW50aXR5'
> pubKeyHash='VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8='>
> </certItem>

https://hg.mozilla.org/mozilla-central/file/f322e65d1069/toolkit/mozapps/extensions/nsBlocklistService.js#l974 <- this client code confirms the above is correct

Comment 6

[Rémy Hubscher (:natim)]

Attachment: Schema modifications

Comment 7

[Rémy Hubscher (:natim)]

Attachment: CertItem generation

Comment 8

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8914350 [details] [diff] [review]
Schema modifications

Review of attachment 8914350 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM

Comment 9

[Rémy Hubscher (:natim)]

This has been validated in stage and is ready for production.

Comment 10

[Matt Wobensmith [:mwobensmith][:matt:]]

I performed updates on both new and old profiles, and I did not see any problems related to this change.

Comment 11

[Jeremy Orem [:oremj]]

No action in a long time, closing as WONTFIX. Please reopen if this is still needed.