On 10/25/2010 11:30 PM, James Yonan wrote: > I'm trying to do a programmatic certificate import into Firefox 3.x > using NSS_Initialize, PK11_GetInternalKeySlot, > CERT_DecodeCertFromPackage, PK11_ImportCert, and CERT_ChangeCertTrust. > > I've seen various postings on this list in the past that seem to > indicate that this is not safe due to the underlying DB engine not > supporting write concurrency across multiple processes, and the sqlite > DB support not being enabled by default in 3.x. > > Is it possible to do programmatic certificate import in Firefox 3.x in > a way that doesn't require a browser restart or changes to default > settings, and that fits into any DB concurrency limitations? The old Database (dbm) has concurrency issues if more than one process accesses at once. Those issue are random, and show up in database corruption a small fraction of the time, but multiplied by the number of Firefox years, will guarrentee someone will loose their database is you violate this rule (likely someone you know even;).
This restrictions has been known and the NSS team has provided a new database based on the sqlite library. Sadly this database has not yet been integrated into firefox, however you can run it yourself if you by setting the environment variable NSS_DEFAULT_DB_TYPE to sql. This will work for FF 3 and later. > > I also noticed that I am able to execute the above sequence of > function calls while Firefox 3.0.19 is running and I don't get an > error return from the calls, however the cert is not visible to > Firefox until it is restarted. If you are running outside of firefox, this is expected behaviour (except that a certain percentage of the time you will corrupt your database doing this, some times you will cause Firefox to crash doing this. You can do this same experiment with NSS tools. If you are running as a pluging inside firefox, then you can execute these steps and have the certificate show up without restart. If you do this as a plugin, I suggest you open psm to initialize NSS so the you aren't fighting firefox about who should to the NSS_Initialize(). NOTE: if firefox walls you off in a separate process, this technique will stop working... > > I'm worried that I was able to execute these functions without an > error (I would assume that a non-concurrent DB would open its > underlying data files with exclusive access to prevent corruption). > Does this mean that NSS will let me walk off a cliff by allowing > operations that might cause DB corruption or does the fact that I > didn't see an error really mean that the operation succeeded because > Firefox didn't have the cert DB open for write access when I made the > calls? This is a limitation of the old berkeley db code used for the old cert database. NSS does not know this is happenning... the database library is managing all the file access. This is why the NSS team has created the sql database and migrated away from the old berkeley db.. This lack of errors are why you are also pretty explicit about 'don't do this, bad things happen' where ever we can. Your options are: 1) do it as a pluggin. 2) use the sqlite database. 3) require firefox to shutdown. > > James
-- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
