1617956 - libssl should be able to handle the client auth data hook returning SECWouldBlock

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Dana Keeler (she/her) [:keeler]]

Currently libssl can't handle client auth data hooks (i.e. set by SSL_GetClientAuthDataHook) that are asynchronous. We need a way to make this possible in Firefox so that one connection waiting for a client certificate doesn't block the entire socket thread, and thus all other connections.

Comment 1

[J.C. Jones [:jcj] (he/they)]

Marking this P3, but to help us avoid forgetting about this for 3.52 or 3.53 going to needinfo Kevin.

Comment 2

[Dennis Jackson]

Attachment: Bug 1617956 - Add support for asynchronous client auth hooks. r=keeler,jschanck,mt

This is a request for feedback on the high level design. This patch:

• Allows client auth hooks to return WouldBlock, pauses the handshake and resumes
  when SSL_ClientAuthCallbackComplete is called.
• Overhauls the ClientAuth gtests to include asynchronous callbacks.
• Adds an asynchronous client auth hook to tstclnt.

There's still a couple of known issues I need to address:

• Additional docs
• Some additional test cases to confirm the handshake is correctly paused between callbacks.
• The async timer used only for running the gtests causes a segfault in NSPR on Windows builds only.
  I need to spend some time setting up a Windows dev environment.

Specific questions:

@dana - Does this provide the right API for your needs?
@mt - Are the changes to the TLS state machine reasonable?

Comment 3

[Dennis Jackson]

Attachment: Bug 1617956 - Add support for asynchronous client auth hooks. r=keeler,jschanck,mt

Comment 4

[Dennis Jackson]

https://hg.mozilla.org/projects/nss/rev/d09752f6580ceaed20bfa3771bd0579aaae8e74d