1653029 - avoid passing NSS types to RootCABinNumber

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) [:keeler]]

To avoid using NSS types unnecessarily in PSM, we should use Span<uint8_t> instead of SECItem and PK11_FindEncodedCertInSlot instead of passing a PK11SlotInfo (which would require having a CERTCertificate).

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1653029 - pass a span of bytes to RootCABinNumber instead of NSS types r?rmf!,kjacobs!

PSM internals are currently tightly-copuled with NSS data types. In many cases
this is unnecessary, because PSM often needs only a sequence of bytes (in the
case of certificates, for example). This tight coupling can also have
performance and architectural impacts. For example, thread contention for NSS
resources has caused performance issues in the past. This patch starts the
process of avoiding using these types as much as possible in PSM.

More specifically, RootCABinNumber can take a Span<uint8_t> instead of a
SECItem. Instead of taking a PK11SlotInfo (which essentially requires having a
CERTCertificate), we can use PK11_FindEncodedCertInSlot to see if the
certificate exists on a small number of specific slots to achieve the same
effect as before. Doing this should eventually allow us to avoid creating a
CERTCertificate, which implicitly involves searching all slots on all modules.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5ecde4077049
pass a span of bytes to RootCABinNumber instead of NSS types r=rmf,kjacobs

Comment 3

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/5ecde4077049