security/manager/ssl/nsINSSComponent.idl

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "nsISupports.idl"
   8
   9 %{C++
  10 #include "cert.h"
  11 #include "SharedCertVerifier.h"
  12 #define PSM_COMPONENT_CONTRACTID "@mozilla.org/psm;1"
  13 %}
  14
  15 [ptr] native CERTCertificatePtr(CERTCertificate);
  16 [ptr] native SharedCertVerifierPtr(mozilla::psm::SharedCertVerifier);
  17
  18 [scriptable, uuid(a0a8f52b-ea18-4abc-a3ca-eccf704ffe63)]
  19 interface nsINSSComponent : nsISupports {
  20   /**
  21    * When we log out of a PKCS#11 token, any TLS connections that may have
  22    * involved a client certificate stored on that token must be closed. Since we
  23    * don't have a fine-grained way to do this, we basically cancel everything.
  24    * More speficially, this clears all temporary certificate exception overrides
  25    * and any remembered client authentication certificate decisions, and then
  26    * cancels all network connections (strictly speaking, this last part is
  27    * overzealous - we only need to cancel all https connections (see bug
  28    * 1446645)).
  29    */
  30   [noscript] void logoutAuthenticatedPK11();
  31
  32   /**
  33    * Used to determine if the given certificate (represented as an array of
  34    * bytes) is the certificate we use in tests to simulate a built-in root
  35    * certificate. Returns false in non-debug builds.
  36    */
  37   [noscript] boolean isCertTestBuiltInRoot(in Array<octet> cert);
  38
  39   /**
  40    * If enabled by the preference "security.enterprise_roots.enabled", returns
  41    * an array of arrays of bytes representing the imported enterprise root
  42    * certificates (i.e. root certificates gleaned from the OS certificate
  43    * store). Returns an empty array otherwise.
  44    * Currently this is only implemented on Windows and MacOS X, so this
  45    * function returns an empty array on all other platforms.
  46    */
  47   Array<Array<octet> > getEnterpriseRoots();
  48   ACString getEnterpriseRootsPEM();
  49
  50   /**
  51    * Similarly, but for intermediate certificates.
  52    */
  53   Array<Array<octet> > getEnterpriseIntermediates();
  54   ACString getEnterpriseIntermediatesPEM();
  55
  56   /**
  57    * Test utility for adding an intermediate certificate to the current set of
  58    * imported enterprise intermediates, if any. Additions to the set made using
  59    * this function will be cleared when the value of the preference
  60    * "security.enterprise_roots.enabled" changes.
  61    */
  62   void addEnterpriseIntermediate(in Array<octet> intermediateBytes);
  63
  64   /**
  65    * For performance reasons, the builtin roots module is loaded on a background
  66    * thread. When any code that depends on the builtin roots module runs, it
  67    * must first wait for the module to be loaded.
  68    */
  69   [noscript] void blockUntilLoadableCertsLoaded();
  70
  71   /**
  72    * In theory a token on a PKCS#11 module can be inserted or removed at any
  73    * time. Operations that may depend on resources on external tokens should
  74    * call this to ensure they have a recent view of the token.
  75    */
  76   [noscript] void checkForSmartCardChanges();
  77
  78   /**
  79    * Used to potentially detect when a user's internet connection is being
  80    * intercepted. When doing an update ping, if certificate verification fails,
  81    * we make a note of the issuer distinguished name of that certificate.
  82    * If a subsequent certificate verification fails, we compare issuer
  83    * distinguished names. If they match, something may be intercepting the
  84    * user's traffic (if they don't match, the server is likely misconfigured).
  85    * This function succeeds if the given DN matches the noted DN and fails
  86    * otherwise (e.g. if the update ping never failed).
  87    */
  88   [noscript] void issuerMatchesMitmCanary(in string certIssuer);
  89
  90   /**
  91    * Returns an already-adrefed handle to the currently configured shared
  92    * certificate verifier.
  93    */
  94   [noscript] SharedCertVerifierPtr getDefaultCertVerifier();
  95
  96   /**
  97    * For clearing both SSL internal and external session cache from JS.
  98    * WARNING: May be racy when using the socket process.
  99    */
 100   void clearSSLExternalAndInternalSessionCache();
 101
 102   /**
 103    * For clearing both SSL internal and external session cache from JS.
 104    */
 105   [implicit_jscontext]
 106   Promise asyncClearSSLExternalAndInternalSessionCache();
 107 };