Commit Graph

13765 Commits

Author SHA1 Message Date
Andrew McCreight
837f0af066 Bug 1493737 - Fix many trivial calls to do_QueryInterface r=smaug
If class A is derived from class B, then an instance of class A can be
converted to B via a static cast, so a slower QI is not needed.

Differential Revision: https://phabricator.services.mozilla.com/D6861

--HG--
extra : moz-landing-system : lando
2018-10-01 21:38:01 +00:00
Brindusan Cristian
9b5034705f Merge mozilla-central to autoland. a=merge CLOSED TREE 2018-10-02 01:04:29 +03:00
Brindusan Cristian
f8087305eb Merge inbound to mozilla-central. a=merge 2018-10-02 00:55:00 +03:00
Dana Keeler
0c4b612622 Bug 1493788 - remove other mozilla-specific dependencies from certificate transparency implementation r=jcj
This patch removes the remaining mozilla-specific dependencies from the
certificate transparency implementation.

Depends on D6845

Differential Revision: https://phabricator.services.mozilla.com/D6846

--HG--
extra : moz-landing-system : lando
2018-10-01 16:20:57 +00:00
Dana Keeler
1661adeb86 Bug 1493788 - convert mozilla::Vector to std::vector in certificate transparency implementation r=jcj
In order to make our certificate transparency implementation standalone, we
have to remove mozilla-specific dependencies such as mozilla::Vector.

Depends on D6844

Differential Revision: https://phabricator.services.mozilla.com/D6845

--HG--
extra : moz-landing-system : lando
2018-10-01 20:27:13 +00:00
Dana Keeler
24a8ad1851 Bug 1493788 - move certificate/binary transparency implementation to its own directory r=jcj
Our current certificate transparency implementation (and the start of the binary
transparency implementation) can almost be used by itself as a standalone
library (for comparison, mozilla::pkix already has this property, as evidenced
by the "Library('mozillapkix')" line in security/pkix/moz.build and the
"'mozillapkix'" line in the USE_LIBS section of
security/manager/ssl/tests/unit/tlsserver/cmd/moz.build).

These changes make this code re-usable as a library so that we'll be able to use
it in the updater to verify binary/certificate transparency information.

This first patch simply moves the code to its own directory.

Differential Revision: https://phabricator.services.mozilla.com/D6844

--HG--
rename : security/certverifier/BTInclusionProof.h => security/ct/BTInclusionProof.h
rename : security/certverifier/BTVerifier.cpp => security/ct/BTVerifier.cpp
rename : security/certverifier/BTVerifier.h => security/ct/BTVerifier.h
rename : security/certverifier/Buffer.cpp => security/ct/Buffer.cpp
rename : security/certverifier/Buffer.h => security/ct/Buffer.h
rename : security/certverifier/CTDiversityPolicy.cpp => security/ct/CTDiversityPolicy.cpp
rename : security/certverifier/CTDiversityPolicy.h => security/ct/CTDiversityPolicy.h
rename : security/certverifier/CTKnownLogs.h => security/ct/CTKnownLogs.h
rename : security/certverifier/CTLog.h => security/ct/CTLog.h
rename : security/certverifier/CTLogVerifier.cpp => security/ct/CTLogVerifier.cpp
rename : security/certverifier/CTLogVerifier.h => security/ct/CTLogVerifier.h
rename : security/certverifier/CTObjectsExtractor.cpp => security/ct/CTObjectsExtractor.cpp
rename : security/certverifier/CTObjectsExtractor.h => security/ct/CTObjectsExtractor.h
rename : security/certverifier/CTPolicyEnforcer.cpp => security/ct/CTPolicyEnforcer.cpp
rename : security/certverifier/CTPolicyEnforcer.h => security/ct/CTPolicyEnforcer.h
rename : security/certverifier/CTSerialization.cpp => security/ct/CTSerialization.cpp
rename : security/certverifier/CTSerialization.h => security/ct/CTSerialization.h
rename : security/certverifier/CTUtils.h => security/ct/CTUtils.h
rename : security/certverifier/CTVerifyResult.cpp => security/ct/CTVerifyResult.cpp
rename : security/certverifier/CTVerifyResult.h => security/ct/CTVerifyResult.h
rename : security/certverifier/MultiLogCTVerifier.cpp => security/ct/MultiLogCTVerifier.cpp
rename : security/certverifier/MultiLogCTVerifier.h => security/ct/MultiLogCTVerifier.h
rename : security/certverifier/SignedCertificateTimestamp.cpp => security/ct/SignedCertificateTimestamp.cpp
rename : security/certverifier/SignedCertificateTimestamp.h => security/ct/SignedCertificateTimestamp.h
rename : security/certverifier/SignedTreeHead.h => security/ct/SignedTreeHead.h
rename : security/certverifier/moz.build => security/ct/moz.build
rename : security/certverifier/tests/gtest/BTSerializationTest.cpp => security/ct/tests/gtest/BTSerializationTest.cpp
rename : security/certverifier/tests/gtest/CTDiversityPolicyTest.cpp => security/ct/tests/gtest/CTDiversityPolicyTest.cpp
rename : security/certverifier/tests/gtest/CTLogVerifierTest.cpp => security/ct/tests/gtest/CTLogVerifierTest.cpp
rename : security/certverifier/tests/gtest/CTObjectsExtractorTest.cpp => security/ct/tests/gtest/CTObjectsExtractorTest.cpp
rename : security/certverifier/tests/gtest/CTPolicyEnforcerTest.cpp => security/ct/tests/gtest/CTPolicyEnforcerTest.cpp
rename : security/certverifier/tests/gtest/CTSerializationTest.cpp => security/ct/tests/gtest/CTSerializationTest.cpp
rename : security/certverifier/tests/gtest/CTTestUtils.cpp => security/ct/tests/gtest/CTTestUtils.cpp
rename : security/certverifier/tests/gtest/CTTestUtils.h => security/ct/tests/gtest/CTTestUtils.h
rename : security/certverifier/tests/gtest/MultiLogCTVerifierTest.cpp => security/ct/tests/gtest/MultiLogCTVerifierTest.cpp
rename : security/certverifier/tests/gtest/moz.build => security/ct/tests/gtest/moz.build
extra : moz-landing-system : lando
2018-10-01 16:20:41 +00:00
Julien Vehent
92ca2d1e89 Bug 1494431 - Pin *.firefox.com to mozilla services whitelisted roots r=keeler,jcj
Put the entire *.firefox.com domain in the list of sites covered by the mozilla services whitelisted roots, which currently include Digicert and Let's Encrypt.

Differential Revision: https://phabricator.services.mozilla.com/D7219

--HG--
extra : moz-landing-system : lando
2018-09-28 23:37:51 +00:00
ffxbld
428aa0f16f No Bug, mozilla-central repo-update HSTS HPKP remote-settings - a=repo-update r=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D7276

--HG--
extra : moz-landing-system : lando
2018-10-01 12:34:47 +00:00
EKR
030f8b7c79 Bug 1495120 - Wire up ESNI r=dragana
Differential Revision: https://phabricator.services.mozilla.com/D7221

--HG--
extra : source : d2edbb87f3d283ab2c2fb6f8ad3408f792a6bd27
2018-09-28 22:37:20 +00:00
J.C. Jones
b5cc135a82 Bug 1488622 - land NSS 94bcc2706b98 UPGRADE_NSS_RELEASE, r=me
--HG--
extra : rebase_source : 761520ca901dabbf0a908a886732155d0d40d468
2018-10-01 07:44:32 -07:00
arthur.iakab
f0410f8d4b Merge mozilla-central to mozilla-inbound 2018-09-29 01:00:35 +03:00
Ehsan Akhgari
5f0be07390 Bug 1493563 - Part 5: Present the old state and the content blocking log to the web progress listeners; r=baku
Differential Revision: https://phabricator.services.mozilla.com/D6595
2018-09-28 14:46:02 -04:00
Ehsan Akhgari
355485be9f Bug 1493563 - Part 4: Present the old state and the content blocking log to the security event sink; r=baku
Differential Revision: https://phabricator.services.mozilla.com/D6594
2018-09-28 14:46:02 -04:00
Noemi Erli
4419e20e14 Backed out 12 changesets (bug 1493563) for failures in test_css-logic-getCssPath.html CLOSED TREE
Backed out changeset d2e83655082f (bug 1493563)
Backed out changeset 1ce58f004593 (bug 1493563)
Backed out changeset 344298c73ee7 (bug 1493563)
Backed out changeset 02b8b073f7d7 (bug 1493563)
Backed out changeset 3ef707008502 (bug 1493563)
Backed out changeset bb2720a401fe (bug 1493563)
Backed out changeset ce0211be57a1 (bug 1493563)
Backed out changeset 83d6c2bf8dc6 (bug 1493563)
Backed out changeset 1844af4cc25b (bug 1493563)
Backed out changeset c8ab17addb7a (bug 1493563)
Backed out changeset a1ff0cd62563 (bug 1493563)
Backed out changeset 932b41e211e0 (bug 1493563)
2018-09-28 21:31:18 +03:00
J.C. Jones
0708336637 Bug 1488622 - land NSS a706ba3c4fa9 UPGRADE_NSS_RELEASE, r=me
--HG--
rename : security/nss/automation/taskcluster/docker-clang-3.9/bin/checkout.sh => security/nss/automation/taskcluster/docker-builds/bin/checkout.sh
rename : security/nss/automation/taskcluster/docker-clang-3.9/bin/checkout.sh => security/nss/automation/taskcluster/docker-clang-format/bin/checkout.sh
rename : security/nss/automation/taskcluster/docker-clang-3.9/bin/checkout.sh => security/nss/automation/taskcluster/docker-fuzz32/bin/checkout.sh
rename : security/nss/automation/taskcluster/docker-clang-3.9/bin/checkout.sh => security/nss/automation/taskcluster/docker-interop/bin/checkout.sh
extra : rebase_source : 2ba3e1b2bfe96388e73e8bbf4ce0b37c530270a1
2018-09-28 09:17:37 -07:00
Ehsan Akhgari
f0108e78c2 Bug 1493563 - Part 5: Present the old state and the content blocking log to the web progress listeners; r=baku
Differential Revision: https://phabricator.services.mozilla.com/D6595
2018-09-28 13:24:41 -04:00
Ehsan Akhgari
4895fd4963 Bug 1493563 - Part 4: Present the old state and the content blocking log to the security event sink; r=baku
Differential Revision: https://phabricator.services.mozilla.com/D6594
2018-09-28 13:24:40 -04:00
Dana Keeler
6004dbc02b bug 1492188 - avoid using the directory service off the main thread when loading loadable roots r=jcj
Differential Revision: https://phabricator.services.mozilla.com/D6692

--HG--
extra : moz-landing-system : lando
2018-09-27 22:45:56 +00:00
Coroiu Cristina
62682de0ba Backed out changeset 39762ef5d56e (bug 1493427) for frequent talos chrome failures a=backout
--HG--
rename : browser/base/content/test/siteIdentity/browser_navigation_failures.js => browser/base/content/test/siteIdentity/browser_tls_handshake_failure.js
2018-09-28 07:29:39 +03:00
Coroiu Cristina
71988c7b7e Merge inbound to mozilla-central a=merge 2018-09-28 00:36:46 +03:00
Dana Keeler
b3b9e414bc bug 1493427 - use the docShell to call OnSecurityChange in nsSecureBrowserUIImpl::OnLocationChange r=Gijs
When navigating to an about: page that doesn't exist (e.g.
"about:somethingthatdoesnotexist"), the docShell will call
nsSecureBrowserUIImpl::OnLocationChange with a request that is null.
Consequently, we can't use that to QueryInterface to a nsISecurityEventSink to
call OnSecurityChange. The previous implementation would use the prior
request's nsISecurityEventSink, which was a bug but luckily this produced the
correct behavior. Since the original docShell the nsSecureBrowserUIImpl was
initialized with is what needs to be notified, we can just QueryInterface that
to an nsISecurityEventSink and call OnSecurityChange directly instead.

Differential Revision: https://phabricator.services.mozilla.com/D6951

--HG--
rename : browser/base/content/test/siteIdentity/browser_tls_handshake_failure.js => browser/base/content/test/siteIdentity/browser_navigation_failures.js
extra : moz-landing-system : lando
2018-09-27 17:26:00 +00:00
ffxbld
dbf253a4b5 No Bug, mozilla-central repo-update HSTS HPKP remote-settings - a=repo-update r=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D7081

--HG--
extra : moz-landing-system : lando
2018-09-27 12:07:07 +00:00
Boris Zbarsky
891631d98c Bug 1494524. Stop using the same function for both webidl and xpidl selectionChanged on treeviews. r=mccr8 2018-09-27 13:46:25 -04:00
shindli
14c2437eec Merge mozilla-central to inbound. a=merge CLOSED TREE 2018-09-27 00:57:23 +03:00
Gijs Kruitbosch
76afb51661 Bug 1493655 - make nsISecureBrowserUI initialize from a docshell instead of a window, r=keeler,nika
This also removes the (afaict, unused) stub implementation from TabParent. The netwerk header
inclusions were necessary because those files included TabParent.h and through it,
nsISecureBrowserUI, but now TabParent.h no longer does that.

Differential Revision: https://phabricator.services.mozilla.com/D6829

--HG--
extra : moz-landing-system : lando
2018-09-26 17:48:38 +00:00
Mark Goodwin
41b314b255 Bug 1492414 - Modify CertBlocklist interface to a form that should work with Rust XPCom bindings r=keeler
Differential Revision: https://phabricator.services.mozilla.com/D6260

--HG--
extra : moz-landing-system : lando
2018-09-21 13:10:40 +00:00
Andrew McCreight
de17b449c6 Bug 1494079 - Clean up some code in ShowProtectedAuthPrompt r=keeler
Differential Revision: https://phabricator.services.mozilla.com/D6852

--HG--
extra : moz-landing-system : lando
2018-09-25 22:54:37 +00:00
Haik Aftandilian
f2fa2012f9 Bug 1491940 - [Mac] Allow Adobe DRM content to play with the Mac Flash sandbox r=Alex_Gaynor
Add an whitelisted write-access path regex to the Flash plugin sandbox.

Differential Revision: https://phabricator.services.mozilla.com/D6679

--HG--
extra : moz-landing-system : lando
2018-09-24 17:22:49 +00:00
ffxbld
78dd007268 No Bug, mozilla-central repo-update HSTS HPKP remote-settings - a=repo-update r=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D6652

--HG--
extra : moz-landing-system : lando
2018-09-24 12:05:01 +00:00
J.C. Jones
5110974f9e Bug 1488622 - land NSS 2c85f81f9b5e UPGRADE_NSS_RELEASE, r=me
--HG--
extra : rebase_source : ac309461f5909fcf7b617bc768d73c0cd7911385
2018-09-22 17:04:35 -07:00
Dragana Damjanovic
9cadc84486 Bug 1473736 - Implement necko part of ESNI r=mak,kmag,mcmanus
--HG--
extra : rebase_source : be79870960953ef9535ccb6a440515ec4a8232d5
extra : histedit_source : 8096ab2eaf246cbbeb97bace0531b86b8c69ff66
2018-09-22 23:54:11 +03:00
Gurzau Raul
07d30b811f Backed out changeset dc225279994a (bug 1473736) for web platform leaks 2018-09-21 04:30:10 +03:00
Dana Keeler
984d5aecee bug 1492424 - check if the TLS handshake failed in nsSecureBrowserUIImpl r=Gijs
The site identity security indicator machinery treats connections where the TLS
handshake failed as insecure (also referred to as "unknown identity"). Before
bug 1468222, such cases were easily detectable as the SSLStatus field of the
relevant nsITransportSecurityInfo would be null. When we merged nsISSLStatus
into nsITransportSecurityInfo, we didn't take this differentiation into account.
This patch brings back the prior behavior by checking if the securityInfo's
securityState indicates that the handshake failed (i.e. it is
STATE_IS_INSECURE).

Differential Revision: https://phabricator.services.mozilla.com/D6316

--HG--
extra : moz-landing-system : lando
2018-09-21 00:17:47 +00:00
Dragana Damjanovic
70e0646d75 Bug 1473736 - Implement necko part of ESNI r=mak,kmag,mcmanus
Implement necko part of ESNI

Differential Revision: https://phabricator.services.mozilla.com/D2716

--HG--
extra : moz-landing-system : lando
2018-09-20 20:53:28 +00:00
Andreea Pavel
f5f6c0b588 Merge mozilla-inbound to mozilla-central. a=merge 2018-09-21 00:54:47 +03:00
Nathan Froyd
e7b3b3140d Bug 1415980 - make hash keys movable and not copyable; r=erahm
Everything that goes in a PLDHashtable (and its derivatives, like
nsTHashtable) needs to inherit from PLDHashEntryHdr. But through a lack
of enforcement, copy constructors for these derived classes didn't
explicitly invoke the copy constructor for PLDHashEntryHdr (and the
compiler didn't invoke the copy constructor for us). Instead,
PLDHashTable explicitly copied around the bits that the copy constructor
would have.

The current setup has two problems:

1) Derived classes should be using move construction, not copy
   construction, since anything that's shuffling hash table keys/entries
   around will be using move construction.

2) Derived classes should take responsibility for transferring bits of
   superclass state around, and not rely on something else to handle that.

The second point is not a huge problem for PLDHashTable (PLDHashTable
only has to copy PLDHashEntryHdr's bits in a single place), but future
hash table implementations that might move entries around more
aggressively would have to insert compensation code all over the
place. Additionally, if moving entries is implemented via memcpy (which
is quite common), PLDHashTable copying around bits *again* is
inefficient.

Let's fix all these problems in one go, by:

1) Explicitly declaring the set of constructors that PLDHashEntryHdr
   implements (and does not implement). In particular, the copy
   constructor is deleted, so any derived classes that attempt to make
   themselves copyable will be detected at compile time: the compiler
   will complain that the superclass type is not copyable.

This change on its own will result in many compiler errors, so...

2) Change any derived classes to implement move constructors instead of
   copy constructors. Note that some of these move constructors are,
   strictly speaking, unnecessary, since the relevant classes are moved
   via memcpy in nsTHashtable and its derivatives.
2018-09-20 11:20:36 -04:00
ffxbld
1263cc5298 No Bug, mozilla-central repo-update HSTS HPKP blocklist remote-settings - a=repo-update r=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D6386

--HG--
extra : moz-landing-system : lando
2018-09-20 12:47:19 +00:00
Bogdan Tara
86023d88c4 Merge inbound to mozilla-central. a=merge 2018-09-20 07:13:05 +03:00
J.C. Jones
a456c6d9a9 Bug 1488622 - land NSS fe738aae0bcc UPGRADE_NSS_RELEASE, r=me
--HG--
extra : rebase_source : c5e74447ceed1014ab1a3bb6abbdc28ac12fa11a
2018-09-19 09:43:03 -07:00
Bogdan Tara
9f17cab93a Merge mozilla-central to autoland. a=merge CLOSED TREE 2018-09-20 01:03:35 +03:00
Dana Keeler
d13840ed4c bug 1490982 - filter out OnLocationChange events that aren't top-level in nsSecureBrowserUIImpl r=Gijs
Differential Revision: https://phabricator.services.mozilla.com/D5920

--HG--
extra : moz-landing-system : lando
2018-09-19 19:57:37 +00:00
Noemi Erli
efdd6a208a Backed out changeset 7aa742bff8fb (bug 1473736) for xpcshell failures and bc failures in browser_urlbarSearchSingleWordNotification.js 2018-09-18 22:07:58 +03:00
Dragana Damjanovic
f000a5b4b0 Bug 1473736 - Implement necko part of ESNI r=mcmanus
Implement necko part of ESNI

Differential Revision: https://phabricator.services.mozilla.com/D2716

--HG--
extra : moz-landing-system : lando
2018-09-17 23:08:14 +00:00
Bogdan Tara
7ebba39407 Merge mozilla-central to autoland. a=merge CLOSED TREE 2018-09-18 01:02:05 +03:00
Dana Keeler
0f23e1458f bug 1488593 - move family safety root detection to background thread r=dipen,jcj
A previous patch in this bug made the incorrect assumption that we had disabled
the family safety root detection/importing feature by default. In reality, we
enabled it by default in bug 1282871.

In bug 1487258 we moved enterprise root loading to a background thread so as to
not block the main thread. This patch does the same with the family safety
feature.

Differential Revision: https://phabricator.services.mozilla.com/D5484

--HG--
extra : moz-landing-system : lando
2018-09-17 15:38:43 +00:00
Jed Davis
2fcf5c7252 Bug 1489735 - Quietly deny sched_setaffinity in content process sandbox r=gcp
Differential Revision: https://phabricator.services.mozilla.com/D5908

--HG--
extra : moz-landing-system : lando
2018-09-17 16:43:52 +00:00
Gurzau Raul
c03510c273 Merge mozilla-central to inbound. a=merge CLOSED TREE 2018-09-17 19:48:54 +03:00
Masatoshi Kimura
cddaaa8ed5 Bug 1491849 - Disable C5045 only if optimization is disabled. r=dmajor
I also changed security/certverifier/moz.build a bit while I am here:
* Using '-Xclang' to pass through '-Wall' on clang-cl.
* Now clang-cl will take clang/gcc path because most '-wd****' options have no
  effect on clang-cl. '-wd4010' will have an effect, but we already have the
  corresponding clang/gcc option ('-Wno-unused-parameter').

--HG--
extra : source : df566a1bd9087cc0bfc03fe19fd9d21bf58f5d9c
2018-09-15 21:20:32 +09:00
ffxbld
8c2208f569 No Bug, mozilla-central repo-update HSTS HPKP remote-settings - a=repo-update r=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D6021

--HG--
extra : moz-landing-system : lando
2018-09-17 13:15:55 +00:00
Ehsan Akhgari
fa81a39327 Bug 1491558 - Remove the XPCOM registration for nsThreadPool; r=froydnj
Differential Revision: https://phabricator.services.mozilla.com/D5943
2018-09-15 12:13:57 -04:00