915930 - (mozilla::pkix) Make mozilla::pkix the default certificate verifier

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P2)

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Matt, I'd like us to run the same kind of tests that we ran for testing TLS 1.2 compatibility against this feature, using the scripts you wrote. I suspect that we'll be ready for doing that testing in a day or two. If at all possible, we should try to do the compatibility testing in the next couple of weeks, if not sooner. If that time frame doesn't work for you, could you please send me the latest version of your testing script so I can try to run it? This is a high-priority feature and parts of it were uplifted to Firefox 29 already.

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

Sounds great. Will do. We can run the script at any time. 

Just let me know when we are ready to do so, as it sounds as if there are dependencies that we are waiting on.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

This should go in the Firefox 30 release notes.
This should not go into the Firefox 29 release notes.
I suspect you may want to wait until it is RESOLVED FIXED though.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Re-assigning the tracking bug because I'm basically on the hook for this.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I'm beginning the renaming of open bugs with "insanity::pkix" in the title as part of renaming the project to "mozilla::pkix". You'll likely receive a lot of bugspam. Apologies in advance.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: patch

Since bug 986156 is inbound and bug 987295 and bug 989516 are ready to land, we're looking to turn this on today. The intention of this patch is to add the pref (default false) to anything using gecko. Adding the pref (default true) in firefox.js makes it so it is only enabled in Firefox.

Comment 7

[Camilo Viecco (:cviecco)]

Comment on attachment 8399611 [details] [diff] [review]
patch

Review of attachment 8399611 [details] [diff] [review]:
-----------------------------------------------------------------

Why dont we make another bug (with this patch) to enable mozilla::pkix in firefox(only) and leave this when we what to have all products with it as default? (when we actually change the value in nsNSSComponent)

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 8399611 [details] [diff] [review]
patch

Ok - filed bug 990248.

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Do we know if it is going to be shipped with 30?

Comment 10

[Camilo Viecco (:cviecco)]

It is on 30,(In reply to Sylvestre Ledru [:sylvestre] from comment #9)
> Do we know if it is going to be shipped with 30?

The new certverifier is on 30 but it is not enabled by default as it has several performance and compatibility issues. The goal is default for 31.

Comment 11

[Camilo Viecco (:cviecco)]

Attachment: make-mozilla-pkix-default-certverifier

Comment 12

[Camilo Viecco (:cviecco)]

Hey brian, can you take a look at the patch. Do you think we can land this as default before 31 becomes aurora? (if so please review the patch) I can land it.

Comment 13

[Camilo Viecco (:cviecco)]

Comment on attachment 8412359 [details] [diff] [review]
make-mozilla-pkix-default-certverifier

Review of attachment 8412359 [details] [diff] [review]:
-----------------------------------------------------------------

This fill fix an issue on android (Bug  1001240) so we want it before the uplift on monday (this is just flippling a switch for all gecko instead of only for desktop).

Comment 14

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8412359 [details] [diff] [review]
make-mozilla-pkix-default-certverifier

Review of attachment 8412359 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks. I suggest emailing dev-platform to let the Thunderbird/SeaMonkey people know that they should look for trouble. You may want to explicitly mention bug 982340 to them.

Comment 15

[Camilo Viecco (:cviecco)]

 https://tbpl.mozilla.org/?tree=Try&rev=7c4e9794de0d

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/83c0c0d2436d

Comment 17

[Lukas Blakk [:lsblakk] use ?needinfo]

Marking tracking for 31 so that we can get this into QA test plans while it's on beta -- can someone put in steps for QA verification on this new feature?

Comment 18

[Dana Keeler (she/her) (use needinfo) [:keeler]]

This page should have the information necessary to test: https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing#Request_for_Testing
Testing basically consists of browsing https sites and making sure we get the same results as before (in some cases the behavior is different, but we definitely shouldn't be breaking any sites that use a certificate signed by a CA in our root program). The pref "security.use_mozillapkix_verification" controls whether or not the new library is in use.
There's also an automated compatibility testing script Matt Wobensmith developed. It would be great to run that, too.

Comment 19

[u279076]

(In reply to Lukas Blakk [:lsblakk] from comment #17)
> Marking tracking for 31 so that we can get this into QA test plans while it's on beta

Assuming you mean Firefox 30 Beta based on the status flags. Matt is already assigned here so I trust he can take care of verifying this is fixed.

Comment 20

[Matt Wobensmith [:mwobensmith][:matt:]]

Yes, I'll own QA verification. Thanks all.

Comment 21

[Lukas Blakk [:lsblakk] use ?needinfo]

This doesn't look to have landed on 30 at all - can someone confirm? I see it landing pre-merge to central (31). Also, yes, Matt will have this (my confusion was about this not being a sec bug)

Comment 22

[Matt Wobensmith [:mwobensmith][:matt:]]

This feature was targeted for Fx31. I believe it's present in Fx30 but off by default.

Comment 23

[Sylvestre Ledru [:Sylvestre]]

Added in the release notes: "mozilla::pkix as default certificate verifier"

Comment 24

[Dana Keeler (she/her) (use needinfo) [:keeler]]

This isn't meant to be enabled in 30.

Comment 25

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Hi Matt, as we get close to the release for 31 we're looking to verify all fixes marked as "verifyme". Since this is one of them, I wanted to ask you whether you're handling this one or if you need some help from us.

Comment 26

[Matt Wobensmith [:mwobensmith][:matt:]]

The default setting for mozilla::pkix in Fx31 is indeed turned on, so I am marking this as verified.