686842 - Implement SSL certificate CA pinning for blocklist

Status: RESOLVED DUPLICATE of bug 1030135

(Toolkit :: Add-ons Manager, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #685064 +++

We need to implement the same kind of CA pinning mechanism for the blocklist that we have for AUS. This will reduce the risks associated with implementing the CA blocklist (bug 647868).

The goal of the CA blocklist is to protect against certificates that were mis-issued by CAs. Twice this year, CAs have mis-issued certificates for addons.mozilla.org. Those certificates would thus have been able to modify the CA blocklist, if we had had the CA blocklisting feature in place at the time. Restricting the set of CAs that we would accept as CAs for the blocklist download would greatly reduce this attack surface--the attacker would have to compromise one of the two CAs that whitelist, instead of just the weakest CAs in our CA program.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

sec review triage = flag removed

Comment 2

[Daniel Veditz [:dveditz]]

Pinning would happen in the client, not server: moving to Toolkit. Assuming this uses the same reviewed code we are using to pin other services it doesn't need a separate sec-review.

Comment 3

[Kris Maglione [:kmag]]

It doesn't look like the blocklist domain is in our list of static key pins:

https://searchfox.org/mozilla-central/source/security/manager/tools/PreloadedHPKPins.json#165-223

Keeler, would it be a good idea to add it?

Andrew, what domain do we currently fetch blocklists from?

Comment 4

[Andrew Swan [:aswan]]

I believe it comes from
https://searchfox.org/mozilla-central/rev/8976abf9cab8eb4661665cc86bd355cd08238011/modules/libpref/init/all.js#2702

https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PING_COUNT%/%TOTAL_PING_COUNT%/%DAYS_SINCE_LAST_PING%/

Comment 5

[Dana Keeler (she/her) [:keeler]]

This entry should cover it: https://searchfox.org/mozilla-central/rev/8976abf9cab8eb4661665cc86bd355cd08238011/security/manager/tools/PreloadedHPKPins.json#193 so we can probably close this as a duplicate of bug 1030135.

Comment 6

[Kris Maglione [:kmag]]

Ah, I missed that. Thanks.