TransportSecurityInfo.h

Enable keyboard shortcuts

/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-

 * This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef TransportSecurityInfo_h

#define TransportSecurityInfo_h

#include "CertVerifier.h"  // For CertificateTransparencyInfo, EVStatus

#include "ScopedNSSTypes.h"

#include "mozilla/Assertions.h"

#include "mozilla/BasePrincipal.h"

#include "mozilla/Components.h"

#include "mozilla/Maybe.h"

#include "mozilla/RefPtr.h"

#include "mozilla/ipc/TransportSecurityInfoUtils.h"

#include "mozpkix/pkixtypes.h"

#include "nsIObjectInputStream.h"

#include "nsITransportSecurityInfo.h"

#include "nsIX509Cert.h"

#include "nsString.h"

namespace mozilla {

namespace psm {

// TransportSecurityInfo implements nsITransportSecurityInfo, which is a

// collection of attributes describing the outcome of a TLS handshake. It is

// constant - once created, it cannot be modified.  It should probably not be

// instantiated directly, but rather accessed via

// nsITLSSocketControl.securityInfo.

class TransportSecurityInfo : public nsITransportSecurityInfo {

 public:

  TransportSecurityInfo(

      uint32_t aSecurityState, PRErrorCode aErrorCode,

      nsTArray<RefPtr<nsIX509Cert>>&& aFailedCertChain,

      nsCOMPtr<nsIX509Cert>& aServerCert,

      nsTArray<RefPtr<nsIX509Cert>>&& aSucceededCertChain,

      Maybe<uint16_t> aCipherSuite, Maybe<nsCString> aKeaGroupName,

      Maybe<nsCString> aSignatureSchemeName, Maybe<uint16_t> aProtocolVersion,

      uint16_t aCertificateTransparencyStatus, Maybe<bool> aIsAcceptedEch,

      Maybe<bool> aIsDelegatedCredential,

      Maybe<OverridableErrorCategory> aOverridableErrorCategory,

      bool aMadeOCSPRequests, bool aUsedPrivateDNS, Maybe<bool> aIsEV,

      bool aNPNCompleted, const nsCString& aNegotiatedNPN, bool aResumed,

      bool aIsBuiltCertChainRootBuiltInRoot, const nsCString& aPeerId);

  NS_DECL_THREADSAFE_ISUPPORTS

  NS_DECL_NSITRANSPORTSECURITYINFO

  static bool DeserializeFromIPC(IPC::MessageReader* aReader,

                                 RefPtr<nsITransportSecurityInfo>* aResult);

  static nsresult Read(const nsCString& aSerializedSecurityInfo,

                       nsITransportSecurityInfo** aResult);

  static uint16_t ConvertCertificateTransparencyInfoToStatus(

      const mozilla::psm::CertificateTransparencyInfo& info);

 private:

  virtual ~TransportSecurityInfo() = default;

  const uint32_t mSecurityState;

  const PRErrorCode mErrorCode;

  // Peer cert chain for failed connections.

  const nsTArray<RefPtr<nsIX509Cert>> mFailedCertChain;

  const nsCOMPtr<nsIX509Cert> mServerCert;

  const nsTArray<RefPtr<nsIX509Cert>> mSucceededCertChain;

  const mozilla::Maybe<uint16_t> mCipherSuite;

  const mozilla::Maybe<nsCString> mKeaGroupName;

  const mozilla::Maybe<nsCString> mSignatureSchemeName;

  const mozilla::Maybe<uint16_t> mProtocolVersion;

  const uint16_t mCertificateTransparencyStatus;

  const mozilla::Maybe<bool> mIsAcceptedEch;

  const mozilla::Maybe<bool> mIsDelegatedCredential;

  const mozilla::Maybe<OverridableErrorCategory> mOverridableErrorCategory;

  const bool mMadeOCSPRequests;

  const bool mUsedPrivateDNS;

  const mozilla::Maybe<bool> mIsEV;

  const bool mNPNCompleted;

  const nsCString mNegotiatedNPN;

  const bool mResumed;

  const bool mIsBuiltCertChainRootBuiltInRoot;

  const nsCString mPeerId;

  static nsresult ReadOldOverridableErrorBits(

      nsIObjectInputStream* aStream,

      OverridableErrorCategory& aOverridableErrorCategory);

  static nsresult ReadSSLStatus(

      nsIObjectInputStream* aStream, nsCOMPtr<nsIX509Cert>& aServerCert,

      Maybe<uint16_t>& aCipherSuite, Maybe<uint16_t>& aProtocolVersion,

      Maybe<OverridableErrorCategory>& aOverridableErrorCategory,

      Maybe<bool>& aIsEV, uint16_t& aCertificateTransparencyStatus,

      Maybe<nsCString>& aKeaGroupName, Maybe<nsCString>& aSignatureSchemeName,

      nsTArray<RefPtr<nsIX509Cert>>& aSucceededCertChain);

  // This function is used to read the binary that are serialized

  // by using nsIX509CertList

  static nsresult ReadCertList(nsIObjectInputStream* aStream,

                               nsTArray<RefPtr<nsIX509Cert>>& aCertList);

  static nsresult ReadCertificatesFromStream(

      nsIObjectInputStream* aStream, uint32_t aSize,

      nsTArray<RefPtr<nsIX509Cert>>& aCertList);

};

}  // namespace psm

}  // namespace mozilla

#endif  // TransportSecurityInfo_h