1747320 - PSM should use the newly defined CRLite filter coverage metadata

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement)

Description

[John Schanck [:jschanck]]

The cert-revocations collection in remote settings now includes more fine-grained information about which certificates are covered by a CRLite filter. PSM should use this information when deciding whether or not to query a CRLite filter on a particular certificate.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1747320 - Only query CRLite on covered certificates. r=keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d4a6f5cb9b3f
Only query CRLite on covered certificates. r=keeler

Comment 3

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/d4a6f5cb9b3f

Comment 4

[Norisz Fay [:noriszfay]]

Backed out for breaking connectivity with many https sites (bug 1750188)

Backout link: https://hg.mozilla.org/mozilla-central/rev/f00c5f3ac20092dc89512735a759f25a29b42467

Comment 5

[mac198442]

Is there someway to update tests such that they do not only pass with new profiles?

Comment 6

[mac198442]

Just me but wondering if bad interaction with the change in bug 1748341

Comment 8

[John Schanck [:jschanck]]

The TLS connectivity failures were due to a function that returned the wrong return code if CRLite was in a "partially initialized" state.

Fully initializing CRLite involves two requests to Remote Settings. With new profiles, completion of the first request transitioned CRLite to a partially initialized state and broke clients' ability to establish TLS connections. This prevented the second Remote Settings request from being made, so clients were stuck partially initialized. With old profiles, the data on disk was not sufficient to fully initialize CRLite, so they were broken from start up. We have tests to cover the initialization, but those tests simulate Remote Settings by self-serving over HTTP.

This patch has been updated to fix the return code issue. Tests that initialize CRLite with partial/corrupted information have been added under Bug 1640316.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f0193ca7b5a
Only query CRLite on covered certificates. r=keeler

Comment 10

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/0f0193ca7b5a