This removes nsIPK11TokenDB and introduces a more direct way of obtaining the
internal key token via:
Cc["@mozilla.org/security/internalkeytoken;1"].createInstance(Ci.nsIPKCS11Token)
It also takes the opportunity to rename PKCS#11 token-related files,
interfaces, and classes (generally, removing any "ns" prefix and expanding
"PK11" to "PKCS11").
Differential Revision: https://phabricator.services.mozilla.com/D298998
Serialize SSLTokensCache to ssl_tokens_cache.bin so TLS session tickets
survive browser restarts, enabling 0-RTT on first connections. A new Rust
crate handles zlib-compressed (Adler-32 integrity) bincode serialization
and atomic tmp→rename writes. Cert chain data is excluded from the
persisted format.
The cache writes to disk when the application is backgrounded (covering
Android OOM kills), daily when idle, and at graceful shutdown via
nsIAsyncShutdownBlocker, keeping all file I/O off the main thread. The
background read uses nsAutoLowPriorityIO to yield disk bandwidth to
startup-critical reads. Consumed and evicted tokens are removed from the
Rust shadow immediately, bounding its memory use independently of write
frequency.
The cache is always partitioned by top-level site via OriginAttributes,
matching cookie-partitioning semantics. CLEAR_TLS_TOKEN_CACHE is part of
CLEAR_COOKIES_AND_SITE_DATA and CLEAR_FORGET_ABOUT_SITE.
Differential Revision: https://phabricator.services.mozilla.com/D288348
Serialize SSLTokensCache to ssl_tokens_cache.bin so TLS session tickets
survive browser restarts, enabling 0-RTT on first connections. A new Rust
crate handles zlib-compressed (Adler-32 integrity) bincode serialization
and atomic tmp→rename writes. Cert chain data is excluded from the
persisted format.
The cache writes to disk when the application is backgrounded (covering
Android OOM kills), daily when idle, and at graceful shutdown via
nsIAsyncShutdownBlocker, keeping all file I/O off the main thread. The
background read uses nsAutoLowPriorityIO to yield disk bandwidth to
startup-critical reads. Consumed and evicted tokens are removed from the
Rust shadow immediately, bounding its memory use independently of write
frequency.
The cache is always partitioned by top-level site via OriginAttributes,
matching cookie-partitioning semantics. CLEAR_TLS_TOKEN_CACHE is part of
CLEAR_COOKIES_AND_SITE_DATA and CLEAR_FORGET_ABOUT_SITE.
Differential Revision: https://phabricator.services.mozilla.com/D288348
Serialize SSLTokensCache to ssl_tokens_cache.bin so TLS session tickets
survive browser restarts, enabling 0-RTT on first connections. A new Rust
crate handles zlib-compressed (Adler-32 integrity) bincode serialization
and atomic tmp→rename writes. Cert chain data is excluded from the
persisted format.
The cache writes to disk when the application is backgrounded (covering
Android OOM kills), daily when idle, and at graceful shutdown via
nsIAsyncShutdownBlocker, keeping all file I/O off the main thread. The
background read uses nsAutoLowPriorityIO to yield disk bandwidth to
startup-critical reads. Consumed and evicted tokens are removed from the
Rust shadow immediately, bounding its memory use independently of write
frequency.
The cache is always partitioned by top-level site via OriginAttributes,
matching cookie-partitioning semantics. CLEAR_TLS_TOKEN_CACHE is part of
CLEAR_COOKIES_AND_SITE_DATA and CLEAR_FORGET_ABOUT_SITE.
Differential Revision: https://phabricator.services.mozilla.com/D288348
Serialize SSLTokensCache to ssl_tokens_cache.bin so TLS session tickets
survive browser restarts, enabling 0-RTT on first connections. A new Rust
crate handles zlib-compressed (Adler-32 integrity) bincode serialization
and atomic tmp→rename writes. Cert chain data is excluded from the
persisted format.
The cache writes to disk when the application is backgrounded (covering
Android OOM kills), daily when idle, and at graceful shutdown via
nsIAsyncShutdownBlocker, keeping all file I/O off the main thread. The
background read uses nsAutoLowPriorityIO to yield disk bandwidth to
startup-critical reads. Consumed and evicted tokens are removed from the
Rust shadow immediately, bounding its memory use independently of write
frequency.
The cache is always partitioned by top-level site via OriginAttributes,
matching cookie-partitioning semantics. CLEAR_TLS_TOKEN_CACHE is part of
CLEAR_COOKIES_AND_SITE_DATA and CLEAR_FORGET_ABOUT_SITE.
Differential Revision: https://phabricator.services.mozilla.com/D288348
This also introduces a shared serial background task queue for doing NSS
operations that are known to have threading issues. In the future, it may be
beneficial to perform more such operations on this queue (perhaps even NSS
initialization itself).
Differential Revision: https://phabricator.services.mozilla.com/D282022
In the patches that add the PKCS#11 utility process in bug 1957156, some
of the work was guarded only by !MOZ_NO_SMART_CARDS, and some of the
work was additionally guarded by NIGHTLY_BUILD. This complicates things
without providing much value. Let's check both guards everywhere to
avoid these complications.
Differential Revision: https://phabricator.services.mozilla.com/D279000
This patch defines a placeholder LoadModule IPDL message for
cross-process interaction between the main process and the PKCS#11
utility process. The correct implementation will come in future patches.
This is preliminary work guarded by a Nightly-only pref. It is intended
as a helpful basis for future work by Security Engineering. We don't
actually load the modules within the utility process for the moment.
Differential Revision: https://phabricator.services.mozilla.com/D271624
This patch adds code that starts the dedicated utility process for
PKCS#11 module loading in Nightly builds. We add a new pref to control
this behavior: security.utility_pkcs11_module_process.enabled
This is preliminary work intended as a helpful basis for future work by
Security Engineering. We don't actually load the modules within the
utility process for the moment.
Differential Revision: https://phabricator.services.mozilla.com/D270692
This reverts commit 5626a548d0.
Revert "Bug 1957156 - Start the PKCS#11 module utility process behind a pref in Nightly. r=ipc-reviewers,keeler,nika"
This reverts commit 17d106ca7c.
Revert "Bug 1957156 - Let the PKCS#11 process run a dedicated executable on macOS in Nightly. r=haik,nika"
This reverts commit a9b9132117.
Revert "Bug 1957156 - Add a new utility process kind for PKCS#11 module loading. r=haik,ipc-reviewers,fluent-reviewers,bolsson,keeler,nika"
This reverts commit 2485ac3023.
Revert "Bug 1957156 - Cleanup pass in utility code. r=ipc-reviewers,nika,haik"
This reverts commit 5760381119.
This patch defines a placeholder LoadModule IPDL message for
cross-process interaction between the main process and the PKCS#11
utility process. The correct implementation will come in future patches.
This is preliminary work guarded by a Nightly-only pref. It is intended
as a helpful basis for future work by Security Engineering. We don't
actually load the modules within the utility process for the moment.
Differential Revision: https://phabricator.services.mozilla.com/D271624
This patch adds code that starts the dedicated utility process for
PKCS#11 module loading in Nightly builds. We add a new pref to control
this behavior: security.utility_pkcs11_module_process.enabled
This is preliminary work intended as a helpful basis for future work by
Security Engineering. We don't actually load the modules within the
utility process for the moment.
Differential Revision: https://phabricator.services.mozilla.com/D270692
This also drops the category argument. The category string was confusing
because it ends up a field of the marker and not the actual category which is
an enum. Having the category as a field isn't really helpful.
This also sets us up for unifying AUTO_PROFILER_MARKER and
AUTO_PROFILER_MARKER_UNTYPED which become basically the same.
Differential Revision: https://phabricator.services.mozilla.com/D269992
This also drops the category argument. The category string was confusing
because it ends up a field of the marker and not the actual category which is
an enum. Having the category as a field isn't really helpful.
This also sets us up for unifying AUTO_PROFILER_MARKER and
AUTO_PROFILER_MARKER_UNTYPED which become basically the same.
Differential Revision: https://phabricator.services.mozilla.com/D269992
This also drops the category argument. The category string was confusing
because it ends up a field of the marker and not the actual category which is
an enum. Having the category as a field isn't really helpful.
This also sets us up for unifying AUTO_PROFILER_MARKER and
AUTO_PROFILER_MARKER_UNTYPED which become basically the same.
Differential Revision: https://phabricator.services.mozilla.com/D269992
This also drops the category argument. The category string was confusing
because it ends up a field of the marker and not the actual category which is
an enum. Having the category as a field isn't really helpful.
This also sets us up for unifying AUTO_PROFILER_MARKER and
AUTO_PROFILER_MARKER_UNTYPED which become basically the same.
Differential Revision: https://phabricator.services.mozilla.com/D269992
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
On macOS and Windows, the underlying implementations of the OS APIs that
provide access to keys and certificates are not necessarily thread-safe. Before
this patch, essentially all calls into osclientcerts would be synchronously
forwarded to a single background thread. Unfortunately, the cost of dispatching
and waiting for all of these events was non-trivial, particularly when the vast
majority of them should essentially be no-ops (e.g. when NSS is looking for CA
certificates or trust information, etc.). This patch reworks the implementation
to only dispatch operations involving OS APIs to the background thread.
Differential Revision: https://phabricator.services.mozilla.com/D246520
Alexandru Marc