Commit fe0468b1 authored by Dana Keeler's avatar Dana Keeler
Browse files

Bug 1712837 - introduce ipcclientcerts to allow client certificates to work... 

Bug 1712837 - introduce ipcclientcerts to allow client certificates to work with the socket process r=rmf,kershaw,necko-reviewers,ipc-reviewers,nika,jschanck

This patch introduces ipcclientcerts, a PKCS#11 module that the socket process
can load to get access to client certificates and keys managed by the parent
process. This enables client certificate authentication to work with the socket
process (particularly for keys stored outside of NSS, as with osclientcerts or
third-party PKCS#11 modules).

Differential Revision: https://phabricator.services.mozilla.com/D122392
parent f573cb14

Cargo.lock

+11 −0
Original line number Diff line number Diff line
@@ -2449,6 +2449,17 @@ dependencies = [ 
 "libc",

]



[[package]]

name = "ipcclientcerts-static"

version = "0.1.0"

dependencies = [

 "byteorder",

 "once_cell",

 "pkcs11",

 "rsclientcerts",

 "sha2",

]



[[package]]

name = "itertools"

version = "0.8.2"

Cargo.toml

+1 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ members = [ 
  "js/src/rust",

  "js/src/wasm/cranelift",

  "netwerk/test/http3server",

  "security/manager/ssl/ipcclientcerts",

  "security/manager/ssl/osclientcerts",

  "testing/geckodriver",

  "toolkit/crashreporter/rust_minidump_writer_linux",

browser/components/extensions/parent/ext-pkcs11.js

+2 −1
Original line number Diff line number Diff line
@@ -49,7 +49,8 @@ this.pkcs11 = class extends ExtensionAPI { 
        }

        if (

          manifestLib !== ctypes.libraryName("nssckbi") &&

          manifestLib !== ctypes.libraryName("osclientcerts")

          manifestLib !== ctypes.libraryName("osclientcerts") &&

          manifestLib !== ctypes.libraryName("ipcclientcerts")

        ) {

          return hostInfo.manifest;

        }

browser/components/extensions/test/xpcshell/test_ext_pkcs11_management.js

+20 −0
Original line number Diff line number Diff line
@@ -204,6 +204,26 @@ add_task(async function test_pkcs11() { 
        /No such PKCS#11 module osclientcerts/,

        "getModuleSlots should not work on the built-in osclientcerts module"

      );

      await browser.test.assertRejects(

        browser.pkcs11.installModule("ipcclientcerts", 0),

        /No such PKCS#11 module ipcclientcerts/,

        "installModule should not work on the built-in ipcclientcerts module"

      );

      await browser.test.assertRejects(

        browser.pkcs11.uninstallModule("ipcclientcerts"),

        /No such PKCS#11 module ipcclientcerts/,

        "uninstallModule should not work on the built-in ipcclientcerts module"

      );

      await browser.test.assertRejects(

        browser.pkcs11.isModuleInstalled("ipcclientcerts"),

        /No such PKCS#11 module ipcclientcerts/,

        "isModuleLoaded should not work on the built-in ipcclientcerts module"

      );

      await browser.test.assertRejects(

        browser.pkcs11.getModuleSlots("ipcclientcerts"),

        /No such PKCS#11 module ipcclientcerts/,

        "getModuleSlots should not work on the built-in ipcclientcerts module"

      );

      browser.test.notifyPass("pkcs11");

    } catch (e) {

      browser.test.fail(`Error: ${String(e)} :: ${e.stack}`);

browser/installer/package-manifest.in

+2 −0
Original line number Diff line number Diff line
@@ -372,6 +372,8 @@ bin/libfreebl_64int_3.so 
#endif

#endif



@BINPATH@/@DLL_PREFIX@ipcclientcerts@DLL_SUFFIX@



; For process sandboxing

#if defined(MOZ_SANDBOX)

#if defined(XP_LINUX)