1759162 - PKCS#11 loading on Linux through the browser.pkcs11 API is broken since Bug 1745352 landed

Status: VERIFIED FIXED

(WebExtensions :: General, defect, P1)

Description

[Wouter Verhelst :wouter]

Given a file /usr/lib/mozilla/pkcs11-modules/beidpkcs11.json with the following contents:

{
"name": "beidpkcs11",
"description": "Belgium eID PKCS#11 module",
"path": "libbeidpkcs11.so.0",
"type": "pkcs11",
"allowed_extensions": ["[e-mail]"]
}

then the following call:

browser.pkcs11.isModuleInstalled("beidpkcs11")

will throw an error rather than returning a promise resolving to "true". The browser console says:

OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH

This is in ext-pkcs11.js:54:37.

That line was modified recently through bug 1745352, so I suspect an error in the PathUtils.filename method.

(I can't currently test whether the bug occurs on other platforms; if necessary I can do this next Monday)

Comment 1

[Alex Cornestean]

Hello,

I’m from QA and attempting to reproduce the issue in order to confirm it, however I’m having some trouble with this. I've attempted to reproduce the issue on the latest Release (98.0/20220304153049) so far, under Ubuntu 16.04 LTS.

Following the information you have provided thus far, I’ve made a “beidpkcs11.json” file with the content you provided and proceeded with putting it in /usr/lib/mozilla/pkcs11-modules/ (the pkcs11-modules folder was not present so I had to create it).

Next I’ve tried to call browser.pkcs11.isModuleInstalled("beidpkcs11"), but the console returns an error stating that browser.pkcs11 is not defined.

Would you mind providing some more detailed steps to reproduce and any extensions you used when you encountered the issue? Thank you !

Comment 2

[Wouter Verhelst :wouter]

You are aware that this is an add-on specific API, right?

You can't run it from the web console, you'd need an add-on console (and you'll need to update the beidpkcs11.json file to allow your add-on to access it).

Comment 3

[Alex Cornestean]

@Wouter Verhelst

I’m not very familiar with either PKCS#11 or the used API.

That is why I was asking for some more detailed steps to reproduce the issue as well as the extension you used when you encountered the problem.

Thank you !

Comment 4

[Luca Greco [:rpl] [:luca] [:lgreco]]

Hi Alex,
I took a look if I could help you to figure out how to reproduce this issue, and if I'm not mistaken the extension mentioned in comment 0 is ulisted but it should be possible to download it manually from https://eid.belgium.be/en

Let me know if this additional detail didn't help yet to confirm the STR to be used to reproduce this issue.

Comment 5

[Alex Cornestean]

Hello Luca and thank you for the info !

Based on what you mentioned I managed to find an extension on AMO which matches "allowed_extensions": ["[e-mail]"] from the beidpkcs11.json contents and is designed to use the Belgian eID in Firefox: https://addons.mozilla.org/en-US/firefox/addon/belgium-eid/ .

Now, with the provided “beidpkcs11.json” placed at “/usr/lib/mozilla/pkcs11-modules/”, and the above extension installed, I accessed the add-on console and called browser.pkcs11.isModuleInstalled("beidpkcs11").

As described in the initial description, the browser console logs the following error:
“ OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37 “

For more details, see the attached screenshot.

Reproduced the issue on the latest Nightly (100.0a1/20220314214902), Beta (99.0b3/20220313185831) and Release ( 98.0.1/20220313140707) under Ubuntu 16.04 LTS.

Comment 6

[Alex Cornestean]

Attachment: Screenshot from 2022-03-15 10-15-42.png

Comment 7

[Wouter Verhelst :wouter]

Thanks.

Please note that this issue is causing our add-on to be completely non-functional. We're getting a number of one-star reviews as a result, when it is not really our fault. Can this please be given the appropriate priority?

Comment 8

[Luca Greco [:rpl] [:luca] [:lgreco]]

Attachment: Bug 1759162 - Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r?barret!,willdurand!

PathUtils.filename throws if the path is not an absolute path, which was likely
not the case with the OS.Path.basename call used previously.

This internal change of behavior shouldn't be triggering any issue on Windows,
where the hostInfo.manifest.path seems to be always normalized into an absolute
path (by computing it as relative to the hostInfo.manifest if it wasn't already
an absolute path), but it makes browser.pkcs11.isModuleInstalled to regress
on Linux (and maybe also on MacOS if the pkcs11 manifest files include only
the library name and not its full path, as it seems to be the case for
the Belgium eID pkcs11 manifest packaged for Linux).

The result of PathUtils.filename is expected to only include the basename of
the file (without the full dir path and the file extension) and so to fix
the regression being triggered on non-windows platform we could use a fake
absolute url to get the expected result using PathUtils.filename as is.

Comment 9

[Luca Greco [:rpl] [:luca] [:lgreco]]

I'll look into adding a test case to explicitly cover the behavior expected when the pkcs11 module path in the pkcs11 manifest.json file is not an absolute path (based on a quick look to test_ext_pkcs11_management.js it seems that it is using using full paths to the module because that makes it possible to test mock pcks11 modules that are not in directory already part of the default system libraries paths).

Comment 10

[Luca Greco [:rpl] [:luca] [:lgreco]]

(In reply to Luca Greco [:rpl] [:luca] [:lgreco] from comment #9)

I'll look into adding a test case to explicitly cover the behavior expected when the pkcs11 module path in the pkcs11 manifest.json file is not an absolute path (based on a quick look to test_ext_pkcs11_management.js it seems that it is using using full paths to the module because that makes it possible to test mock pcks11 modules that are not in directory already part of the default system libraries paths).

I added a basic test assertion to cover the fix for this regression to the existing test cases, and pushed the patch to try:

• https://treeherder.mozilla.org/#/jobs?repo=try&revision=25694273d619c214428503fb068f0c9825399a91

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1745352

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9907f16a1b8a
Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r=barret,willdurand

Comment 13

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/9907f16a1b8a

Comment 14

[Alex Cornestean]

Verified the fix on the latest Nightly (100.0a1/20220316095231) under Ubuntu 16.04 LTS.

Following the STR used to confirm the issue (Comment 5), calling browser.pkcs11.isModuleInstalled("beidpkcs11") in the add-on console will no longer cause the “ OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37 “ error to be logged to the browser console.

Furthermore, the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11") is now “fulfilled” as opposed to “rejected” as it was before the fix.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta and Release approval when you get a chance.

Comment 16

[Wouter Verhelst :wouter]

Confirmed, works for me in nightly.

Comment 17

[Luca Greco [:rpl] [:luca] [:lgreco]]

Hi Alex, would you mind to also verify the same STR on MacOS and Windows?

The fix shouldn't have changed anything related to the behaviors expected on Windows, but it is theoretically covering both Linux and MacOS.

I'd like to double-check that the STR works fine also on the other two platforms before proceeding to request uplifts for Beta and Release.

Comment 18

[Alex Cornestean]

Verified the fix on the latest Nightly (100.0a1/20220316214937) under Windows 10 x64 and macOS 11.3.1.

• Windows:

I was having trouble identifying the location of where to put the “beidpkcs11.json” on Windows in order to check that the fix hasn’t caused any unwanted effects so I chose, based on Luca’s suggestion, to check the real user flow starting with installing the appropriate software from https://eid.belgium.be/en and the Belgium eID extension from AMO.

I’ve then proceeded to access the extension console and call browser.pkcs11.isModuleInstalled("beidpkcs11_64") (beidpkcs11_64 instead of beidpkcs11, as this seems to be the pkcs11 manifest installed with the software above).

No “OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37“ error was logged to browser console and the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11_64") is “fulfilled”.

So there is no negative impact on Windows as a result of the fix.

• MacOS:

I’ve placed the provided “beidpkcs11.json” file at /Library/Application Support/Mozilla/PKCS11Modules/
and calling browser.pkcs11.isModuleInstalled("beidpkcs11") in the add-on console did not throw any “OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37“ error in the browser console.

The promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11") is also “fulfilled”.

This should confirm that the issue is also fixed on macOS.

Comment 19

[Luca Greco [:rpl] [:luca] [:lgreco]]

Comment on attachment 9267841 [details]
Bug 1759162 - Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r?barret!,willdurand!

Beta/Release Uplift Approval Request

• User impact if declined: This issue may prevent to Linux (and likely also MacOS) users to log in on eGovernment websites (like Belgium eID case reported in this issue) that are using pkcs11 modules.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: same STR used to verify the fix on Nightly.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The risk should be low:

• the fix is small, covered by automated tests (with additions to trigger the scenario that was not covered before and prevented us from catching the regressions as soon as introduced)
• the fix is also limited to the part of the ext-pkcs11.js WebExtensions API script that is looking up the pkcs11 manifest files and it is not expected to affect any other behavior besides the one regressed by Bug 1759162 in Firefox 98 (and no change in behavior on the Windows platform, where the issues was not reproducible).

• String changes made/needed:

Comment 20

[Luca Greco [:rpl] [:luca] [:lgreco]]

Comment on attachment 9267841 [details]
Bug 1759162 - Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r?barret!,willdurand!

Beta/Release Uplift Approval Request

• User impact if declined: Same as Bug 1759162 comment 19

(If accepted for release too, it may also be worth to let QA to verify the uplift to beta first before uplifting it also to release, but it is worth to mention that the module didn't change in Firefox 99 and so we don't expect any difference between the fix applied to beta and the same fix applied to release)

• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Same as Bug 1759162 comment 19
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Same as Bug 1759162 comment 19
• String changes made/needed:

Comment 21

[Donal Meehan [:dmeehan]]

Comment on attachment 9267841 [details]
Bug 1759162 - Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r?barret!,willdurand!

Approved for 99.0b5. Thanks.

Comment 22

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/84490e4c249d

Comment 23

[Wouter Verhelst :wouter]

wfm in beta.

Comment 24

[Alex Cornestean]

Verified the fix on the latest Beta (99.0b6/20220320185956) under Windows 10 x64, Ubuntu 16.04 LTS and macOS 11.3.1.

Ubuntu:
Following the STR from Comment 5, calling browser.pkcs11.isModuleInstalled("beidpkcs11") in the add-on console will not throw the “ OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37 “ error in the browser console.
Furthermore, the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11") is also “fulfilled”.

MacOS:
Following the STR used to verify the fix on Nightly in Comment 18, calling browser.pkcs11.isModuleInstalled("beidpkcs11") in the add-on console did not throw any “OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37“ error in the browser console.
The promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11") is also “fulfilled”.

Windows:
Following the STR used to verify the fix on Nightly in Comment 18, no “OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37“ error was logged to browser console and the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11_64") is “fulfilled”.

In conclusion, the fix is confirmed on Beta, on Linux and macOS. Furthermore, no negative impact was observed on Windows as a result of the fix.

Comment 25

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9267841 [details]
Bug 1759162 - Fix pkcs11.isModuleInstalled regressions triggered on non-windows builds. r?barret!,willdurand!

Regression, P1/S2, verified by QA on nightly and Beta 6 => approved for 98.0.2, thanks.

Comment 26

[Pascal Chevrel:pascalc (PTO until April 26)]

https://hg.mozilla.org/releases/mozilla-release/rev/50ef8a785b49

Comment 27

[Alex Cornestean]

Verified the fix on the latest Release (98.0.2/20220322144853) under Windows 10 x64, Ubuntu 16.04 LTS and macOS 11.3.1.

Following the steps from Comment 24, the same results have been obtained as on Beta i.e.

On macOS and Ubuntu:

• calling browser.pkcs11.isModuleInstalled("beidpkcs11") in the add-on console will not throw the “ OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37 “ error in the browser console.
• the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11") is “fulfilled”.

On Windows:

• calling browser.pkcs11.isModuleInstalled("beidpkcs11_64") in the add-on console will not throw the “ OperationError: PathUtils.filename: Could not initialize path: NS_ERROR_FILE_UNRECOGNIZED_PATH ext-pkcs11.js:54:37 “ error in the browser console.
• the promise resulting from calling browser.pkcs11.isModuleInstalled("beidpkcs11_64") is “fulfilled”.

In conclusion, the fix is confirmed on Firefox Release, on Linux and macOS, and no negative impact has been observed on Windows.