mirror of
https://github.com/classilla/tenfourfox.git
synced 2024-06-07 13:53:33 +00:00
351 lines
11 KiB
Plaintext
351 lines
11 KiB
Plaintext
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "nsISupports.idl"
|
|
|
|
interface nsIArray;
|
|
interface nsIX509CertValidity;
|
|
interface nsIASN1Object;
|
|
interface nsICertVerificationListener;
|
|
|
|
%{ C++
|
|
/* forward declaration */
|
|
typedef struct CERTCertificateStr CERTCertificate;
|
|
%}
|
|
[ptr] native CERTCertificatePtr(CERTCertificate);
|
|
|
|
/**
|
|
* This represents a X.509 certificate.
|
|
*/
|
|
[scriptable, uuid(f8ed8364-ced9-4c6e-86ba-48af53c393e6)]
|
|
interface nsIX509Cert : nsISupports {
|
|
|
|
/**
|
|
* A nickname for the certificate.
|
|
*/
|
|
readonly attribute AString nickname;
|
|
|
|
/**
|
|
* The primary email address of the certificate, if present.
|
|
*/
|
|
readonly attribute AString emailAddress;
|
|
|
|
/**
|
|
* Obtain a list of all email addresses
|
|
* contained in the certificate.
|
|
*
|
|
* @param length The number of strings in the returned array.
|
|
* @return An array of email addresses.
|
|
*/
|
|
void getEmailAddresses(out unsigned long length,
|
|
[retval, array, size_is(length)] out wstring addresses);
|
|
|
|
/**
|
|
* Check whether a given address is contained in the certificate.
|
|
* The comparison will convert the email address to lowercase.
|
|
* The behaviour for non ASCII characters is undefined.
|
|
*
|
|
* @param aEmailAddress The address to search for.
|
|
*
|
|
* @return True if the address is contained in the certificate.
|
|
*/
|
|
boolean containsEmailAddress(in AString aEmailAddress);
|
|
|
|
/**
|
|
* The subject owning the certificate.
|
|
*/
|
|
readonly attribute AString subjectName;
|
|
|
|
/**
|
|
* The subject's common name.
|
|
*/
|
|
readonly attribute AString commonName;
|
|
|
|
/**
|
|
* The subject's organization.
|
|
*/
|
|
readonly attribute AString organization;
|
|
|
|
/**
|
|
* The subject's organizational unit.
|
|
*/
|
|
readonly attribute AString organizationalUnit;
|
|
|
|
/**
|
|
* The fingerprint of the certificate's DER encoding,
|
|
* calculated using the SHA-256 algorithm.
|
|
*/
|
|
readonly attribute AString sha256Fingerprint;
|
|
|
|
/**
|
|
* The fingerprint of the certificate's DER encoding,
|
|
* calculated using the SHA1 algorithm.
|
|
*/
|
|
readonly attribute AString sha1Fingerprint;
|
|
|
|
/**
|
|
* A human readable name identifying the hardware or
|
|
* software token the certificate is stored on.
|
|
*/
|
|
readonly attribute AString tokenName;
|
|
|
|
/**
|
|
* The subject identifying the issuer certificate.
|
|
*/
|
|
readonly attribute AString issuerName;
|
|
|
|
/**
|
|
* The serial number the issuer assigned to this certificate.
|
|
*/
|
|
readonly attribute AString serialNumber;
|
|
|
|
/**
|
|
* The issuer subject's common name.
|
|
*/
|
|
readonly attribute AString issuerCommonName;
|
|
|
|
/**
|
|
* The issuer subject's organization.
|
|
*/
|
|
readonly attribute AString issuerOrganization;
|
|
|
|
/**
|
|
* The issuer subject's organizational unit.
|
|
*/
|
|
readonly attribute AString issuerOrganizationUnit;
|
|
|
|
/**
|
|
* The certificate used by the issuer to sign this certificate.
|
|
*/
|
|
readonly attribute nsIX509Cert issuer;
|
|
|
|
/**
|
|
* This certificate's validity period.
|
|
*/
|
|
readonly attribute nsIX509CertValidity validity;
|
|
|
|
/**
|
|
* A unique identifier of this certificate within the local storage.
|
|
*/
|
|
readonly attribute string dbKey;
|
|
|
|
/**
|
|
* A human readable identifier to label this certificate.
|
|
*/
|
|
readonly attribute AString windowTitle;
|
|
|
|
/**
|
|
* Constants to classify the type of a certificate.
|
|
*/
|
|
const unsigned long UNKNOWN_CERT = 0;
|
|
const unsigned long CA_CERT = 1 << 0;
|
|
const unsigned long USER_CERT = 1 << 1;
|
|
const unsigned long EMAIL_CERT = 1 << 2;
|
|
const unsigned long SERVER_CERT = 1 << 3;
|
|
const unsigned long ANY_CERT = 0xffff;
|
|
|
|
/**
|
|
* Type of this certificate
|
|
*/
|
|
readonly attribute unsigned long certType;
|
|
|
|
/**
|
|
* True if the certificate is self-signed. CA issued
|
|
* certificates are always self-signed.
|
|
*/
|
|
readonly attribute boolean isSelfSigned;
|
|
|
|
/**
|
|
* Constants for certificate verification results.
|
|
*/
|
|
const unsigned long VERIFIED_OK = 0;
|
|
const unsigned long NOT_VERIFIED_UNKNOWN = 1 << 0;
|
|
const unsigned long CERT_REVOKED = 1 << 1;
|
|
const unsigned long CERT_EXPIRED = 1 << 2;
|
|
const unsigned long CERT_NOT_TRUSTED = 1 << 3;
|
|
const unsigned long ISSUER_NOT_TRUSTED = 1 << 4;
|
|
const unsigned long ISSUER_UNKNOWN = 1 << 5;
|
|
const unsigned long INVALID_CA = 1 << 6;
|
|
const unsigned long USAGE_NOT_ALLOWED = 1 << 7;
|
|
const unsigned long SIGNATURE_ALGORITHM_DISABLED = 1 << 8;
|
|
|
|
/**
|
|
* Constants that describe the certified usages of a certificate.
|
|
*
|
|
* Deprecated and unused
|
|
*/
|
|
const unsigned long CERT_USAGE_SSLClient = 0;
|
|
const unsigned long CERT_USAGE_SSLServer = 1;
|
|
const unsigned long CERT_USAGE_SSLServerWithStepUp = 2;
|
|
const unsigned long CERT_USAGE_SSLCA = 3;
|
|
const unsigned long CERT_USAGE_EmailSigner = 4;
|
|
const unsigned long CERT_USAGE_EmailRecipient = 5;
|
|
const unsigned long CERT_USAGE_ObjectSigner = 6;
|
|
const unsigned long CERT_USAGE_UserCertImport = 7;
|
|
const unsigned long CERT_USAGE_VerifyCA = 8;
|
|
const unsigned long CERT_USAGE_ProtectedObjectSigner = 9;
|
|
const unsigned long CERT_USAGE_StatusResponder = 10;
|
|
const unsigned long CERT_USAGE_AnyCA = 11;
|
|
|
|
/**
|
|
* Constants for specifying the chain mode when exporting a certificate
|
|
*/
|
|
const unsigned long CMS_CHAIN_MODE_CertOnly = 1;
|
|
const unsigned long CMS_CHAIN_MODE_CertChain = 2;
|
|
const unsigned long CMS_CHAIN_MODE_CertChainWithRoot = 3;
|
|
|
|
/**
|
|
* Obtain a list of certificates that contains this certificate
|
|
* and the issuing certificates of all involved issuers,
|
|
* up to the root issuer.
|
|
*
|
|
* @return The chain of certifficates including the issuers.
|
|
*/
|
|
nsIArray getChain();
|
|
|
|
/**
|
|
* Obtain an array of human readable strings describing
|
|
* the certificate's certified usages.
|
|
*
|
|
* @param localOnly Do not hit the network, even if revocation information
|
|
* downloading is currently activated.
|
|
* @param verified The certificate verification result, see constants.
|
|
* @param count The number of human readable usages returned.
|
|
* @param usages The array of human readable usages.
|
|
*/
|
|
void getUsagesArray(in boolean localOnly,
|
|
out uint32_t verified,
|
|
out uint32_t count,
|
|
[array, size_is(count)] out wstring usages);
|
|
|
|
/**
|
|
* Async version of nsIX509Cert::getUsagesArray()
|
|
*
|
|
* Will not block, will request results asynchronously,
|
|
* availability of results will be notified on the main thread.
|
|
*/
|
|
void requestUsagesArrayAsync(in nsICertVerificationListener cvl);
|
|
|
|
/**
|
|
* Obtain a single comma separated human readable string describing
|
|
* the certificate's certified usages.
|
|
*
|
|
* @param localOnly Do not hit the network, even if revocation information
|
|
* downloading is currently activated.
|
|
* @param verified The certificate verification result, see constants.
|
|
* @param purposes The string listing the usages.
|
|
*/
|
|
void getUsagesString(in boolean localOnly, out uint32_t verified, out AString usages);
|
|
|
|
/**
|
|
* This is the attribute which describes the ASN1 layout
|
|
* of the certificate. This can be used when doing a
|
|
* "pretty print" of the certificate's ASN1 structure.
|
|
*/
|
|
readonly attribute nsIASN1Object ASN1Structure;
|
|
|
|
/**
|
|
* Obtain a raw binary encoding of this certificate
|
|
* in DER format.
|
|
*
|
|
* @param length The number of bytes in the binary encoding.
|
|
* @param data The bytes representing the DER encoded certificate.
|
|
*/
|
|
void getRawDER(out unsigned long length,
|
|
[retval, array, size_is(length)] out octet data);
|
|
|
|
/**
|
|
* Test whether two certificate instances represent the
|
|
* same certificate.
|
|
*
|
|
* @return Whether the certificates are equal
|
|
*/
|
|
boolean equals(in nsIX509Cert other);
|
|
|
|
/**
|
|
* The base64 encoding of the DER encoded public key info using the specified
|
|
* digest.
|
|
*/
|
|
readonly attribute ACString sha256SubjectPublicKeyInfoDigest;
|
|
|
|
/**
|
|
* Obtain the certificate wrapped in a PKCS#7 SignedData structure,
|
|
* with or without the certificate chain
|
|
*
|
|
* @param chainMode Whether to include the chain (with or without the root),
|
|
see CMS_CHAIN_MODE constants.
|
|
* @param length The number of bytes of the PKCS#7 data.
|
|
* @param data The bytes representing the PKCS#7 wrapped certificate.
|
|
*/
|
|
void exportAsCMS(in unsigned long chainMode,
|
|
out unsigned long length,
|
|
[retval, array, size_is(length)] out octet data);
|
|
|
|
/**
|
|
* Retrieves the NSS certificate object wrapped by this interface
|
|
*/
|
|
[notxpcom, noscript] CERTCertificatePtr getCert();
|
|
|
|
/**
|
|
* Human readable names identifying all hardware or
|
|
* software tokens the certificate is stored on.
|
|
*
|
|
* @param length On success, the number of entries in the returned array.
|
|
* @return On success, an array containing the names of all tokens
|
|
* the certificate is stored on (may be empty).
|
|
* On failure the function throws/returns an error.
|
|
*/
|
|
void getAllTokenNames(out unsigned long length,
|
|
[retval, array, size_is(length)] out wstring
|
|
tokenNames);
|
|
|
|
/**
|
|
* Either delete the certificate from all cert databases,
|
|
* or mark it as untrusted.
|
|
*/
|
|
void markForPermDeletion();
|
|
};
|
|
|
|
[scriptable, uuid(2fd0a785-9f2d-4327-8871-8c3e0783891d)]
|
|
interface nsICertVerificationResult : nsISupports {
|
|
|
|
/**
|
|
* This interface reflects a container of
|
|
* verification results. Call will not block.
|
|
*
|
|
* Obtain an array of human readable strings describing
|
|
* the certificate's certified usages.
|
|
*
|
|
* Mirrors the results produced by
|
|
* nsIX509Cert::getUsagesArray()
|
|
*
|
|
* As of today, this function is a one-shot object,
|
|
* only the first call will succeed.
|
|
* This allows an optimization in the implementation,
|
|
* ownership of result data will be transfered to caller.
|
|
*
|
|
* @param cert The certificate that was verified.
|
|
* @param verified The certificate verification result,
|
|
* see constants in nsIX509Cert.
|
|
* @param count The number of human readable usages returned.
|
|
* @param usages The array of human readable usages.
|
|
*/
|
|
void getUsagesArrayResult(out uint32_t verified,
|
|
out uint32_t count,
|
|
[array, size_is(count)] out wstring usages);
|
|
};
|
|
|
|
[scriptable, uuid(6684bce9-50db-48e1-81b7-98102bf81357)]
|
|
interface nsICertVerificationListener : nsISupports {
|
|
|
|
/**
|
|
* Notify that results are ready, that have been requested
|
|
* using nsIX509Cert::requestUsagesArrayAsync()
|
|
*/
|
|
void notify(in nsIX509Cert verifiedCert,
|
|
in nsICertVerificationResult result);
|
|
};
|