696976 - Client certificate UI blocks the SSL thread / socket transport thread

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P2)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

We present the client authentication UI and wait for the user to dismiss it synchronously in our client auth data hook (nsNSS_SSLGetClientAuthData in nsNSSIOLayer.cpp). Instead, we should dispatch an event to launch the UI and then return SECWouldBlock. libssl will wait for us to restart the handshake after the user has chosen his/her certificate.

This depends on one or more bugs in libssl being fixed.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: WIP: Bug 696976 - not the real changeset, but NSS changes for async client auth

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: WIP: Bug 696976 - async client auth ughhhh

Depends on D146258

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 696976 - move TLS client auth certificate selection implementation to its own file r?jschanck!

Depends on D146258

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 696976 - asynchronously handle client auth certificate requests from TLS servers r?jschanck!

Depends on D146366

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4b0ec373bcdd
move TLS client auth certificate selection implementation to its own file r=necko-reviewers,kershaw,jschanck
https://hg.mozilla.org/integration/autoland/rev/8f559e1cf746
asynchronously handle client auth certificate requests from TLS servers r=necko-reviewers,ipc-reviewers,nika,kershaw,rmf

Comment 10

[Cristina Cozmuta (:CrissCozmuta)]

https://hg.mozilla.org/mozilla-central/rev/4b0ec373bcdd
https://hg.mozilla.org/mozilla-central/rev/8f559e1cf746