1 /* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
3 * You can obtain one at http://mozilla.org/MPL/2.0/. */
7 const { Preferences } = ChromeUtils.import(
8 "resource://gre/modules/Preferences.jsm"
10 const { XPCOMUtils } = ChromeUtils.import(
11 "resource://gre/modules/XPCOMUtils.jsm"
14 this.EXPORTED_SYMBOLS = [
15 "CertificateOverrideManager",
16 "InsecureSweepingOverride",
19 const registrar = Components.manager.QueryInterface(Ci.nsIComponentRegistrar);
20 const sss = Cc["@mozilla.org/ssservice;1"].getService(
21 Ci.nsISiteSecurityService
24 const CERT_PINNING_ENFORCEMENT_PREF = "security.cert_pinning.enforcement_level";
25 const CID = Components.ID("{4b67cce0-a51c-11e6-9598-0800200c9a66}");
26 const CONTRACT_ID = "@mozilla.org/security/certoverride;1";
27 const DESC = "All-encompassing cert service that matches on a bitflag";
28 const HSTS_PRELOAD_LIST_PREF = "network.stricttransportsecurity.preloadlist";
36 let currentOverride = null;
38 /** TLS certificate service override management for Marionette. */
39 class CertificateOverrideManager {
41 * Installs a TLS certificate service override.
43 * The provided `service` must implement the `register` and `unregister`
44 * functions that causes a new `nsICertOverrideService` interface
45 * implementation to be registered with the `nsIComponentRegistrar`.
47 * After `service` is registered, `nsICertOverrideService` is
48 * reinitialised to cause all Gecko components to pick up the
51 * If an override is already installed this functions acts as a no-op.
53 * @param {cert.Override} service
54 * Service generator that registers and unregisters the XPCOM service.
56 * @throws {Components.Exception}
57 * If unable to register or initialise `service`.
59 static install(service) {
60 if (currentOverride) {
65 currentOverride = service;
69 * Uninstall a TLS certificate service override.
71 * If there is no current override installed this function acts
75 if (!currentOverride) {
78 currentOverride.unregister();
79 currentOverride = null;
82 this.CertificateOverrideManager = CertificateOverrideManager;
85 * Certificate override service that acts in an all-inclusive manner
86 * on TLS certificates.
88 * @throws {Components.Exception}
89 * If there are any problems registering the service.
91 function InsecureSweepingOverride() {
92 // This needs to be an old-style class with a function constructor
93 // and prototype assignment because... XPCOM. Any attempt at
94 // modernisation will be met with cryptic error messages which will
95 // make your life miserable.
96 let service = function() {};
98 hasMatchingOverride(aHostName, aPort, aCert, aOverrideBits, aIsTemporary) {
99 aIsTemporary.value = false;
100 aOverrideBits.value = Error.Untrusted | Error.Mismatch | Error.Time;
105 QueryInterface: ChromeUtils.generateQI([Ci.nsICertOverrideService]),
107 let factory = XPCOMUtils.generateSingletonFactory(service);
111 // make it possible to register certificate overrides for domains
112 // that use HSTS or HPKP
113 Preferences.set(HSTS_PRELOAD_LIST_PREF, false);
114 Preferences.set(CERT_PINNING_ENFORCEMENT_PREF, 0);
116 registrar.registerFactory(CID, DESC, CONTRACT_ID, factory);
120 registrar.unregisterFactory(CID, factory);
122 Preferences.reset(HSTS_PRELOAD_LIST_PREF);
123 Preferences.reset(CERT_PINNING_ENFORCEMENT_PREF);
125 // clear collected HSTS and HPKP state
126 // through the site security service
132 this.InsecureSweepingOverride = InsecureSweepingOverride;