nsICertOverrideService.idl (7177B)
1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- 2 * 3 * This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this 5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 #include "nsISupports.idl" 8 9 interface nsIArray; 10 interface nsIX509Cert; 11 12 [ref] native const_OriginAttributesRef(const mozilla::OriginAttributes); 13 14 %{C++ 15 #define NS_CERTOVERRIDE_CONTRACTID "@mozilla.org/security/certoverride;1" 16 17 namespace mozilla { 18 class OriginAttributes; 19 } 20 %} 21 22 [scriptable, builtinclass, uuid(ed735e24-fa55-4163-906d-17fb78851fe1)] 23 interface nsICertOverride : nsISupports { 24 25 /** 26 * The hostname of the server the override is used for. 27 */ 28 readonly attribute ACString asciiHost; 29 30 /** 31 * The port of the server the override is used for. 32 */ 33 readonly attribute int32_t port; 34 35 /** 36 * A combination of hostname and port in the form host:port. 37 * Since the port can be -1 which is equivalent to port 433 we use an 38 * existing function of nsCertOverrideService to create this property. 39 */ 40 readonly attribute ACString hostPort; 41 42 /** 43 * The fingerprint for the associated certificate. 44 */ 45 readonly attribute ACString fingerprint; 46 47 /** 48 * The origin attributes associated with this override. 49 */ 50 [implicit_jscontext] 51 readonly attribute jsval originAttributes; 52 }; 53 54 [scriptable, builtinclass, uuid(be019e47-22fc-4355-9f16-9ab047d6742d)] 55 interface nsICertOverrideService : nsISupports { 56 /** 57 * When making a TLS connection to the given hostname and port (in the 58 * context of the given origin attributes), if the certificate verifier 59 * encounters an overridable error when verifying the given certificate, the 60 * connection will continue (provided overrides are allowed for that host). 61 * 62 * @param aHostName The host (punycode) this mapping belongs to 63 * @param aPort The port this mapping belongs to. If it is -1 then it 64 * is internaly treated as 443. 65 * @param aOriginAttributes the origin attributes of the mapping 66 * @param aCert The certificate used by the server 67 * @param aTemporary Whether or not to only store the mapping for the session 68 */ 69 [binaryname(RememberValidityOverride), noscript, must_use] 70 void rememberValidityOverrideNative(in AUTF8String aHostName, 71 in int32_t aPort, 72 in const_OriginAttributesRef aOriginAttributes, 73 in nsIX509Cert aCert, 74 in boolean aTemporary); 75 [binaryname(RememberValidityOverrideScriptable), implicit_jscontext, must_use] 76 void rememberValidityOverride(in AUTF8String aHostName, 77 in int32_t aPort, 78 in jsval aOriginAttributes, 79 in nsIX509Cert aCert, 80 in boolean aTemporary); 81 82 /** 83 * Return whether this host, port, cert triple has a stored override. 84 * If so, the outparams will contain the specific errors that were 85 * overridden, and whether the override is permanent, or only for the current 86 * session. 87 * 88 * @param aHostName The host (punycode) this mapping belongs to 89 * @param aPort The port this mapping belongs to, if it is -1 then it 90 * is internally treated as 443 91 * @param aCert The certificate this mapping belongs to 92 * @param aIsTemporary Whether the stored override is session-only, 93 * or permanent 94 * @return Whether an override has been stored for this host+port+cert 95 */ 96 [binaryname(HasMatchingOverride), noscript, must_use] 97 boolean hasMatchingOverrideNative(in AUTF8String aHostName, 98 in int32_t aPort, 99 in const_OriginAttributesRef aOriginAttributes, 100 in nsIX509Cert aCert, 101 out boolean aIsTemporary); 102 [binaryname(HasMatchingOverrideScriptable), implicit_jscontext, must_use] 103 boolean hasMatchingOverride(in AUTF8String aHostName, 104 in int32_t aPort, 105 in jsval aOriginAttributes, 106 in nsIX509Cert aCert, 107 out boolean aIsTemporary); 108 109 /** 110 * Remove a override for the given hostname:port. 111 * 112 * @param aHostName The host (punycode) whose entry should be cleared. 113 * @param aPort The port whose entry should be cleared. 114 * If it is -1, then it is internaly treated as 443. 115 * If it is 0 and aHostName is "all:temporary-certificates", 116 * then all temporary certificates should be cleared. 117 */ 118 [binaryname(ClearValidityOverride), noscript] 119 void clearValidityOverrideNative(in AUTF8String aHostName, 120 in int32_t aPort, 121 in const_OriginAttributesRef aOriginAttributes); 122 [binaryname(ClearValidityOverrideScriptable), implicit_jscontext] 123 void clearValidityOverride(in AUTF8String aHostName, 124 in int32_t aPort, 125 in jsval aOriginAttributes); 126 127 /** 128 * Remove all overrides. 129 */ 130 void clearAllOverrides(); 131 132 Array<nsICertOverride> getOverrides(); 133 134 /** 135 * NOTE: This function is used only for testing! 136 * 137 * @param aDisable If true, disable all security checks and make 138 * hasMatchingOverride always return true. 139 */ 140 void setDisableAllSecurityChecksAndLetAttackersInterceptMyData( 141 in boolean aDisable); 142 143 /** 144 * NOTE: This function is used only for webdriver! 145 * Spec: https://www.w3.org/TR/webdriver-bidi/#command-browser-createUserContext. 146 * 147 * The method is designed to enable or disable all security checks 148 * for the specified user context. This settings should override the global state, 149 * e.g., the security checks can be disabled globally but with this method they can 150 * be enabled for the specified user context. 151 * 152 * @param aUserContextId Enable or disable all security checks for this user context. 153 * @param aDisable If true, disable all security checks and make 154 * hasMatchingOverride always return true. 155 */ 156 void setDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext( 157 in uint32_t aUserContextId, 158 in boolean aDisable); 159 160 /** 161 * NOTE: This function is used only for webdriver! 162 * Spec: https://www.w3.org/TR/webdriver-bidi/#cleanup-the-session. 163 * 164 * This method is required to reset the status of security checks 165 * for the specified user context and fallback to the global state. 166 * E.g., the user context can have security checks enabled 167 * but globally they are disabled. After calling this method the security checks 168 * for the user context should be disabled as it is globally. 169 * 170 * @param aUserContextId Reset the status of security checks for this user context. 171 */ 172 void resetDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext( 173 in uint32_t aUserContextId); 174 175 readonly attribute boolean securityCheckDisabled; 176 };