security/manager/ssl/nsICertOverrideService.idl

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "nsISupports.idl"
   8
   9 interface nsIArray;
  10 interface nsIX509Cert;
  11
  12 [ref] native const_OriginAttributesRef(const mozilla::OriginAttributes);
  13
  14 %{C++
  15 #define NS_CERTOVERRIDE_CONTRACTID "@mozilla.org/security/certoverride;1"
  16
  17 namespace mozilla {
  18 class OriginAttributes;
  19 }
  20 %}
  21
  22 [scriptable, builtinclass, uuid(ed735e24-fa55-4163-906d-17fb78851fe1)]
  23 interface nsICertOverride : nsISupports {
  24
  25   /**
  26   *   The hostname of the server the override is used for.
  27   */
  28   readonly attribute ACString asciiHost;
  29
  30   /**
  31   *   The port of the server the override is used for.
  32   */
  33   readonly attribute int32_t port;
  34
  35   /**
  36   *   A combination of hostname and port in the form host:port.
  37   *   Since the port can be -1 which is equivalent to port 433 we use an
  38   *   existing function of nsCertOverrideService to create this property.
  39   */
  40   readonly attribute ACString hostPort;
  41
  42   /**
  43   *   The fingerprint for the associated certificate.
  44   */
  45   readonly attribute ACString fingerprint;
  46
  47   /**
  48   *   The origin attributes associated with this override.
  49   */
  50   [implicit_jscontext]
  51   readonly attribute jsval originAttributes;
  52 };
  53
  54 [scriptable, builtinclass, uuid(be019e47-22fc-4355-9f16-9ab047d6742d)]
  55 interface nsICertOverrideService : nsISupports {
  56   /**
  57    * When making a TLS connection to the given hostname and port (in the
  58    * context of the given origin attributes), if the certificate verifier
  59    * encounters an overridable error when verifying the given certificate, the
  60    * connection will continue (provided overrides are allowed for that host).
  61    *
  62    * @param aHostName The host (punycode) this mapping belongs to
  63    * @param aPort The port this mapping belongs to. If it is -1 then it
  64    *              is internaly treated as 443.
  65    * @param aOriginAttributes the origin attributes of the mapping
  66    * @param aCert The certificate used by the server
  67    * @param aTemporary Whether or not to only store the mapping for the session
  68    */
  69   [binaryname(RememberValidityOverride), noscript, must_use]
  70   void rememberValidityOverrideNative(in AUTF8String aHostName,
  71                                 in int32_t aPort,
  72                                 in const_OriginAttributesRef aOriginAttributes,
  73                                 in nsIX509Cert aCert,
  74                                 in boolean aTemporary);
  75   [binaryname(RememberValidityOverrideScriptable), implicit_jscontext, must_use]
  76   void rememberValidityOverride(in AUTF8String aHostName,
  77                                 in int32_t aPort,
  78                                 in jsval aOriginAttributes,
  79                                 in nsIX509Cert aCert,
  80                                 in boolean aTemporary);
  81
  82   /**
  83    *  Return whether this host, port, cert triple has a stored override.
  84    *  If so, the outparams will contain the specific errors that were
  85    *  overridden, and whether the override is permanent, or only for the current
  86    *  session.
  87    *
  88    *  @param aHostName The host (punycode) this mapping belongs to
  89    *  @param aPort The port this mapping belongs to, if it is -1 then it
  90    *         is internally treated as 443
  91    *  @param aCert The certificate this mapping belongs to
  92    *  @param aIsTemporary Whether the stored override is session-only,
  93    *         or permanent
  94    *  @return Whether an override has been stored for this host+port+cert
  95    */
  96   [binaryname(HasMatchingOverride), noscript, must_use]
  97   boolean hasMatchingOverrideNative(in AUTF8String aHostName,
  98                               in int32_t aPort,
  99                               in const_OriginAttributesRef aOriginAttributes,
 100                               in nsIX509Cert aCert,
 101                               out boolean aIsTemporary);
 102   [binaryname(HasMatchingOverrideScriptable), implicit_jscontext, must_use]
 103   boolean hasMatchingOverride(in AUTF8String aHostName,
 104                               in int32_t aPort,
 105                               in jsval aOriginAttributes,
 106                               in nsIX509Cert aCert,
 107                               out boolean aIsTemporary);
 108
 109   /**
 110    *  Remove a override for the given hostname:port.
 111    *
 112    *  @param aHostName The host (punycode) whose entry should be cleared.
 113    *  @param aPort The port whose entry should be cleared.
 114    *               If it is -1, then it is internaly treated as 443.
 115    *               If it is 0 and aHostName is "all:temporary-certificates",
 116    *               then all temporary certificates should be cleared.
 117    */
 118   [binaryname(ClearValidityOverride), noscript]
 119   void clearValidityOverrideNative(in AUTF8String aHostName,
 120                              in int32_t aPort,
 121                              in const_OriginAttributesRef aOriginAttributes);
 122   [binaryname(ClearValidityOverrideScriptable), implicit_jscontext]
 123   void clearValidityOverride(in AUTF8String aHostName,
 124                              in int32_t aPort,
 125                              in jsval aOriginAttributes);
 126
 127   /**
 128    *  Remove all overrides.
 129    */
 130   void clearAllOverrides();
 131
 132   Array<nsICertOverride> getOverrides();
 133
 134   /**
 135    *  NOTE: This function is used only for testing!
 136    *
 137    *  @param aDisable If true, disable all security check and make
 138    *                  hasMatchingOverride always return true.
 139    */
 140   void setDisableAllSecurityChecksAndLetAttackersInterceptMyData(in boolean aDisable);
 141
 142   readonly attribute boolean securityCheckDisabled;
 143 };