summaryrefslogtreecommitdiffstats
path: root/security/manager/ssl/nsSiteSecurityService.h
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
commit26a029d407be480d791972afb5975cf62c9360a6 (patch)
treef435a8308119effd964b339f76abb83a57c29483 /security/manager/ssl/nsSiteSecurityService.h
parentInitial commit. (diff)
downloadfirefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz
firefox-26a029d407be480d791972afb5975cf62c9360a6.zip
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'security/manager/ssl/nsSiteSecurityService.h')
-rw-r--r--security/manager/ssl/nsSiteSecurityService.h158
1 files changed, 158 insertions, 0 deletions
diff --git a/security/manager/ssl/nsSiteSecurityService.h b/security/manager/ssl/nsSiteSecurityService.h
new file mode 100644
index 0000000000..f5de35936a
--- /dev/null
+++ b/security/manager/ssl/nsSiteSecurityService.h
@@ -0,0 +1,158 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef __nsSiteSecurityService_h__
+#define __nsSiteSecurityService_h__
+
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/Dafsa.h"
+#include "mozilla/RefPtr.h"
+#include "nsCOMPtr.h"
+#include "nsIDataStorage.h"
+#include "nsIObserver.h"
+#include "nsISiteSecurityService.h"
+#include "nsString.h"
+#include "nsTArray.h"
+#include "mozpkix/pkixtypes.h"
+#include "prtime.h"
+
+class nsIURI;
+
+using mozilla::OriginAttributes;
+
+// {16955eee-6c48-4152-9309-c42a465138a1}
+#define NS_SITE_SECURITY_SERVICE_CID \
+ { \
+ 0x16955eee, 0x6c48, 0x4152, { \
+ 0x93, 0x09, 0xc4, 0x2a, 0x46, 0x51, 0x38, 0xa1 \
+ } \
+ }
+
+/**
+ * SecurityPropertyState: A utility enum for representing the different states
+ * a security property can be in.
+ * SecurityPropertySet and SecurityPropertyUnset correspond to indicating
+ * a site has or does not have the security property in question, respectively.
+ * SecurityPropertyKnockout indicates a value on a preloaded list is being
+ * overridden, and the associated site does not have the security property
+ * in question.
+ */
+enum SecurityPropertyState {
+ SecurityPropertyUnset = 0,
+ SecurityPropertySet = 1,
+ SecurityPropertyKnockout = 2,
+};
+
+/**
+ * SiteHSTSState: A utility class that encodes/decodes a string describing
+ * the security state of a site. Currently only handles HSTS.
+ * HSTS state consists of:
+ * - Hostname (nsCString)
+ * - Origin attributes (OriginAttributes)
+ * - Expiry time (PRTime (aka int64_t) in milliseconds)
+ * - A state flag (SecurityPropertyState, default SecurityPropertyUnset)
+ * - An include subdomains flag (bool, default false)
+ */
+class SiteHSTSState {
+ public:
+ SiteHSTSState(const nsCString& aHost,
+ const OriginAttributes& aOriginAttributes,
+ const nsCString& aStateString);
+ SiteHSTSState(const nsCString& aHost,
+ const OriginAttributes& aOriginAttributes,
+ PRTime aHSTSExpireTime, SecurityPropertyState aHSTSState,
+ bool aHSTSIncludeSubdomains);
+
+ nsCString mHostname;
+ OriginAttributes mOriginAttributes;
+ PRTime mHSTSExpireTime;
+ SecurityPropertyState mHSTSState;
+ bool mHSTSIncludeSubdomains;
+
+ bool IsExpired() {
+ // If mHSTSExpireTime is 0, this entry never expires (this is the case for
+ // knockout entries).
+ if (mHSTSExpireTime == 0) {
+ return false;
+ }
+
+ PRTime now = PR_Now() / PR_USEC_PER_MSEC;
+ if (now > mHSTSExpireTime) {
+ return true;
+ }
+
+ return false;
+ }
+
+ void ToString(nsCString& aString);
+};
+
+struct nsSTSPreload;
+
+class nsSiteSecurityService : public nsISiteSecurityService,
+ public nsIObserver {
+ public:
+ NS_DECL_THREADSAFE_ISUPPORTS
+ NS_DECL_NSIOBSERVER
+ NS_DECL_NSISITESECURITYSERVICE
+
+ nsSiteSecurityService();
+ nsresult Init();
+
+ static nsresult GetHost(nsIURI* aURI, nsACString& aResult);
+ static bool HostIsIPAddress(const nsCString& hostname);
+
+ protected:
+ virtual ~nsSiteSecurityService();
+
+ private:
+ nsresult SetHSTSState(const char* aHost, int64_t maxage,
+ bool includeSubdomains,
+ SecurityPropertyState aHSTSState,
+ const OriginAttributes& aOriginAttributes);
+ nsresult ProcessHeaderInternal(nsIURI* aSourceURI, const nsCString& aHeader,
+ const OriginAttributes& aOriginAttributes,
+ uint64_t* aMaxAge, bool* aIncludeSubdomains,
+ uint32_t* aFailureResult);
+ nsresult ProcessSTSHeader(nsIURI* aSourceURI, const nsCString& aHeader,
+ const OriginAttributes& aOriginAttributes,
+ uint64_t* aMaxAge, bool* aIncludeSubdomains,
+ uint32_t* aFailureResult);
+ nsresult MarkHostAsNotHSTS(const nsAutoCString& aHost,
+ const OriginAttributes& aOriginAttributes);
+ nsresult ResetStateInternal(nsIURI* aURI,
+ const OriginAttributes& aOriginAttributes,
+ nsISiteSecurityService::ResetStateBy aScope);
+ void ResetStateForExactDomain(const nsCString& aHostname,
+ const OriginAttributes& aOriginAttributes);
+ nsresult HostMatchesHSTSEntry(const nsAutoCString& aHost,
+ bool aRequireIncludeSubdomains,
+ const OriginAttributes& aOriginAttributes,
+ bool& aHostMatchesHSTSEntry);
+ bool GetPreloadStatus(
+ const nsACString& aHost,
+ /*optional out*/ bool* aIncludeSubdomains = nullptr) const;
+ nsresult IsSecureHost(const nsACString& aHost,
+ const OriginAttributes& aOriginAttributes,
+ bool* aResult);
+
+ nsresult GetWithMigration(const nsACString& aHostname,
+ const OriginAttributes& aOriginAttributes,
+ nsIDataStorage::DataType aDataStorageType,
+ nsACString& aValue);
+ nsresult PutWithMigration(const nsACString& aHostname,
+ const OriginAttributes& aOriginAttributes,
+ nsIDataStorage::DataType aDataStorageType,
+ const nsACString& aStateString);
+ nsresult RemoveWithMigration(const nsACString& aHostname,
+ const OriginAttributes& aOriginAttributes,
+ nsIDataStorage::DataType aDataStorageType);
+
+ bool mUsePreloadList;
+ int64_t mPreloadListTimeOffset;
+ nsCOMPtr<nsIDataStorage> mSiteStateStorage;
+ const mozilla::Dafsa mDafsa;
+};
+
+#endif // __nsSiteSecurityService_h__