1546816 - Changes needed to make proxy certificate validation from Socket Process/Socket Thread to Parent Process easier

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P2)

Comment 1

[Dragana Damjanovic [:dragana]]

Attachment: Part 1: Changes needed for performing cert verification on the parent proces while networking access is on the socket process. r=keeler

Comment 2

[Dragana Damjanovic [:dragana]]

Attachment: Part 2: Change nsNSSCallback to prepare for moving cert verifications to the parent process if the socket process performs network access. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dbb07b64cdf9
Part 1: Changes needed for performing cert verification on the parent proces while networking access is on the socket process. r=keeler

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4d299dcdcaaa
Part 2: Change nsNSSCallback to prepare for moving cert verifications to the parent process if the socket process performs network access. r=keeler

Comment 5

[Andrei Ciure[:aciure]]

Backed out 2 changesets (bug 1546816) for causing test_navigation.py and test_js_cert_override_service.js to permafail

push that caused the failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel%2Crunnable&revision=dbb07b64cdf9fc9653272a81b12291f65dd24ca5

failures:
https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=252014563&searchStr=os%2Cx%2C10.14%2Cshippable%2Copt%2Ctest-macosx1014-64-shippable%2Fopt-marionette-e10s%2C%28mn%29

https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=252015324&searchStr=linux%2Cx64%2Cquantumrender%2Cdebug%2Cxpcshell%2Ctests%2Ctest-linux64-qr%2Fdebug-xpcshell-e10s-4%2Cx%28x4%29

backout: https://hg.mozilla.org/integration/autoland/rev/6deb980edef43939014512a2e564085cd35c92ab

Comment 6

[BugBot [:suhaib / :marco]]

There are some r+ patches which didn't land and no activity in this bug for 2 weeks.
:dragana, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 7

[Kershaw Chang [:kershaw]]

Still this from Dragana.
I'll try to finish this bug.

Comment 8

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part3: Not allow nsICertOverrideService to be implemented in js

Comment 9

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-1: Remove MITM_OK flag and bypassAuthentication

Comment 10

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-2: Simplify collecting telemetry

Comment 11

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-3: Always do certificate verification on a background thread

Comment 12

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-4: Remove mTelemetryID and mTelemetryValue from SSLServerCertVerificationResult

Comment 13

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-5: Add AuthCertificateSetResults helper function

Comment 14

[Kershaw Chang [:kershaw]]

Attachment: Bug 1546816 - Part 1-6: Add a helper function: AuthCertificateParseResults

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/81feab3f92a5
Part 1-1: Remove MITM_OK flag and bypassAuthentication r=keeler
https://hg.mozilla.org/integration/autoland/rev/a89d6ea194c1
Part 1-2: Simplify collecting telemetry r=keeler
https://hg.mozilla.org/integration/autoland/rev/f3cc7d17a1f4
Part 1-3: Always do certificate verification on a background thread r=keeler

Comment 16

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/81feab3f92a5
https://hg.mozilla.org/mozilla-central/rev/a89d6ea194c1
https://hg.mozilla.org/mozilla-central/rev/f3cc7d17a1f4

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5b303cb0a0a3
Part 1-4: Remove  mTelemetryID and mTelemetryValue from SSLServerCertVerificationResult r=keeler

Comment 18

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/5b303cb0a0a3

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/890b10f39b9c
Part 1-5: Add AuthCertificateSetResults helper function r=keeler

Comment 20

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/890b10f39b9c

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c4ba0117c23d
Part 1-6: Add a helper function: AuthCertificateParseResults r=keeler

Comment 22

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/c4ba0117c23d

Comment 23

[Kershaw Chang [:kershaw]]

Comment on attachment 9060556 [details]
Part 2: Change nsNSSCallback to prepare for moving cert verifications to the parent process if the socket process performs network access. r=keeler

We don't need this patch.

Comment 24

[Kershaw Chang [:kershaw]]

We can close this bug now.