117 lines
4.5 KiB
Plaintext
117 lines
4.5 KiB
Plaintext
/*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "nsISerialEventTarget.idl"
|
|
#include "nsISupports.idl"
|
|
|
|
%{C++
|
|
#include "cert.h"
|
|
#include "SharedCertVerifier.h"
|
|
#define PSM_COMPONENT_CONTRACTID "@mozilla.org/psm;1"
|
|
%}
|
|
|
|
[ptr] native CERTCertificatePtr(CERTCertificate);
|
|
[ptr] native SharedCertVerifierPtr(mozilla::psm::SharedCertVerifier);
|
|
|
|
[scriptable, uuid(a0a8f52b-ea18-4abc-a3ca-eccf704ffe63)]
|
|
interface nsINSSComponent : nsISupports {
|
|
/**
|
|
* When we log out of a PKCS#11 token, any TLS connections that may have
|
|
* involved a client certificate stored on that token must be closed. Since we
|
|
* don't have a fine-grained way to do this, we basically cancel everything.
|
|
* More speficially, this clears the TLS session cache and then
|
|
* cancels all network connections (strictly speaking, this last part is
|
|
* overzealous - we only need to cancel all https connections (see bug
|
|
* 1446645)).
|
|
*/
|
|
void clearTLSCacheAndCancelAllConnections();
|
|
|
|
/**
|
|
* Used to determine if the given certificate (represented as an array of
|
|
* bytes) is the certificate we use in tests to simulate a built-in root
|
|
* certificate. Returns false in non-debug builds.
|
|
*/
|
|
[noscript] boolean isCertTestBuiltInRoot(in Array<octet> cert);
|
|
|
|
/**
|
|
* If enabled by the preference "security.enterprise_roots.enabled", returns
|
|
* an array of arrays of bytes representing the imported enterprise root
|
|
* certificates (i.e. root certificates gleaned from the OS certificate
|
|
* store). Returns an empty array otherwise.
|
|
* Currently this is only implemented on Windows and MacOS X, so this
|
|
* function returns an empty array on all other platforms.
|
|
*/
|
|
Array<Array<octet> > getEnterpriseRoots();
|
|
ACString getEnterpriseRootsPEM();
|
|
|
|
/**
|
|
* Similarly, but for intermediate certificates.
|
|
*/
|
|
Array<Array<octet> > getEnterpriseIntermediates();
|
|
ACString getEnterpriseIntermediatesPEM();
|
|
|
|
/**
|
|
* Test utility for adding an intermediate certificate to the current set of
|
|
* imported enterprise intermediates, if any. Additions to the set made using
|
|
* this function will be cleared when the value of the preference
|
|
* "security.enterprise_roots.enabled" changes.
|
|
*/
|
|
void addEnterpriseIntermediate(in Array<octet> intermediateBytes);
|
|
|
|
/**
|
|
* For performance reasons, the builtin roots module is loaded on a background
|
|
* thread. When any code that depends on the builtin roots module runs, it
|
|
* must first wait for the module to be loaded.
|
|
*/
|
|
[noscript] void blockUntilLoadableCertsLoaded();
|
|
|
|
/**
|
|
* Used to potentially detect when a user's internet connection is being
|
|
* intercepted. When doing an update ping, if certificate verification fails,
|
|
* we make a note of the issuer distinguished name of that certificate.
|
|
* If a subsequent certificate verification fails, we compare issuer
|
|
* distinguished names. If they match, something may be intercepting the
|
|
* user's traffic (if they don't match, the server is likely misconfigured).
|
|
* This function succeeds if the given DN matches the noted DN and fails
|
|
* otherwise (e.g. if the update ping never failed).
|
|
*/
|
|
[noscript] void issuerMatchesMitmCanary(in string certIssuer);
|
|
|
|
/**
|
|
* Returns an already-adrefed handle to the currently configured shared
|
|
* certificate verifier.
|
|
*/
|
|
[noscript] SharedCertVerifierPtr getDefaultCertVerifier();
|
|
|
|
/**
|
|
* For clearing both SSL internal and external session cache from JS.
|
|
* WARNING: May be racy when using the socket process.
|
|
*/
|
|
void clearSSLExternalAndInternalSessionCache();
|
|
|
|
/**
|
|
* For clearing both SSL internal and external session cache from JS.
|
|
*/
|
|
[implicit_jscontext]
|
|
Promise asyncClearSSLExternalAndInternalSessionCache();
|
|
|
|
/**
|
|
* Remove TLS session resumption tokens matching the given
|
|
* OriginAttributesPattern (serialized as JSON). Used by the clear-data
|
|
* service to honour per-partition site-data clearing.
|
|
*/
|
|
void removeSSLTokensByHostAndOriginAttributesPattern(in ACString aHost,
|
|
in AString aPattern);
|
|
void removeSSLTokensBySiteAndOriginAttributesPattern(in ACString aSite,
|
|
in AString aPattern);
|
|
|
|
/**
|
|
* Provides a common background serial event target on which to do any
|
|
* operations that modify the NSS module DB.
|
|
* Only available from the main thread.
|
|
*/
|
|
readonly attribute nsISerialEventTarget nssTaskQueue;
|
|
};
|