1547701 - Investigate if OCSPRequest::Run requires LOAD_BYPASS_URL_ClASSIFIER flag

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, task, P1)

Description

[Dimi Lee [:dimi]]

Check if OCSPRequest::Run[1] requires LOAD_BYPASS_URL_ClASSIFIER[2].
The question is, what happens if OCSPRequest request is blocked, is it a critical channel?

[1] https://searchfox.org/mozilla-central/rev/66086345467c69685434dd1c5177b30a7511b1a5/security/manager/ssl/nsNSSCallbacks.cpp#264

[2] https://searchfox.org/mozilla-central/rev/66086345467c69685434dd1c5177b30a7511b1a5/netwerk/base/nsIChannel.idl#255

Comment 1

[Dimi Lee [:dimi]]

Hi keeler,
We have recently changed the behavior of how URL Classifier determines whether a channel should be classified[1] by using the information in the channel.
To be extra careful for not blocking critical channel because of bugs, we added this LOAD_BYPASS_URL_ClASSIFIER flag as a safeguard, whenever we see this flag, we do not classify it no matter the information in the channel.

My question is, what happens if the OCSP request is mistakenly blocked, does it satisfies any of the rules here(this is just a reference to see if this is critical)?

• channels related to an update
• channels may cause security issues if blocked
• channels may prevent the browser to launch if blocked
• channels break basic functionality if blocked

Thank you for your help!

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1522412

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

OCSP requests are important for certificate verification (specifically, getting revocation information), so it would be a security issue if we blocked them.

Comment 3

[Dimi Lee [:dimi]]

Attachment: Bug 1547701 - Use LOAD_BYPASS_URL_ClASSIFIER flag for OCSP request. r?keeler

If OCSP request is blocked, we can't get the certificate revocation
informatoin.
Add nsIChannel::LOAD_BYPASS_URL_ClASSIFIER to enfore URL classifier
bypasses OCSP request.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aa674b410265
Use LOAD_BYPASS_URL_ClASSIFIER flag for OCSP request. r=keeler

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/aa674b410265