492054 - Expire entries from nsPSMRememberCertErrorsTable::mErrorHosts hash table

Status: RESOLVED WONTFIX

(Core :: Security: PSM, enhancement)

Description

[Honza Bambas (:mayhemer)]

We store for each certificate that has some errors like domain name mismatch an entry to mErrorHosts hast table. We may by time bloat this table and keep already expired information that has to be kept only for time of the client SSL session remains valid. Thus, we should expire those entries from time to time.

This feature has been implemented in bug 445871 that is 1.9.1 blocking. We should decide if this should come to 1.9.1 as well.

Comment 1

[Honza Bambas (:mayhemer)]

Good first bug.

Comment 2

[Josh Aas]

Each entry in the table is a struct containing three bool values. The entries are only stored when there is a cert error (rarely), and if the error ever clears up they are removed.

I'll leave this bug open but I'm not going to work on it now as the memory cost is very minor.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

AFAICT, this is not worth tracking for MemShrink. If this is coming up often, it is most likely because users are running into bogus cert errors (i.e. false positives) and we should fix *that*. Otherwise, this will be extremely unlikely to bloat things. Realistically, we will not ever have enough time to implement any optimizations for the cert error case. Re-open if you disagree.

Comment 4

[Nicholas Nethercote [inactive]]

We marked it MemShrink:P3 because it's a small, rare leak.  WONTFIXing seems reasonable to me.