1577836 - Remove nsIX509CertList from getCerts and loadCertsFromCache

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Sean Feng [:sefeng]]

nsNSSCertList/ nsIX509CertList is redundant as it can be replaced by Array<nsIX509Cert>. Constructing nsNSSCertList is expensive as it required the raw cert to be decoded.

Comment 1

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Remove nsIX509CertList from getCerts and loadCertsFromCache r=keeler

This patch removes nsIX509CertList for LoadCertsFromCache,
GetCerts and AsPKCS7Blob.

Comment 2

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Add are_certChains_equal function to head_psm.js r=keeler

This is a helper function that is used t compare two Array of
nsIX509Cert.

Depends on D44239

Comment 3

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Duplicate some helper functions from nsIX509CertList r=keeler

Since we are removing nsIX509CertList, some of the helper functions
need to be duplicated with small modifications to adapt the new
certList format.

Depends on D44240

Comment 4

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Remove nsIX509CertList from TransportSecurityInfo r=keeler

Depends on D44241

Comment 5

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Remove nsIX509CertList from verifyCertFinished r=keeler

Depends on D44243

Comment 6

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Remove nsNSSCertList/nsIX509CertList r=keeler

nsNSSCertList/nsIX509CertList are redundant, and also contructing
them are expensive. so it is replaced by Array<nsIX509Cert>

Depends on D44244

Comment 7

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Remove nsIX509CertList from asPKCS7Blob r=keeler

Depends on D44239

Comment 8

[Sean Feng [:sefeng]]

Attachment: Bug 1577836 - Update signatureInfo to Array of Array of nsIX509Cert(in raw bytes) r=keeler

The signatureInfo that has been used in ExternalHelperAppService and
ReputationService has been stored Array of nsIX509CertList, which
isn't necessary because only the raw bytes of the certs are required.
This patch intends to remove the usage of nsIX509CertList and store
the raw bytes directly.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b4e80141db47
Remove nsIX509CertList from getCerts and loadCertsFromCache r=keeler

Comment 10

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/b4e80141db47

Comment 11

[Sean Feng [:sefeng]]

Reopen the bug as only the first patch got landed.

Comment 13

[Phabricator Automation]

Comment on attachment 9090131 [details]
Bug 1577836 - Remove nsIX509CertList from asPKCS7Blob r=keeler

Revision D44516 was moved to bug 1580313. Setting attachment 9090131 [details] to obsolete.

Comment 14

[Phabricator Automation]

Comment on attachment 9089496 [details]
Bug 1577836 - Duplicate some helper functions from nsIX509CertList r=keeler

Revision D44241 was moved to bug 1580315. Setting attachment 9089496 [details] to obsolete.

Comment 15

[Phabricator Automation]

Comment on attachment 9089497 [details]
Bug 1577836 - Remove nsIX509CertList from TransportSecurityInfo r=keeler

Revision D44242 was moved to bug 1580315. Setting attachment 9089497 [details] to obsolete.

Comment 16

[Phabricator Automation]

Comment on attachment 9090395 [details]
Bug 1577836 - Update signatureInfo to Array of Array of nsIX509Cert(in raw bytes) r=keeler

Revision D44243 was moved to bug 1580316. Setting attachment 9090395 [details] to obsolete.

Comment 17

[Phabricator Automation]

Comment on attachment 9089499 [details]
Bug 1577836 - Remove nsIX509CertList from verifyCertFinished r=keeler

Revision D44244 was moved to bug 1580318. Setting attachment 9089499 [details] to obsolete.

Comment 18

[Phabricator Automation]

Comment on attachment 9089500 [details]
Bug 1577836 - Remove nsNSSCertList/nsIX509CertList r=keeler

Revision D44245 was moved to bug 1580304. Setting attachment 9089500 [details] to obsolete.

Comment 19

[Sean Feng [:sefeng]]

I re-purposed this bug to only for the patch that is landed, the rest of the patches got moved to other bugs. Resolving this bug as the patch landed.