Munguva pfupi yapfuura Mozilla yakazivisa kuvhurwa kwechiratidzo chitsva chekuona nzira kubviswa inonzi "CRLite" uye iyo inowanikwa mumhando dzehusiku dzeFirefox. Iyi nyowani mashandiro inobvumira kuronga kuongorora chinoshanda chitupa kubviswa inopesana nedhatabhesi yakachengetwa pane system yemushandisi.
Chitupa chekuongorora chakashandiswa kusvika parizvino nekushandiswa kwekunze masevhisi akavakirwa Mune OCSP protocol (Online Chitupa Mamiriro Protocol) inoda kuwanikwa kwakachengetedzwa kunetiweki, izvo zvinotungamira mukunonoka kunooneka mukugadzirisa chikumbiro (paavhareji 350 ms) uye ine zvakavanzika nyaya (maseva anopindura zvikumbiro OCSP inowana ruzivo nezve chaiwo zvitupa, izvo zvinogona kushandiswa kutonga kuti ndeapi masosi anovhurwa nemushandisi).
Uyewo pane mukana wekutarisirwa kwenzvimbo kupokana neCRL (Chitupa chekumisikidza runyorwa), asi kusakosha kweiyi nzira hukuru hukuru hwe data rakadzingwa: Parizvino gwaro rekubvisa chitupa rinotora mazana mazana matatu MB uye kukura kwaro kuri kuenderera.
Firefox yanga ichishandisa iyo yepakati OneCRL nhema runyorwa kubvira 2015 kuvharira zvitupa zvakakanganiswa uye zvakabviswa nezviremera zvechitupa pamwe nekuwana sevhisi yakachengeteka yeGoogle kuti uone chiitiko chinokanganisa.
OneCRL, seCRLSets muChannel, inoshanda seyepakati yekubatanidza iyo inosanganisa CRL runyorwa rwezvitupa zviremera uye inopa imwechete yepakati OCSP sevhisi yekuona yakanzurwa zvitupa, zvichiita kuti zvikwanise kutumira zvikumbiro zvakananga kuzviremera zvitupa.
Default, kana zvisingakwanise kuongorora kuburikidza neOCSP, bhurawuza rinoona chitupa seichifanira. Nenzira iyi kana sevhisi isipo nekuda kwematambudziko enetiweki uye zvemukati network zvirambidzo kana kuti inogona kuvharirwa nevanorwisa panguva yekurwiswa kweMITM. Kuti udzivise kurwiswa kwakadai, iyo Inofanirwa-Chikafu nzira inoitwa, iyo inobvumidza iyo OCSP yekukanganisa kukanganisa kana OCSP kusapindirwa kuti idudzirwe sedambudziko nechitupa, asi chimiro ichi chinosarudzika uye chinoda kunyoreswa kwakakosha kwesitifiketi.
Nezve CRLite
CRLite inokutendera iwe kuti uunze ruzivo rwakakwana nezve zvese zvakabviswa zvitupa muchimiro chiri nyore kudzoreka 1 MB chete, zvichiita kuti zvikwanise kuchengeta dhatabhesi rese reCRL padivi revatengi. Bhurawuza racho rinokwanisa kuenzanisa kopi yaro yedata muzvitupa zvakabviswa zuva nezuva uye dhatabhesi iri richave riripo pasi pechero mamiriro.
CRLite inosanganisa ruzivo kubva kuSitifiketi Transparency, rekodhi reruzhinji rwezvose zvakapihwa uye zvakabviswa zvitupa uye mhedzisiro yeInternet chitupa scanning (dzakasiyana CRL runyorwa rwezvitupa nzvimbo dzinounganidzwa uye ruzivo nezve zvese zvinozivikanwa zvitifiketi zvinowedzerwa).
Dhata yakarongedzwa uchishandisa Bloom mafirita, chimiro chinobvumirwa chinotendera kumisikidzwa kwenhema kwechinhu chisipo, asi kusanganisa kusiiwa kwechinhu chiripo (ndiko kuti, pamwe nekumwe kuitika, manyepo enzvimbo anogona kuita chitupa chakakodzera, asi zvitupa zvakabviswa zvinovimbiswa kuti zvionekwe).
Kubvisa maalarm enhema, CRLite yakaunza mamwe ekugadzirisa mafirita emazinga. Mushure mekuvakwa kwechimiro, zvese zvinyorwa zvinyorwa zvinonyorwa uye maalarm enhema anoonekwa.
Kubva pamhedzisiro yeichi simbiso, chimwe chimiro chinogadzirwa icho chinopaza pamusoro pekutanga uye chinogadzirisa chero maaramu enhema amuka. Iko kuvhiyiwa kunodzokororwa kusvikira manyepo enhema abviswa zvachose panguva yekusimbisa.
Kazhinjial, kufukidza zvizere data rese, kugadzira 7-10 zvidimbu zvakaringana. Sezvo iyo dhatabhesi nekuda kwekuenderana nguva nenguva iri kumashure zvishoma kwenzvimbo yazvino yeCRL, kuongororwa kwechitupa nyowani kwakapihwa mushure mekupedzisira kugadzirisa kweCRLite dhatabhesi kunoitwa uchishandisa protocol OCSP, kusanganisira kushandiswa kweOCSP yekumisikidza nzira .
Kuitwa kweMozilla kweCRLite kunoburitswa pasi pemahara MPL 2.0 rezinesi. Iyo kodhi yekugadzira iyo dhatabhesi uye izvo zveseva zvinhu zvakanyorwa muPython neGo. Izvo zvikamu zvevatengi zvakawedzerwa kuFirefox kuverenga data kubva kudhatabhesi zvakagadzirirwa mumutauro weRust.
mabviro: https://blog.mozilla.org/