1662636 - rework bug 1658042 to avoid CryptFindCertificateKeyProvInfo

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Ivaylo Ivanov]

Since the landing of Bug 1658042 - the SSL client authentication is no longer possible in FF.

The browser just hangs and constantly reloads the page.

Tried with 2 different certs having:
public key: RSA 2048, Signature Algorithm: SHA-256 with RSA Encryption v3
public key: RSA 1024 bit, Signature Algorithm: SHA-1 with RSA Encryption v3

Also clicking the 'View Certificates' button in about:preferences#privacy causes the main window to hang, but several seconds later the Certificate Manager dialog opens.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1658042

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Can you use https://profiler.firefox.com/ to get a profile of the hang when you click the "view certificates" button? Thanks!

Comment 3

[Ivaylo Ivanov]

Here is the result
https://share.firefox.dev/2Fob600

(Sorry for the late response)

Comment 4

[Ivaylo Ivanov]

I would be really glad if someone explains what this report actually shows.
I saw that the UI thread is waiting to be notified (NtWaitForAlertByThreadId)

But how can I find which thread is supposed to send the notification and what is it actually doing ?

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Unfortunately that profile doesn't have the information I need. Can you repeat that but using custom settings in the profiler, with the "all registered threads" checkbox checked? Thanks!

Comment 6

[Ivaylo Ivanov]

here it is:
https://share.firefox.dev/3ho2Sm7

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks. I forgot the thread I'm looking for doesn't get registered to the profiler, so we can't look at it directly. We may just have to back out bug 1658042 since without NSS and PSM changes it doesn't help anyway.

Comment 8

[Ivaylo Ivanov]

Well ... This makes sense to me.
Btw - is there a way for debugging this code at runtime ? (So that - we can track the chain of calls and see which part really hangs - I suspect it's sme native call for obtaining the certificates (may be due to the fact that my PC can't actually reach the domain controller currently - so the cert response is delayed for some reason)

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

If you're familiar with windbg you could try using that. The thread you're looking for will be running code in a library called osclientcerts (or maybe osclientcerts-static).

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1662636 - osclientcerts: rework legacy key handling to avoid slow APIs r?kjacobs

Bug 1658042 attempted to identify keys that could only handle legacy crypto
using CryptFindCertificateKeyProvInfo. However, it appears that this API can
be incredibly slow and potentially involve network I/O. This patch reworks
the legacy crypto handling by using CryptAcquireCertificatePrivateKey with the
CRYPT_ACQUIRE_SILENT_FLAG flag to avoid showing UI at inopportune times.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7927a1705247
osclientcerts: rework legacy key handling to avoid slow APIs r=kjacobs

Comment 12

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/7927a1705247

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:keeler, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.