1976779 - rsclientcerts: make each backend responsible for rate-limiting calls to find_objects

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) [:keeler]]

rsclientcerts::manager rate-limits calls to find_objects to once every 3 seconds because the underlying operation can be time-consuming (in particular, on macOS and Windows, if there are many certificates/keys available). On Android, keys aren't available until the user selects one, which means that if a call to find_objects happens before the selection prompt is shown (which is currently what happens) and the user chooses one in less than 3 seconds, the backend won't search again, thus making it seem like no keys are available, which causes Firefox to not send a client certificate. It would be better if each backend implementation were responsible for this rate-limiting, because only they know if it's appropriate to do so.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1976779 - rsclientcerts: make each backend responsible for rate-limiting calls to find_objects r?jschanck

Before this patch, rsclientcerts::manager would rate-limit calls to
find_objects to once every 3 seconds because the underlying operation can be
time-consuming (in particular, on macOS and Windows, if there are many
certificates/keys available). On Android, keys aren't available until the user
selects one, which means that if a call to find_objects happened before the
selection prompt was shown (which is what happens) and the user chose one in
less than 3 seconds, the backend wouldn't search again, thus making it seem like
no keys were available, which would cause Firefox to not send a client
certificate. This patch makes each backend implementation responsible for this
rate-limiting, because only they know if it's appropriate to do so.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c4a98fc4f3b6
https://hg.mozilla.org/integration/autoland/rev/3a804f83c6b2
rsclientcerts: make each backend responsible for rate-limiting calls to find_objects r=jschanck

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/3a804f83c6b2