It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
The race here is caused by the fact that CommonSocketControl::mUsedPrivateDNS was
initialized to false in the constructor, and then set to
`SetUsedPrivateDNS(GetProviderFlags() & nsISocketProvider::USED_PRIVATE_DNS);`
in SetCertVerificationResult.
However, these flags don't change, so we can just initialize it in the constructor.
Differential Revision: https://phabricator.services.mozilla.com/D267401
This patch reworks client auth certificate selection somewhat in that PSM will
now do basically no work to look for, select, or ask the user to select a
certificate until the server's certificate has been verified and the connection
has been claimed.
Differential Revision: https://phabricator.services.mozilla.com/D258082
Previously, rsclientcerts would have to heuristically determine when the
platform was searching for client auth certificates in order to avoid
re-querying the underlying certificate and key sources every time any part of
NSS looked for PKCS#11 objects. This heuristic was imprecise and constrained
the rest of the implementation that handles client auth certificates.
Now that osclientcerts and ipcclientcerts (the consumers of rsclientcerts) are
part of libxul, they can directly check if gecko is searching for client auth
certificates and update their list of known certificates and keys accordingly.
In theory, multiple simultaneous connections could cause multiple updates of
the known list of certificates and keys, so to prevent unnecessary costly work,
rsclientcerts will still only refresh its list of objects every 2 seconds (down
from 3 seconds previously).
Differential Revision: https://phabricator.services.mozilla.com/D237108
Previously, rsclientcerts would have to heuristically determine when the
platform was searching for client auth certificates in order to avoid
re-querying the underlying certificate and key sources every time any part of
NSS looked for PKCS#11 objects. This heuristic was imprecise and constrained
the rest of the implementation that handles client auth certificates.
Now that osclientcerts and ipcclientcerts (the consumers of rsclientcerts) are
part of libxul, they can directly check if gecko is searching for client auth
certificates and update their list of known certificates and keys accordingly.
In theory, multiple simultaneous connections could cause multiple updates of
the known list of certificates and keys, so to prevent unnecessary costly work,
rsclientcerts will still only refresh its list of objects every 2 seconds (down
from 3 seconds previously).
Differential Revision: https://phabricator.services.mozilla.com/D237108
Thunderbird uses nsITLSSocketControl.startTLS to drive the XMPP
connection, but since we started enforcing proper thread safety in
bug 1847260, it's asserting when called on the main thread.
This patch marks StartTLS and proxyStartTLS as [noscript] and adds
asyncStartTLS. This new method dispatches a runnable to the socket thread
to call startTLS, then resolves (or rejects with the nsresult as an arg)
on the main thread.
Differential Revision: https://phabricator.services.mozilla.com/D207692
Previously, the client authentication certificate selection dialog could show
up unexpectedly. Because it was modal, it would prevent user interaction with
the browser. It could even get in a state where the dialog couldn't be
interacted with, and neither could anything else, so the entire browser would
be locked and the user would have to quit and restart.
This patch associates a top-level outer content window ID (called "browserId"
in networking code) with each NSSSocketControl. When a peer asks for a client
authentication certificate, the NSSSocketControl can use the ID to find the
relevant tab and open a tab-modal dialog, which allows other browser UI to be
interacted with.
Some loads cannot be associated with browser tabs, and so the implementation
falls back to opening a window-modal dialog on the most recently active window.
This is still better than the previous implementation, since the dialog is
connected to a window rather than being its own separate dialog.
Differential Revision: https://phabricator.services.mozilla.com/D183775
Previously, the client authentication certificate selection dialog could show
up unexpectedly. Because it was modal, it would prevent user interaction with
the browser. It could even get in a state where the dialog couldn't be
interacted with, and neither could anything else, so the entire browser would
be locked and the user would have to quit and restart.
This patch associates a top-level outer content window ID (called "browserId"
in networking code) with each NSSSocketControl. When a peer asks for a client
authentication certificate, the NSSSocketControl can use the ID to find the
relevant tab and open a tab-modal dialog, which allows other browser UI to be
interacted with.
Some loads cannot be associated with browser tabs, and so the implementation
falls back to opening a window-modal dialog on the most recently active window.
This is still better than the previous implementation, since the dialog is
connected to a window rather than being its own separate dialog.
Differential Revision: https://phabricator.services.mozilla.com/D183775
Speculative connections to servers that request a client authentication
certificate can't make progress, because PSM buffers the "select a client
authentication certificate" dialog (otherwise, the dialog would show up
unexpectedly), but Necko won't claim the connection until the TLS handshake has
completed (which it won't, because the user needs to select a client
authentication certificate first). So, the only option is to cancel the
connection and have Necko make a new non-speculative connection.
Differential Revision: https://phabricator.services.mozilla.com/D180134
When necko makes a speculative connection, the peer may ask for a client
authentication certificate. This patch makes it so that when this happens,
no certificate selection UI will be shown until the connection is claimed (as
in, it is no longer merely speculative).
Differential Revision: https://phabricator.services.mozilla.com/D175528
If a TLS server asks for a client authentication certificate, no dialog asking
the user to select one should be shown until the server's certificate verifies
successfully.
Differential Revision: https://phabricator.services.mozilla.com/D175170
If a TLS server asks for a client authentication certificate, no dialog asking
the user to select one should be shown until the server's certificate verifies
successfully.
Differential Revision: https://phabricator.services.mozilla.com/D175170
John M. Schanck