nsINSSComponent.idl (4314B)
1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- 2 * 3 * This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this 5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 #include "nsISupports.idl" 8 9 %{C++ 10 #include "cert.h" 11 #include "SharedCertVerifier.h" 12 #define PSM_COMPONENT_CONTRACTID "@mozilla.org/psm;1" 13 %} 14 15 [ptr] native CERTCertificatePtr(CERTCertificate); 16 [ptr] native SharedCertVerifierPtr(mozilla::psm::SharedCertVerifier); 17 18 [scriptable, uuid(a0a8f52b-ea18-4abc-a3ca-eccf704ffe63)] 19 interface nsINSSComponent : nsISupports { 20 /** 21 * When we log out of a PKCS#11 token, any TLS connections that may have 22 * involved a client certificate stored on that token must be closed. Since we 23 * don't have a fine-grained way to do this, we basically cancel everything. 24 * More speficially, this clears all temporary certificate exception overrides 25 * and any remembered client authentication certificate decisions, and then 26 * cancels all network connections (strictly speaking, this last part is 27 * overzealous - we only need to cancel all https connections (see bug 28 * 1446645)). 29 */ 30 [noscript] void logoutAuthenticatedPK11(); 31 32 /** 33 * Used to determine if the given certificate (represented as an array of 34 * bytes) is the certificate we use in tests to simulate a built-in root 35 * certificate. Returns false in non-debug builds. 36 */ 37 [noscript] boolean isCertTestBuiltInRoot(in Array<octet> cert); 38 39 /** 40 * If enabled by the preference "security.enterprise_roots.enabled", returns 41 * an array of arrays of bytes representing the imported enterprise root 42 * certificates (i.e. root certificates gleaned from the OS certificate 43 * store). Returns an empty array otherwise. 44 * Currently this is only implemented on Windows and MacOS X, so this 45 * function returns an empty array on all other platforms. 46 */ 47 Array<Array<octet> > getEnterpriseRoots(); 48 ACString getEnterpriseRootsPEM(); 49 50 /** 51 * Similarly, but for intermediate certificates. 52 */ 53 Array<Array<octet> > getEnterpriseIntermediates(); 54 ACString getEnterpriseIntermediatesPEM(); 55 56 /** 57 * Test utility for adding an intermediate certificate to the current set of 58 * imported enterprise intermediates, if any. Additions to the set made using 59 * this function will be cleared when the value of the preference 60 * "security.enterprise_roots.enabled" changes. 61 */ 62 void addEnterpriseIntermediate(in Array<octet> intermediateBytes); 63 64 /** 65 * For performance reasons, the builtin roots module is loaded on a background 66 * thread. When any code that depends on the builtin roots module runs, it 67 * must first wait for the module to be loaded. 68 */ 69 [noscript] void blockUntilLoadableCertsLoaded(); 70 71 /** 72 * In theory a token on a PKCS#11 module can be inserted or removed at any 73 * time. Operations that may depend on resources on external tokens should 74 * call this to ensure they have a recent view of the token. 75 */ 76 [noscript] void checkForSmartCardChanges(); 77 78 /** 79 * Used to potentially detect when a user's internet connection is being 80 * intercepted. When doing an update ping, if certificate verification fails, 81 * we make a note of the issuer distinguished name of that certificate. 82 * If a subsequent certificate verification fails, we compare issuer 83 * distinguished names. If they match, something may be intercepting the 84 * user's traffic (if they don't match, the server is likely misconfigured). 85 * This function succeeds if the given DN matches the noted DN and fails 86 * otherwise (e.g. if the update ping never failed). 87 */ 88 [noscript] void issuerMatchesMitmCanary(in string certIssuer); 89 90 /** 91 * Returns an already-adrefed handle to the currently configured shared 92 * certificate verifier. 93 */ 94 [noscript] SharedCertVerifierPtr getDefaultCertVerifier(); 95 96 /** 97 * For clearing both SSL internal and external session cache from JS. 98 * WARNING: May be racy when using the socket process. 99 */ 100 void clearSSLExternalAndInternalSessionCache(); 101 102 /** 103 * For clearing both SSL internal and external session cache from JS. 104 */ 105 [implicit_jscontext] 106 Promise asyncClearSSLExternalAndInternalSessionCache(); 107 };