1738592 - Allow NSS S/MIME code to call application defined certificate verification functions

Status: NEW

(NSS :: Libraries, enhancement, P3)

Description

[Kai Engert [:KaiE:]]

Function NSS_CMSSignedData_ImportCerts obtains the list of available certs, and decides which certificates it imports.

Thunderbird would like to be able to perform its own checks, prior to allowing a certificate to be imported.

I think the easiest approach to do this is:

Introduce a new API e.g. NSS_CMSSignedData_ImportCertsExt, which takes an additional callback function parameter. NSS could call the callback function prior to importing a candidate certificate. If the callback functions return SECFailure, the certificate is not imported.

Comment 1

[Kai Engert [:KaiE:]]

This change was suggested because of bug CVE-2021-43527 (and as a remedy we had added code in bug CVE-2021-43529).

(context: https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html )

Our remedy for the above was to duplicate code from NSS (copied into Thunderbird), and add additional checks locally.
https://hg.mozilla.org/comm-central/rev/2ff7d3a75e8f

We should undo that code duplication. Rather, we should enhance NSS in a general way to allow Thunderbird to perform its additional checks.

But it would be good to change it even more.

The NSS S/MIME code calls legacy API CERT_VerifyCert. Firefox has stopped using it already.

It would be good to allow the NSS S/MIME code to call the modern certificate verification code that the Firefox platform provides.
However, because that code is C++ and lives outside of NSS, we cannot call it by default.
I suggest we add a callback API to NSS, allowing Thunderbird to override the functions that are used.

To make this possible, it's necessary that mozilla::pkix supports certificate verification for the email usage.
(In earlier discussions, I mentioned that support is missing. Now I've looked more closely, and I see some support for it is already present. So either it already has what we need, or hopefully only little is missing.)

I've started to work on this idea.
I'll attach my initial patches for NSS and Thunderbird.

Comment 2

[Kai Engert [:KaiE:]]

Attachment: WIP: Bug 1738592

Comment 3

[Kai Engert [:KaiE:]]

Attachment: WIP: Bug 1738592 tb

Comment 4

[Kai Engert [:KaiE:]]

The patch doesn't work yet. There's a crash when sending a signed S/MIME message. Not yet sure what's wrong. Need to postpone this for a bit.

Comment 5

[BugBot [:suhaib / :marco]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.

Comment 6

[Suhaib Mujahid [:suhaib]]

Sorry, there was a problem with the detection of inactive users. I'm reverting the change.