Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NSS keydb #6548

Merged
merged 1 commit into from
Jan 14, 2025
Merged

NSS keydb #6548

merged 1 commit into from
Jan 14, 2025

Conversation

jo
Copy link
Contributor

@jo jo commented Jan 7, 2025 •
edited
Loading

Add NSS functionality for key management, enabled via feature flag.

New feature flag keydb in rc_crypto/nss, which enables NSS key persistence: ensure_initialized_with_profile_dir(path: impl AsRef<Path>) initializes NSS with a profile directory and appropriate flags to persist keys (and certificates) in its internal PKCS11 software implementation.

New methods for dealing with primary password and key persistence, available within the keydb feature:

  • authorization_with_primary_password_is_needed(): checks weather a primary password is set and needs to be authorized
  • authorize_with_primary_password(primary_password: &str): method for authorizing NSS key store against a user-provided primary password
  • get_or_create_aes256_key(name: &str): retrieve a key by name from the internal NSS key store. If none exists, create one, persist, and return.

Pull Request checklist

  • Breaking changes: This PR follows our breaking change policy
    • This PR follows the breaking change policy:
      • This PR has no breaking API changes, or
      • There are corresponding PRs for our consumer applications that resolve the breaking changes and have been approved
  • Quality: This PR builds and tests run cleanly
    • Note:
      • For changes that need extra cross-platform testing, consider adding [ci full] to the PR title.
      • If this pull request includes a breaking change, consider cutting a new release after merging.
  • Tests: This PR includes thorough tests or an explanation of why it does not
  • Changelog: This PR includes a changelog entry in CHANGELOG.md or an explanation of why it does not need one
    • Any breaking changes to Swift or Kotlin binding APIs are noted explicitly
  • Dependencies: This PR follows our dependency management guidelines
    • Any new dependencies are accompanied by a summary of the due diligence applied in selecting them.

Branch builds: add [firefox-android: branch-name] to the PR title.

@jo jo force-pushed the nss-keydb branch 2 times, most recently from e838172 to abcd64b Compare January 7, 2025 11:18
@jo jo requested review from bendk and mhammond January 7, 2025 11:46
@jo jo force-pushed the nss-keydb branch 3 times, most recently from b4f3904 to 2c0fea2 Compare January 7, 2025 22:25
mhammond
mhammond reviewed Jan 8, 2025
View reviewed changes
Copy link
Member

@mhammond mhammond left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems good to me. I'm mildly concerned about some of the unwrapping/panicing, but this is really your call. I do think you should wait a few days to let Ben have a look if possible and he has time, but I'm +1 on this.

CHANGELOG.md Outdated Show resolved Hide resolved
components/support/rc_crypto/nss/src/pk11/sym_key.rs Outdated Show resolved Hide resolved
components/support/rc_crypto/nss/src/util.rs Outdated Show resolved Hide resolved
components/support/rc_crypto/nss/src/util.rs Outdated Show resolved Hide resolved
@jo
Copy link
Contributor Author

jo commented Jan 9, 2025

@mhammond , thanks for the review!

I think you have raised important points here, I will think again in detail about the error handling. I have mostly imitated the behavior of ensure_nss_initialized() here, but I absolutely agree, in some code paths we should not panic, because in particular file corruption can occur, or the directory may have disappeared.

@bendk , please wait a bit until I have incorporated Mark's feedback.

@jo jo removed the request for review from bendk January 9, 2025 02:13
@jo jo force-pushed the nss-keydb branch 4 times, most recently from 6d6ff7c to 8ba136e Compare January 9, 2025 17:02
@jo
Copy link
Contributor Author

jo commented Jan 9, 2025

I have now revised the implementation. The new method ensure_nss_initialized_with_profile_dir now returns a result containing any errors. It also checks, as @bendk mentioned recently, whether any previous calls have taken place with the same path.
Thanks again for your valuable feedback, @mhammond . Can you take another look at this and give us your opinion?

@jo
Copy link
Contributor Author

jo commented Jan 9, 2025

btw I added the once_cell dependency because we already use it heavily throughout AS. Do I have to take any additional steps here?

@jo jo requested review from bendk and mhammond January 9, 2025 17:51
mhammond
mhammond reviewed Jan 9, 2025
View reviewed changes
Copy link
Member

@mhammond mhammond left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this looks great!

components/support/rc_crypto/nss/src/pk11/sym_key.rs Show resolved Hide resolved
components/support/rc_crypto/nss/Cargo.toml Outdated Show resolved Hide resolved
bendk
bendk approved these changes Jan 9, 2025
View reviewed changes
Copy link
Contributor

@bendk bendk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great from my POV as well, I just had one documentation request.

components/support/rc_crypto/nss/src/pk11/sym_key.rs Show resolved Hide resolved
@jo jo force-pushed the nss-keydb branch 5 times, most recently from aac3e37 to 62ee9c4 Compare January 14, 2025 13:14
@jo
support keydb feature
154fd8e 
This adds a feature `keydb` to rc_crypto's nss create, which enables the
`ensure_initialized_with_profile_dir` initialize function. This
configures NSS to use a profile and persist keys into key4.db.

Also adding methods for managing AES256 keys with NSS:
* `authentication_with_primary_password_is_needed`: check wheather primary password is enabled
* `authenticate_with_primary_password`: authenticate with primary password against NSS key database
* `get_or_create_aes256_key`: retrieve a key from key4.db or, if not present, create one
@jo jo added this pull request to the merge queue Jan 14, 2025
Merged via the queue into mozilla:main with commit fc22cdb Jan 14, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bendk bendk bendk approved these changes

@mhammond mhammond mhammond left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jo @mhammond @bendk