1538248 - Verify authenticity of records when reading recipes from Remote Settings

Status: RESOLVED FIXED

(Firefox :: Normandy Client, enhancement, P1)

Description

[Mathieu Leplatre [:leplatrem]]

The current security model of Normandy over Remote Settings is not strong enough.

By adding an additional signature on each record, we could make sure that the records published on Remote Settings had really been published by the Normandy server.

Comment 1

[Mathieu Leplatre [:leplatrem]]

Attachment: Bug 1538248 - Verify authenticity of Remote Settings records for Normandy

Verify authenticity of Remote Settings records for Normandy

Comment 2

[Mathieu Leplatre [:leplatrem]]

The current patch is a draft, but it seems to work locally.

I changed the structure of Remote Settings records to simplify the signature verification code (a record now has two fields: recipe and signature).
This mean the old client code that reads recipes from RS won't work. I thought this would be acceptable since we wouldn't have enabled it anyway.
Mike, do you think it makes sense?
Also should I rename the Feature gate pref so that we don't activate the feature on clients < 68 by accident? (eg. "features.normandy-recipes-remote-settings.enabled")

Comment 3

[Mathieu Leplatre [:leplatrem]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4df5c75a1bf8a283a0fe2bd3137003302869b028

Comment 4

[Mathieu Leplatre [:leplatrem]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f67e0eb0369980f872a1735e0df8ef1d01429e98

Comment 5

[Michael Cooper [:mythmon]]

I think this change makes sense. I think it's ok that we don't keep compatibility with the version we never turned on.

Also should I rename the Feature gate pref so that we don't activate the feature on clients < 68 by accident? (eg. "features.normandy-recipes-remote-settings.enabled")

I think doing this would cause more confusion in the long run. I think we should keep the preference the same.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7c95672d5215
Verify authenticity of Remote Settings records for Normandy r=mythmon,Gijs

Comment 7

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/7c95672d5215