diff --git a/security/manager/locales/en-US/security/certificates/certManager.ftl b/security/manager/locales/en-US/security/certificates/certManager.ftl
--- a/security/manager/locales/en-US/security/certificates/certManager.ftl
+++ b/security/manager/locales/en-US/security/certificates/certManager.ftl
@@ -51,9 +51,6 @@ certmgr-cert-name =
certmgr-cert-server =
.label = Server
-certmgr-override-lifetime =
- .label = Lifetime
-
certmgr-token-name =
.label = Security Device
@@ -69,6 +66,9 @@ certmgr-email =
certmgr-serial =
.label = Serial Number
+certmgr-fingerprint-sha-256 =
+ .label = SHA-256 Fingerprint
+
certmgr-view =
.label = View…
.accesskey = V
diff --git a/security/manager/pki/resources/content/certManager.js b/security/manager/pki/resources/content/certManager.js
--- a/security/manager/pki/resources/content/certManager.js
+++ b/security/manager/pki/resources/content/certManager.js
@@ -64,22 +64,16 @@ var serverRichList = {
buildRichList() {
let overrides = overrideService.getOverrides().map(item => {
- let cert = null;
- if (item.dbKey !== "") {
- cert = certdb.findCertByDBKey(item.dbKey);
- }
return {
hostPort: item.hostPort,
- dbKey: item.dbKey,
asciiHost: item.asciiHost,
port: item.port,
originAttributes: item.originAttributes,
- isTemporary: item.isTemporary,
- displayName: cert !== null ? cert.displayName : "",
+ fingerprint: item.fingerprint,
};
});
overrides.sort((a, b) => {
- let criteria = ["hostPort", "displayName"];
+ let criteria = ["hostPort", "fingerprint"];
for (let c of criteria) {
let res = a[c].localeCompare(b[c]);
if (res !== 0) {
@@ -106,10 +100,10 @@ var serverRichList = {
_richBoxAddItem(item) {
let richlistitem = document.createXULElement("richlistitem");
- richlistitem.setAttribute("dbKey", item.dbKey);
richlistitem.setAttribute("host", item.asciiHost);
richlistitem.setAttribute("port", item.port);
richlistitem.setAttribute("hostPort", item.hostPort);
+ richlistitem.setAttribute("fingerprint", item.fingerprint);
richlistitem.setAttribute(
"originAttributes",
JSON.stringify(item.originAttributes)
@@ -120,18 +114,7 @@ var serverRichList = {
hbox.setAttribute("equalsize", "always");
hbox.appendChild(createRichlistItem({ raw: item.hostPort }));
- hbox.appendChild(
- createRichlistItem(
- item.displayName !== ""
- ? { raw: item.displayName }
- : { l10nid: "no-cert-stored-for-override" }
- )
- );
- hbox.appendChild(
- createRichlistItem({
- l10nid: item.isTemporary ? "temporary-override" : "permanent-override",
- })
- );
+ hbox.appendChild(createRichlistItem({ raw: item.fingerprint }));
richlistitem.appendChild(hbox);
@@ -170,32 +153,6 @@ var serverRichList = {
}
},
- viewSelectedRichListItem() {
- let selectedItem = this.richlist.selectedItem;
- if (!selectedItem) {
- return;
- }
-
- let dbKey = selectedItem.getAttribute("dbKey");
- if (dbKey) {
- let cert = certdb.findCertByDBKey(dbKey);
- viewCertHelper(window, cert);
- }
- },
-
- exportSelectedRichListItem() {
- let selectedItem = this.richlist.selectedItem;
- if (!selectedItem) {
- return;
- }
-
- let dbKey = selectedItem.getAttribute("dbKey");
- if (dbKey) {
- let cert = certdb.findCertByDBKey(dbKey);
- exportToFile(window, cert);
- }
- },
-
addException() {
let retval = {
exceptionAdded: false,
@@ -212,16 +169,8 @@ var serverRichList = {
},
_setButtonState() {
- let websiteViewButton = document.getElementById("websites_viewButton");
- let websiteExportButton = document.getElementById("websites_exportButton");
let websiteDeleteButton = document.getElementById("websites_deleteButton");
-
- let certKey = this.richlist.selectedItem?.getAttribute("dbKey");
- let cert = certKey && certdb.findCertByDBKey(certKey);
-
websiteDeleteButton.disabled = this.richlist.selectedIndex < 0;
- websiteExportButton.disabled = !cert;
- websiteViewButton.disabled = websiteExportButton.disabled;
},
};
/**
diff --git a/security/manager/pki/resources/content/certManager.xhtml b/security/manager/pki/resources/content/certManager.xhtml
--- a/security/manager/pki/resources/content/certManager.xhtml
+++ b/security/manager/pki/resources/content/certManager.xhtml
@@ -157,18 +157,13 @@
<listheader equalsize="always">
<treecol id="sitecol" data-l10n-id="certmgr-cert-server" primary="true" flex="1"/>
- <treecol id="certcol" data-l10n-id="certmgr-cert-name" flex="1"/>
- <treecol id="lifetimecol" data-l10n-id="certmgr-override-lifetime" flex="1"/>
+ <treecol id="sha256col" data-l10n-id="certmgr-fingerprint-sha-256" flex="1"/>
</listheader>
<richlistbox ondblclick="serverRichList.viewSelectedRichListItem();" class="certManagerRichlistBox" id="serverList" flex="1" selected="false"/>
<separator class="thin"/>
<hbox>
- <button id="websites_viewButton"
- data-l10n-id="certmgr-view" oncommand="serverRichList.viewSelectedRichListItem();"/>
- <button id="websites_exportButton"
- data-l10n-id="certmgr-export" oncommand="serverRichList.exportSelectedRichListItem();"/>
<button id="websites_deleteButton"
data-l10n-id="certmgr-delete" oncommand="serverRichList.deleteSelectedRichListItem();"/>
<button id="websites_exceptionButton"
diff --git a/security/manager/ssl/nsCertOverrideService.cpp b/security/manager/ssl/nsCertOverrideService.cpp
--- a/security/manager/ssl/nsCertOverrideService.cpp
+++ b/security/manager/ssl/nsCertOverrideService.cpp
@@ -106,8 +106,8 @@ nsCertOverride::GetAsciiHost(/*out*/ nsA
}
NS_IMETHODIMP
-nsCertOverride::GetDbKey(/*out*/ nsACString& aDBKey) {
- aDBKey = mDBKey;
+nsCertOverride::GetFingerprint(/*out*/ nsACString& aFingerprint) {
+ aFingerprint = mFingerprint;
return NS_OK;
}
@@ -118,12 +118,6 @@ nsCertOverride::GetPort(/*out*/ int32_t*
}
NS_IMETHODIMP
-nsCertOverride::GetIsTemporary(/*out*/ bool* aIsTemporary) {
- *aIsTemporary = mIsTemporary;
- return NS_OK;
-}
-
-NS_IMETHODIMP
nsCertOverride::GetHostPort(/*out*/ nsACString& aHostPort) {
nsCertOverrideService::GetHostWithPort(mAsciiHost, mPort, aHostPort);
return NS_OK;
@@ -274,7 +268,6 @@ void nsCertOverrideService::RemoveAllTem
for (auto iter = mSettingsTable.Iter(); !iter.Done(); iter.Next()) {
nsCertOverrideEntry* entry = iter.Get();
if (entry->mSettings->mIsTemporary) {
- entry->mSettings->mCert = nullptr;
iter.Remove();
}
}
@@ -297,18 +297,11 @@
nsAutoCString buffer;
bool isMore = true;
- /* file format is:
- *
- * host:port:originattributes \t fingerprint-algorithm \t fingerprint \t
- * override-mask \t dbKey
- *
- * where override-mask is a sequence of characters,
- * M meaning hostname-Mismatch-override
- * U meaning Untrusted-override
- * T meaning Time-error-override (expired/not yet valid)
- *
- * if this format isn't respected we move onto the next line in the file.
- */
+ // Each line is of the form:
+ // host:port:originAttributes \t sSHA256OIDString \t fingerprint \t
+ // There may be some "bits" identifiers and "dbKey" after the `fingerprint`
+ // field in 'fingerprint \t \t dbKey' format, but these are now ignored.
+ // Lines that don't match this form are silently dropped.
while (isMore && NS_SUCCEEDED(lineInputStream->ReadLine(buffer, &isMore))) {
if (buffer.IsEmpty() || buffer.First() == '#') {
@@ -350,23 +343,10 @@
fingerprint.Length() == 0) {
continue;
}
- nsDependentCSubstring bitsString;
- if (!parser.ReadUntil(Tokenizer::Token::Whitespace(), bitsString) ||
- bitsString.Length() == 0) {
- continue;
- }
- nsDependentCSubstring dbKey;
- if (!parser.ReadUntil(Tokenizer::Token::EndOfFile(), dbKey) ||
- dbKey.Length() == 0) {
- continue;
- }
- nsCertOverride::OverrideBits bits;
- nsCertOverride::convertStringToBits(bitsString, bits);
AddEntryToList(host, port, attributes,
- nullptr, // don't have the cert
- false, // not temporary
- fingerprint, bits, dbKey, aProofOfLock);
+ false, // not temporary
+ fingerprint, aProofOfLock);
}
return NS_OK;
@@ -412,9 +392,8 @@
output.Append(kTab);
output.Append(settings->mFingerprint);
output.Append(kTab);
- output.Append(bitsString);
- output.Append(kTab);
- output.Append(settings->mDBKey);
+ // the "bits" string used to go here, but it no longer exists
+ // the "\t dbKey" string used to go here, but it no longer exists
output.Append(NS_LINEBREAK);
}
@@ -462,42 +441,16 @@
return NS_ERROR_FAILURE;
}
- nsAutoCString nickname;
- nsresult rv = DefaultServerNicknameForCert(nsscert.get(), nickname);
- if (!aTemporary && NS_SUCCEEDED(rv)) {
- UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
- if (!slot) {
- return NS_ERROR_FAILURE;
- }
-
- // This can fail (for example, if we're in read-only mode). Luckily, we
- // don't even need it to succeed - we always match on the stored hash of the
- // certificate rather than the full certificate. It makes the display a bit
- // less informative (since we won't have a certificate to display), but it's
- // better than failing the entire operation.
- Unused << PK11_ImportCert(slot.get(), nsscert.get(), CK_INVALID_HANDLE,
- nickname.get(), false);
- }
-
nsAutoCString fpStr;
- rv = GetCertSha256Fingerprint(aCert, fpStr);
- if (NS_FAILED(rv)) {
- return rv;
- }
-
- nsAutoCString dbkey;
- rv = aCert->GetDbKey(dbkey);
+ nsresult rv = GetCertSha256Fingerprint(aCert, fpStr);
if (NS_FAILED(rv)) {
return rv;
}
{
MutexAutoLock lock(mMutex);
- AddEntryToList(aHostName, aPort, aOriginAttributes,
- aTemporary ? aCert : nullptr,
- // keep a reference to the cert for temporary overrides
- aTemporary, fpStr,
- (nsCertOverride::OverrideBits)aOverrideBits, dbkey, lock);
+ AddEntryToList(aHostName, aPort, aOriginAttributes, aTemporary, fpStr,
+ lock);
if (!aTemporary) {
Write(lock);
}
@@ -532,10 +485,8 @@
MutexAutoLock lock(mMutex);
AddEntryToList(aHostName, aPort, aOriginAttributes,
- nullptr, // No cert to keep alive
true, // temporary
- aCertFingerprint, (nsCertOverride::OverrideBits)aOverrideBits,
- ""_ns, // dbkey
+ aCertFingerprint,
lock);
return NS_OK;
@@ -632,10 +583,8 @@
nsresult nsCertOverrideService::AddEntryToList(
const nsACString& aHostName, int32_t aPort,
- const OriginAttributes& aOriginAttributes, nsIX509Cert* aCert,
- const bool aIsTemporary, const nsACString& fingerprint,
- nsCertOverride::OverrideBits ob, const nsACString& dbKey,
- const MutexAutoLock& aProofOfLock) {
+ const OriginAttributes& aOriginAttributes, const bool aIsTemporary,
+ const nsACString& fingerprint, const MutexAutoLock& aProofOfLock) {
mMutex.AssertCurrentThreadOwns();
nsAutoCString keyString;
GetKeyString(aHostName, aPort, aOriginAttributes, keyString);
@@ -656,11 +605,6 @@
settings->mOriginAttributes = aOriginAttributes;
settings->mIsTemporary = aIsTemporary;
settings->mFingerprint = fingerprint;
- settings->mOverrideBits = ob;
- settings->mDBKey = dbKey;
- // remove whitespace from stored dbKey for backwards compatibility
- settings->mDBKey.StripWhitespace();
- settings->mCert = aCert;
entry->mSettings = settings;
return NS_OK;
diff --git a/security/manager/ssl/nsCertOverrideService.h b/security/manager/ssl/nsCertOverrideService.h
--- a/security/manager/ssl/nsCertOverrideService.h
+++ b/security/manager/ssl/nsCertOverrideService.h
@@ -43,8 +43,6 @@
bool mIsTemporary; // true: session only, false: stored on disk
nsCString mFingerprint;
OverrideBits mOverrideBits;
- nsCString mDBKey;
- nsCOMPtr<nsIX509Cert> mCert;
static void convertBitsToString(OverrideBits ob, nsACString& str);
static void convertStringToBits(const nsACString& str, OverrideBits& ob);
@@ -145,10 +143,8 @@
nsresult Write(const mozilla::MutexAutoLock& aProofOfLock);
nsresult AddEntryToList(const nsACString& host, int32_t port,
const OriginAttributes& aOriginAttributes,
- nsIX509Cert* aCert, const bool aIsTemporary,
+ const bool aIsTemporary,
const nsACString& fingerprint,
- nsCertOverride::OverrideBits ob,
- const nsACString& dbKey,
const mozilla::MutexAutoLock& aProofOfLock);
// Set in constructor only
diff --git a/security/manager/ssl/SSLServerCertVerification.cpp b/security/manager/ssl/SSLServerCertVerification.cpp
--- a/security/manager/ssl/SSLServerCertVerification.cpp
+++ b/security/manager/ssl/SSLServerCertVerification.cpp
@@ -791,8 +791,8 @@
aHostName, aPort, aOriginAttributes, aCert, &overrideBits,
&isTemporaryOverride, &haveOverride);
if (NS_SUCCEEDED(rv) && haveOverride) {
- // remove the errors that are already overriden
- remainingDisplayErrors &= ~overrideBits;
+ // remove all the errors
+ remainingDisplayErrors = 0;
}
}
diff --git a/security/manager/ssl/nsICertOverrideService.idl b/security/manager/ssl/nsICertOverrideService.idl
--- a/security/manager/ssl/nsICertOverrideService.idl
+++ b/security/manager/ssl/nsICertOverrideService.idl
@@ -33,17 +33,6 @@ interface nsICertOverride : nsISupports
readonly attribute int32_t port;
/**
- * Whether or not the override is only used for this
- * session (true) or stored persistently (false)
- */
- readonly attribute boolean isTemporary;
-
- /**
- * The database key for the associated certificate.
- */
- readonly attribute ACString dbKey;
-
- /**
* A combination of hostname and port in the form host:port.
* Since the port can be -1 which is equivalent to port 433 we use an
* existing function of nsCertOverrideService to create this property.
@@ -51,6 +40,11 @@ interface nsICertOverride : nsISupports
readonly attribute ACString hostPort;
/**
+ * The fingerprint for the associated certificate.
+ */
+ readonly attribute ACString fingerprint;
+
+ /**
* The origin attributes associated with this override.
*/
[implicit_jscontext]
diff --git a/security/manager/ssl/tests/mochitest/browser/browser_certificateManager.js b/security/manager/ssl/tests/mochitest/browser/browser_certificateManager.js
--- a/security/manager/ssl/tests/mochitest/browser/browser_certificateManager.js
+++ b/security/manager/ssl/tests/mochitest/browser/browser_certificateManager.js
@@ -27,9 +27,7 @@ async function checkServerCertificates(w
expectedValues.forEach((item, i) => {
let hostPort = labels[i * 3].value;
- let certString = labels[i * 3 + 1].value || labels[i * 3 + 1].textContent;
- let isTemporaryString =
- labels[i * 3 + 2].value || labels[i * 3 + 2].textContent;
+ let fingerprint = labels[i * 3 + 1].value || labels[i * 3 + 1].textContent;
Assert.equal(
hostPort,
@@ -38,15 +36,9 @@ async function checkServerCertificates(w
);
Assert.equal(
- certString,
- item.certName,
- `Expected override to have field ${item.certName}`
- );
-
- Assert.equal(
- isTemporaryString,
- item.isTemporary ? "Temporary" : "Permanent",
- `Expected override to be ${item.isTemporary ? "Temporary" : "Permanent"}`
+ fingerprint,
+ item.fingerprint,
+ `Expected override to have field ${item.fingerprint}`
);
});
}
@@ -73,41 +73,6 @@
);
}
-async function testViewButton(win) {
- win.document.getElementById("serverList").selectedIndex = 1;
-
- Assert.ok(
- win.document.getElementById("websites_viewButton").disabled,
- "View button should be disabled for override without cert"
- );
-
- win.document.getElementById("serverList").selectedIndex = 0;
-
- Assert.ok(
- !win.document.getElementById("websites_viewButton").disabled,
- "View button should be enabled for override with cert"
- );
-
- let loaded = BrowserTestUtils.waitForNewTab(gBrowser, null, true);
-
- win.document.getElementById("websites_viewButton").click();
-
- let newTab = await loaded;
- let spec = newTab.linkedBrowser.documentURI.spec;
-
- Assert.ok(
- spec.startsWith("about:certificate"),
- "about:certificate should habe been opened"
- );
-
- let newUrl = new URL(spec);
- let certEncoded = newUrl.searchParams.get("cert");
- let certDecoded = decodeURIComponent(certEncoded);
- Assert.ok(certDecoded, "should have some certificate as cert url param");
-
- gBrowser.removeCurrentTab();
-}
-
add_task(async function test_cert_manager_server_tab() {
let win = await openCertManager();
@@ -134,48 +99,13 @@
await checkServerCertificates(win, [
{
hostPort: "example.com:443",
- certName: "md5-ee",
- isTemporary: false,
- },
- ]);
-
- win.document.getElementById("certmanager").acceptDialog();
- await BrowserTestUtils.windowClosed(win);
-
- certOverrideService.rememberTemporaryValidityOverrideUsingFingerprint(
- "example.com",
- 9999,
- {},
- "40:20:3E:57:FB:82:95:0D:3F:62:D7:04:39:F6:32:CC:B2:2F:70:9F:3E:66:C5:35:64:6E:49:2A:F1:02:75:9F",
- Ci.nsICertOverrideService.ERROR_UNTRUSTED
- );
-
- win = await openCertManager();
-
- await checkServerCertificates(win, [
- {
- hostPort: "example.com:443",
- certName: "md5-ee",
- isTemporary: false,
- },
- {
- hostPort: "example.com:9999",
- certName: "(Not Stored)",
- isTemporary: true,
+ fingerprint: cert.sha256Fingerprint,
},
]);
- await testViewButton(win);
-
- await deleteOverride(win, 2);
+ await deleteOverride(win, 1);
- await checkServerCertificates(win, [
- {
- hostPort: "example.com:9999",
- certName: "(Not Stored)",
- isTemporary: true,
- },
- ]);
+ await checkServerCertificates(win, []);
win.document.getElementById("certmanager").acceptDialog();
await BrowserTestUtils.windowClosed(win);
diff --git a/security/manager/ssl/tests/unit/test_cert_override_read.js b/security/manager/ssl/tests/unit/test_cert_override_read.js
--- a/security/manager/ssl/tests/unit/test_cert_override_read.js
+++ b/security/manager/ssl/tests/unit/test_cert_override_read.js
@@ -11,19 +11,16 @@ function run_test() {
let cert1 = {
sha256Fingerprint:
"E9:3A:91:F6:15:11:FB:DD:02:76:DD:45:8C:4B:F4:9B:D1:14:13:91:2E:96:4B:EC:D2:4F:90:D5:F4:BB:29:5C",
- dbKey: "This isn't relevant for this test.",
};
// bad_certs/selfsigned.pem
let cert2 = {
sha256Fingerprint:
"51:BC:41:90:C1:FD:6E:73:18:19:B0:60:08:DD:A3:3D:59:B2:5B:FB:D0:3D:DD:89:19:A5:BB:C6:2B:5A:72:A7",
- dbKey: "This isn't relevant for this test.",
};
// bad_certs/noValidNames.pem
let cert3 = {
sha256Fingerprint:
"C3:A3:61:02:CA:64:CC:EC:45:1D:24:B6:A0:69:DB:DB:F0:D8:58:76:FC:50:36:52:5A:E8:40:4C:55:72:08:F4",
- dbKey: "This isn't relevant for this test.",
};
let profileDir = do_get_profile();
@@ -35,58 +35,42 @@
"# This is a generated file! Do not edit.",
"test.example.com:443:^privateBrowsingId=1\tOID.2.16.840.1.101.3.4.2.1\t" +
cert1.sha256Fingerprint +
- "\tM\t" +
- cert1.dbKey,
+ "\t",
"test.example.com:443:^privateBrowsingId=2\tOID.2.16.840.1.101.3.4.2.1\t" +
cert1.sha256Fingerprint +
+ "\t",
+ "test.example.com:443:^privateBrowsingId=3\tOID.2.16.840.1.101.3.4.2.1\t" + // includes bits and dbKey (now obsolete)
+ cert1.sha256Fingerprint +
"\tM\t" +
- cert1.dbKey,
+ "AAAAAAAAAAAAAAACAAAAFjA5MBQxEjAQBgNVBAMMCWxvY2FsaG9zdA==",
"example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" +
cert2.sha256Fingerprint +
- "\tU\t" +
- cert2.dbKey,
+ "\t",
"[::1]:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // IPv6
cert2.sha256Fingerprint +
- "\tM\t" +
- cert2.dbKey,
+ "\t",
"old.example.com:443\tOID.2.16.840.1.101.3.4.2.1\t" + // missing attributes (defaulted)
cert1.sha256Fingerprint +
- "\tM\t" +
- cert1.dbKey,
+ "\t",
":443:\tOID.2.16.840.1.101.3.4.2.1\t" + // missing host name
cert3.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
+ "\t",
"example.com::\tOID.2.16.840.1.101.3.4.2.1\t" + // missing port
cert3.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
- "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // wrong fingerprint/dbkey
+ "\t",
+ "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // wrong fingerprint
cert2.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
+ "\t",
"example.com:443:\tOID.0.00.000.0.000.0.0.0.0\t" + // bad OID
cert3.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
+ "\t",
"example.com:443:\t.0.0.0.0\t" + // malformed OID
cert3.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
+ "\t",
"example.com:443:\t\t" + // missing OID
cert3.sha256Fingerprint +
- "\tU\t" +
- cert3.dbKey,
- "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // missing fingerprint
- "\tU\t" +
- cert3.dbKey,
- "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // missing override bits
- cert3.sha256Fingerprint +
- "\t\t" +
- cert3.dbKey,
- "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t" + // missing dbkey
- cert3.sha256Fingerprint +
- "\tU\t",
+ "\t",
+ "example.com:443:\tOID.2.16.840.1.101.3.4.2.1\t", // missing fingerprint
];
writeLinesAndClose(lines, outputStream);
let overrideService = Cc["@mozilla.org/security/certoverride;1"].getService(