Previously, remembered client authentication certificate decisions would be
partitioned by server certificate (as well as domain, obviously). This led to
unexpected behavior whereby a user could connect to the same domain multiple
times and be asked each time to choose a client certificate (given that a
single domain could be backed by multiple servers each with a different
certificate).
Differential Revision: https://phabricator.services.mozilla.com/D177562
Content sandbox level 1 was a configuration with a default-deny
seccomp-bpf policy but which allowed direct filesystem access; that
required additional code for the syscall filter which was untested and
tended to bit-rot. It was trivially escapable and was no longer being
used even for debugging, so this patch removes it.
The `security.sandbox.content.level` pref can still be set to 0 to
disable the sandbox, but if it's nonzero then we now enforce a minimum
level of 2, which restricts write access to files (but not read access
or the use of sockets).
Differential Revision: https://phabricator.services.mozilla.com/D176968
Due to design constraints, it is difficult for osclientcerts to properly
indicate whether or not each known key supports RSA-PSS. Ideally such a
determination would be made close to when a particular key is going to be used,
but due to the design of PKCS#11 and NSS' tight coupling to it, osclientcerts
would have to make this determination when searching for all known keys, which
has been shown to be prohibitively slow on Windows and results in unexpected
dialogs on macOS.
Thus, previously osclientcerts simply assumed all RSA keys supported RSA-PSS.
This has resulted in handshake failures when a server indicates that it accepts
RSA-PSS signatures.
This patch instead makes RSA-PSS support configurable via a pref
(security.osclientcerts.assume_rsa_pss_support). If the pref is true,
osclientcerts assumes all RSA keys support RSA-PSS. If it is false, it assumes
no RSA keys support RSA-PSS.
Differential Revision: https://phabricator.services.mozilla.com/D175966
Due to design constraints, it is difficult for osclientcerts to properly
indicate whether or not each known key supports RSA-PSS. Ideally such a
determination would be made close to when a particular key is going to be used,
but due to the design of PKCS#11 and NSS' tight coupling to it, osclientcerts
would have to make this determination when searching for all known keys, which
has been shown to be prohibitively slow on Windows and results in unexpected
dialogs on macOS.
Thus, previously osclientcerts simply assumed all RSA keys supported RSA-PSS.
This has resulted in handshake failures when a server indicates that it accepts
RSA-PSS signatures.
This patch instead makes RSA-PSS support configurable via a pref
(security.osclientcerts.assume_rsa_pss_support). If the pref is true,
osclientcerts assumes all RSA keys support RSA-PSS. If it is false, it assumes
no RSA keys support RSA-PSS.
Differential Revision: https://phabricator.services.mozilla.com/D175966
Due to design constraints, it is difficult for osclientcerts to properly
indicate whether or not each known key supports RSA-PSS. Ideally such a
determination would be made close to when a particular key is going to be used,
but due to the design of PKCS#11 and NSS' tight coupling to it, osclientcerts
would have to make this determination when searching for all known keys, which
has been shown to be prohibitively slow on Windows and results in unexpected
dialogs on macOS.
Thus, previously osclientcerts simply assumed all RSA keys supported RSA-PSS.
This has resulted in handshake failures when a server indicates that it accepts
RSA-PSS signatures.
This patch instead makes RSA-PSS support configurable via a pref
(security.osclientcerts.assume_rsa_pss_support). If the pref is true,
osclientcerts assumes all RSA keys support RSA-PSS. If it is false, it assumes
no RSA keys support RSA-PSS.
Differential Revision: https://phabricator.services.mozilla.com/D175966
Noemi Erli
Mark Banner
ffxbld
Anton Bobrov
Dana Keeler
Alexandre Lissy
Barret Rennie
Bob Owen
Iulian Moraru
Mike Hommey
Jed Davis
Dennis Jackson
Willy R. Vasquez
Norisz Fay
Tom Ritter
owlishDeveloper
Ryan VanderMeulen
Sandor Molnar
Shravan Narayan
Cosmin Sabou
Nika Layzell