1552601 - NoSuchMethodException: {makeCredential, getAssertion} in WebAuthnUtils

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P1)

Description

[J.C. Jones [:jcj] (he/they)]

On Fennec builds from 17 May 2019 (and possibly earlier), we're getting an exception when trying to Make Credential from WebAuhthn:

05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager: Couldn't run WebAuthnUtils
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager: java.lang.NoSuchMethodException: makeCredential [class java.lang.String, class org.mozilla.gecko.util.GeckoBundle, class [B, class [B, long, class java.lang.String, class [Lorg.mozilla.gecko.WebAuthnTokenManager$WebAuthnPublicCredential;, class org.mozilla.gecko.util.GeckoBundle, class org.mozilla.gecko.util.GeckoBundle, interface org.mozilla.gecko.WebAuthnTokenManager$WebAuthnMakeCredentialResponse]
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager:  at java.lang.Class.getMethod(Class.java:2068)
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager:  at java.lang.Class.getDeclaredMethod(Class.java:2047)
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager:  at org.mozilla.gecko.WebAuthnTokenManager.webAuthnMakeCredential(WebAuthnTokenManager.java:118)
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager:  at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
05-17 14:58:11.342 29599 29731 W WebAuthnTokenManager:  at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:476)

The NoSuchMethodException happens after resolving the WebAuthnUtils class, so the class exists.

The method signature from above is:
makeCredential [class java.lang.String, class org.mozilla.gecko.util.GeckoBundle, class [B, class [B, long, class java.lang.String, class [Lorg.mozilla.gecko.WebAuthnTokenManager$WebAuthnPublicCredential;, class org.mozilla.gecko.util.GeckoBundle, class org.mozilla.gecko.util.GeckoBundle, interface org.mozilla.gecko.WebAuthnTokenManager$WebAuthnMakeCredentialResponse]

The one from current m-c is:

    public static void makeCredential(final String rpId, final GeckoBundle identifiers,
                                      final byte[] userId, final byte[] challenge,
                                      final long timeoutMs, final String originStr,
                                      final WebAuthnTokenManager.WebAuthnPublicCredential[] excludeList,
                                      final GeckoBundle authenticatorSelection,
                                      final GeckoBundle extensions,
                                      WebAuthnTokenManager.WebAuthnMakeCredentialResponse handler)```

Careful inspection shows a match of function signatures.

The involved files are:
https://hg.mozilla.org/mozilla-central/log/tip/mobile/android/geckoview/src/main/java/org/mozilla/gecko/WebAuthnTokenManager.java
https://hg.mozilla.org/mozilla-central/log/tip/mobile/android/base/java/org/mozilla/gecko/util/WebAuthnUtils.java

There's nothing as of morning 17 May 2019 that should have impacted these two classes. (Note, there's a consolidation patch on inbound that affects the signatures). The only external non-primitive type in that signature is GeckoBundle, which similarly is without change:

https://hg.mozilla.org/mozilla-central/log/tip/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/GeckoBundle.java

This did work at the beginning of the week. It also works fine in local builds. So now the mystery is: Why all of a sudden is there a NoSuchMethodException?

Comment 1

[J.C. Jones [:jcj] (he/they)]

Works on:
https://archive.mozilla.org/pub/mobile/nightly/2019/05/2019-05-13-08-22-56-mozilla-central-android-api-16/
Note: You have to enable the pref manually
Revision: fa3cfee27619ddc9bcbcf70555bda4eb1e815146

Errors on:
https://archive.mozilla.org/pub/mobile/nightly/2019/05/2019-05-14-09-42-36-mozilla-central-android-api-16/
Pref is now on
Revision: db99095ae0b53c30927add34be3dc20a7bdcb52e

Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fa3cfee27619ddc9bcbcf70555bda4eb1e815146&tochange=db99095ae0b53c30927add34be3dc20a7bdcb52e

Comment 2

[J.C. Jones [:jcj] (he/they)]

Found the culprit, a Proguard rule update. Will produce a patch.

Comment 3

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1552601 - Annotate WebAuthn reflection methods as @ReflectionTarget

A Proguard update in Bug 1550596 optimized away the WebAuthn methods, but
there's a convenient ReflectionTarget defined to say 'hey, don't do that.'

Comment 4

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:
WebAuthn on Fennec is totally disabled without this patch. If we can't land before merge, we'll have to uplift this into Fennec 68.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2c73613d29c2
Annotate WebAuthn reflection methods as @ReflectionTarget r=nalexander

Comment 6

[J.C. Jones [:jcj] (he/they)]

Woot, made it!

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/2c73613d29c2