291122 - No way to override certificate authentication callback from Netlib

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect)

Description

[Matthew Gertner]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

NSS offers the possibility of overriding the default certificate authentication
logic by calling SSL_AuthCertificateHook. However, there is no way (as far as I
can tell) to access this functionality using Netlib's public interfaces, since
these do not give access to the underlying socket implementation. This means
that anyone using the nsSocketTransportService to create a socket is restricted
to the authentication logic in SSL_AuthCertificate, which is inappropriate for
applications that do not base their certificate identity on domain names but
rather on proprietary identifiers (this might be the case, for example, for a
P2P application where clients can freely change IP addresses without changing
their identity).

I'm not sure what the correct resolution is. One idea would be to make the
PRFileDesc associated with the socket accessible through an additional interface
on the component returned by the nsSocketTransportService. In this way,
SSL_AuthCertificateHook could be called directly. But this seems to conflate
Netlib and NSS APIs, which is probably not desirable. Another option would be to
use the security callbacks that can be set using the nsISocketTransport
interface. This is appealing because it would fit smoothly into the current
mechanism for overriding default Netlib behavior with respect to security. At
the same time, these callbacks seem to be used exclusively for overriding UI
behavior at present (e.g. changing the various prompt dialogs thrown up by NSS
for accepting certificates at the like), so I'm not sure if this would be
appropriate.

What I have in mind is a new interface nsIAuthCertificateCallbackProvider or the
like which would return the callback for authenticating certificates. This could
be implemented in a component that exposes nsIInterfaceRequestor and set to the
securityCallbacks member of the nsISocketTransport interface.


Reproducible: Always

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

necko does not know about SSL/TLS... this bug probably belongs to PSM

Comment 2

[Matthew Gertner]

(In reply to comment #1)
> necko does not know about SSL/TLS... this bug probably belongs to PSM

Just for clarification: I'm not suggesting that explicit dependencies on SSL/TSL
be added to Necko. But that securityCallbacks member suggests that Necko does
know about security, at least on a very generic level. It seems to me that if
this approach is valid for overriding security-related user dialogs, it might
also be valid for influencing other security-related behavior like certificate
authentication.

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Darin Fisher]

-> PSM

Comment 5

[Kai Engert (:KaiE:)]

reassign bug owner.
mass-update-kaie-20120918

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

We won't be supporting replacing the auth certificate callback in gecko for the time being.