New issue
Advanced search Search tips

Issue 649026 link

Starred by 6 users
Status: Started
Owner:
mattm@chromium.org
Cc:
awhalley@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug

Blocked on:
issue 649017
issue 780611
Blocking:
issue 410574



Sign in to add a comment

[PKI library] Create a dual verifier for running both the new path builder, and the current (in parallel)

Project Member Reported by eroman@chromium.org, Sep 21 2016 
The general idea is we want to be able to experiment with the new path builder such that we can run both new and old implementations side-by-side and compare their results. This would primarily for checking correctness, prior to doing A/B testing.

How this will work depends on how  issue 649017  was resolved.

Assuming  issue 649017  introducing a new CertVerifier, then we will now want another CertVerifier implementation that dispatches requests to the primary CertVerifier (old), and a secondary CertVerifier (new).

The dual implementation can reply to requests as soon as the primary CertVerifier completes. Completion of the secondary implementation would just be for gathering metrics. (mostly for correctness -- performance comparisons with this approach has issues)
Project Member

Comment 1 by sheriffbot@chromium.org, Sep 22 2017

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 2 by mattm@chromium.org, Sep 22 2017

Owner: mattm@chromium.org
Status: Started (was: Untriaged)

Comment 3 by mattm@chromium.org, Nov 1 2017

Blockedon: 780611

Comment 4 by awhalley@chromium.org, Jan 11 2018

Cc: awhalley@chromium.org
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 31 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0a4382cf0466f8ae431ac4af3e1fe24686be53e8

commit 0a4382cf0466f8ae431ac4af3e1fe24686be53e8
Author: Matt Mueller <mattm@chromium.org>
Date: Sat Mar 31 00:36:25 2018

Dual certificate verification trial.

When the feature flag is enabled and the user has opted-in via the
SBER2(Scout) pref, verifies certificates with both the platform verifier
and the CertVerifyProcBuiltin, and reports if the results differ. Has no
user-visible effect, the result from the platform verifier is used as soon
as it is complete, and the trial verification is completed in the background.
Currently, the trial is only supported on Mac and Linux.

Design doc: https://docs.google.com/document/d/1AM1CD42bC6LHWjKg-Hkid_RLr2DH6OMzstH9-pGSi-g/edit

Bug: 649026
Change-Id: If5b7e8841a072224aaa748f7bbd5609adb9170a0
Reviewed-on: https://chromium-review.googlesource.com/898388
Reviewed-by: Nathan Parker <nparker@chromium.org>
Reviewed-by: Jesse Doherty <jwd@chromium.org>
Reviewed-by: Ryan Hamilton <rch@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Reviewed-by: Emily Stark <estark@chromium.org>
Commit-Queue: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547337}
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/BUILD.gn
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/io_thread.cc
[add] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/net/trial_comparison_cert_verifier.cc
[add] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/net/trial_comparison_cert_verifier.h
[add] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/profiles/profile_io_data.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/safe_browsing/certificate_reporting_service_test_utils.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/safe_browsing/certificate_reporting_service_test_utils.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/ssl/cert_logger.proto
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/ssl/certificate_error_report.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/browser/ssl/certificate_error_report.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/common/chrome_features.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/common/chrome_features.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/chrome/test/BUILD.gn
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/net/cert/multi_threaded_cert_verifier.cc
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/net/cert/multi_threaded_cert_verifier.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/net/log/net_log_event_type_list.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/net/log/net_log_source_type_list.h
[modify] https://crrev.com/0a4382cf0466f8ae431ac4af3e1fe24686be53e8/tools/metrics/histograms/histograms.xml
Project Member

Comment 7 by bugdroid1@chromium.org, May 31 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ff168dccb8ebb1fc01a9e1349394a70833be8b23

commit ff168dccb8ebb1fc01a9e1349394a70833be8b23
Author: Matt Mueller <mattm@chromium.org>
Date: Thu May 31 03:37:28 2018

TrialComparisonCertVerifierTest: Use DATE_INVALID instead of REVOKED

The REVOKED status can trigger some of the difference-ignorers that
will be added in followups.

Bug: 649026
Change-Id: I099402d188a7819aaee229a52327187620146434
Reviewed-on: https://chromium-review.googlesource.com/1079705
Reviewed-by: Eric Roman <eroman@chromium.org>
Commit-Queue: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#563142}
[modify] https://crrev.com/ff168dccb8ebb1fc01a9e1349394a70833be8b23/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
Project Member

Comment 8 by bugdroid1@chromium.org, May 31 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b21135f884703f4cc6d0dfaa3bb493522667f113

commit b21135f884703f4cc6d0dfaa3bb493522667f113
Author: Matt Mueller <mattm@chromium.org>
Date: Thu May 31 19:16:37 2018

TrialComparisonCertVerifier: Ignore undesired mac revocation checking differences

CertVerifyProcMac will do revocation checking even if it was not
requested. This change causes TrialComparisonCertVerifier to not report
a difference if the CertVerifyProcMac returned a revoked result and the
builtin verifier returned OK, if reverifying with the builtin verifier
and requesting revocation checking does return revoked.

Bug: 649026
Change-Id: Iba5403d2b0d5b34e625e5f8d69c02b9fd2a4ba49
Reviewed-on: https://chromium-review.googlesource.com/1079789
Commit-Queue: Matt Mueller <mattm@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#563341}
[modify] https://crrev.com/b21135f884703f4cc6d0dfaa3bb493522667f113/chrome/browser/net/trial_comparison_cert_verifier.cc
[modify] https://crrev.com/b21135f884703f4cc6d0dfaa3bb493522667f113/chrome/browser/net/trial_comparison_cert_verifier.h
[modify] https://crrev.com/b21135f884703f4cc6d0dfaa3bb493522667f113/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
[modify] https://crrev.com/b21135f884703f4cc6d0dfaa3bb493522667f113/net/cert/x509_util.h
[modify] https://crrev.com/b21135f884703f4cc6d0dfaa3bb493522667f113/tools/metrics/histograms/enums.xml
Project Member

Comment 9 by bugdroid1@chromium.org, Jun 1 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9ff44a0740a15b7cfb35b414c96958645f0fdf92

commit 9ff44a0740a15b7cfb35b414c96958645f0fdf92
Author: Matt Mueller <mattm@chromium.org>
Date: Fri Jun 01 00:23:44 2018

TrialComparisonCertVerifier: Ignore EV difference due to multiple EV policies

The builtin verifier properly handles the case where the leaf cert has
multiple candidate EV policies, while the platform verifiers do not.
This change ignores differences that are likely due to that.

Bug: 649026
Change-Id: Ica84e7c23f98e42d8450382a68927eecf1a3b007
Reviewed-on: https://chromium-review.googlesource.com/1079809
Commit-Queue: Matt Mueller <mattm@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#563455}
[modify] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/browser/net/trial_comparison_cert_verifier.cc
[modify] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/browser/net/trial_comparison_cert_verifier.h
[modify] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
[add] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/test/data/net/trial_comparison_cert_verifier_unittest/target-multiple-policies/chain.pem
[add] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/test/data/net/trial_comparison_cert_verifier_unittest/target-multiple-policies/generate-chains.py
[add] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/test/data/net/trial_comparison_cert_verifier_unittest/target-multiple-policies/keys/Intermediate.key
[add] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/test/data/net/trial_comparison_cert_verifier_unittest/target-multiple-policies/keys/Root.key
[add] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/chrome/test/data/net/trial_comparison_cert_verifier_unittest/target-multiple-policies/keys/Target.key
[modify] https://crrev.com/9ff44a0740a15b7cfb35b414c96958645f0fdf92/tools/metrics/histograms/enums.xml
Project Member

Comment 10 by bugdroid1@chromium.org, Jun 4 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/69977608b5eb9f80797b834001fdfcb139974b5a

commit 69977608b5eb9f80797b834001fdfcb139974b5a
Author: Matt Mueller <mattm@chromium.org>
Date: Mon Jun 04 23:48:02 2018

TrialComparisonCertVerifier: Fix uma log when both verifiers fail with different error

Bug: 649026
Change-Id: If023ec28835f1260e0cb21f4545f41e4a4f8ff88
Reviewed-on: https://chromium-review.googlesource.com/1086029
Commit-Queue: Matt Mueller <mattm@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564299}
[modify] https://crrev.com/69977608b5eb9f80797b834001fdfcb139974b5a/chrome/browser/net/trial_comparison_cert_verifier.cc
[modify] https://crrev.com/69977608b5eb9f80797b834001fdfcb139974b5a/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
Project Member

Comment 11 by bugdroid1@chromium.org, Jun 5 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/11f6f8c38522aaeb729626089fb00c89b817b4dc

commit 11f6f8c38522aaeb729626089fb00c89b817b4dc
Author: Matt Mueller <mattm@chromium.org>
Date: Tue Jun 05 01:31:11 2018

TrialComparisonCertVerifier: reverify using trial path if it differs

If the primary and trial verifiers build different paths, and the trial
verifier succeeded or the primary verifier failed, try verifiying the
trial-built path with the primary verifier. This allows us to ignore
some cases where the platform verifier built a poor/different chain but
can be coaxed into building a better one by giving it the other chain
as input.

Bug: 649026
Change-Id: I0b0f6bf7c230abceadcfceedfeeacc6b39339292
Reviewed-on: https://chromium-review.googlesource.com/1083845
Reviewed-by: Eric Roman <eroman@chromium.org>
Commit-Queue: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564334}
[modify] https://crrev.com/11f6f8c38522aaeb729626089fb00c89b817b4dc/chrome/browser/net/trial_comparison_cert_verifier.cc
[modify] https://crrev.com/11f6f8c38522aaeb729626089fb00c89b817b4dc/chrome/browser/net/trial_comparison_cert_verifier.h
[modify] https://crrev.com/11f6f8c38522aaeb729626089fb00c89b817b4dc/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
[modify] https://crrev.com/11f6f8c38522aaeb729626089fb00c89b817b4dc/tools/metrics/histograms/enums.xml
Project Member

Comment 13 by bugdroid1@chromium.org, Jun 19 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6ada8b62e5175ca24b778814c6fa4c83a6fbf586

commit 6ada8b62e5175ca24b778814c6fa4c83a6fbf586
Author: Matt Mueller <mattm@chromium.org>
Date: Tue Jun 19 16:57:37 2018

Change TrialVerificationInfo.cert_chain to optional

Nothing was receiving this yet so it should be safe to change.

Bug: 649026
Change-Id: I964e91edab78f94f08b20dc89eeb2dd09879dc8c
Reviewed-on: https://chromium-review.googlesource.com/1105465
Reviewed-by: Emily Stark <estark@chromium.org>
Commit-Queue: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568497}
[modify] https://crrev.com/6ada8b62e5175ca24b778814c6fa4c83a6fbf586/chrome/browser/ssl/cert_logger.proto
►

Sign in to add a comment