598282 - ESS: Security Labels (RFC2634 - 3)

Status: NEW

(MailNews Core :: Security: S/MIME, enhancement)

Description

[Raphaël Fairise]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Build Identifier: 

Here is a patch for comm-central which provides RFC 2634 S/MIME Security Labels for Thunderbird and Seamonkey.
A security label is a set of security information regarding the sensitivity of the content that is protected by S/MIME encapsulation.

A security label is a S/MIME signature attribute composed of:
* Security Policy Identifier
* Security Classification (optional)
* Privacy Mark (optional)
* Security Categories (optional) 


The patch is split in 4 parts:
* patch-smime-security-labels-backend.diff (for comm-central)
* patch-smime-security-labels-ui.diff (for comm-central)
* patch-smime-security-labels-style.diff (for comm-central)
* patch-smime-security-labels-nss.diff (for mozilla-central)

(These patches have been updated with comm-central as of 2010/09/20)

Screenshots are available here (in Trustedbird 3.1 section):
http://adullact.net/plugins/mediawiki/wiki/milimail/index.php/Security_Labels

You can test this feature in Thunderbird 3.1 by downloading our test build called Trustedbird:
http://adullact.net/plugins/mediawiki/wiki/milimail/index.php/Trustedbird


Security policies should be installed as an XML file in a "securityLabel" directory in user's profile directory.
A security policy sample (securityLabelPolicy-sample.xml) and its XML schema (securityLabelPolicy-schema.xsd) are attached to this bug.


What needs to be watched/checked carefully:
* memory management in NSS: I'm not sure to have understood everything about
memory allocation/freeing with arena pools.
* functions to DER-encode/decode OID strings.

Ideas:
* Hide the menu item "S/MIME Security Label" when no XML profiles are installed.


Reproducible: Always

Comment 1

[Raphaël Fairise]

Attachment: patch-smime-security-labels-backend.diff

Comment 2

[Raphaël Fairise]

Attachment: patch-smime-security-labels-ui.diff

Comment 3

[Raphaël Fairise]

Attachment: patch-smime-security-labels-style.diff

Comment 4

[Raphaël Fairise]

Attachment: patch-smime-security-labels-nss.diff

Comment 5

[Raphaël Fairise]

Attachment: securityLabelPolicy-sample.xml

Comment 6

[Raphaël Fairise]

Attachment: securityLabelPolicy-schema.xsd

Comment 7

[Bryan Clark (DevTools PM) [:clarkbw]]

Comment on attachment 477079 [details] [diff] [review]
patch-smime-security-labels-ui.diff

(I feel like I did this once before but perhaps it got lost)

In general I'm wondering if you want more visible space to indicate when an email has a security label.  i.e. Once you've applied the label it might make sense to show the applied labels in the compose area window somewhere.  Similarly for the labels when displaying the message in the message header.  Treating them more like tags.

Going by the screenshots, here a quick review of the ui labels

=Compose window=

Menu item label seems fine

=Settings=

You likely don't need the header for this dialog.

The Security Categories looks a little non-standard but understandable and perhaps even better than more of those chooser types.  See a more standard type in "Preferences ... Composition -> (Keywords...)"

=Compose Info=

I would format the "Please note" section differently.  

In HTML / ASCII:
<center><span style="color:HighlightText;background-color:Highlight;">(!) Note: Email subjects are never encrypted.</span></center>

=View and sort messages with the security classification column=

I might name that column "Security" instead of "Security Classification" just to be brief and take up less space.  Column names don't have to be the exact meaning as they are just for reference.

=Message security info=

Looks fine.

Comment 8

[Ludovic Hirlimann [:Usul]]

kaie review ping ?

Comment 9

[Anton Kochkov]

Any news on this bug? Or it seems abandoned? Like Trustedbird at all? Thats bad :(

Comment 10

[Kai Engert [:KaiE:]]

Comment on attachment 477078 [details] [diff] [review]
patch-smime-security-labels-backend.diff

sorry, I don't have time to review this

also any new feature would require automated tests

Comment 11

[Mark Banner (:standard8)]

Comment on attachment 477078 [details] [diff] [review]
patch-smime-security-labels-backend.diff

Clearing review request completely, if Raphaël or someone is willing to pick this up and update the patch as well as provide unit tests, then we can try and find someone to review it.

Comment 12

[Wayne Mery (:wsmwk)]

Raphael is unable to continue with the patches

Comment 13

[Ludovic Hirlimann [:Usul]]

Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.