467317 - nsCertOverrideService::GetAllOverrideHostsWithPorts is unimplemented

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Stuart Morgan]

I'm trying to write the UI for Camino users to see and remove certificate overrides they've set, and ran into a pretty big stumbling block when I discovered this:

NS_IMETHODIMP
nsCertOverrideService::GetAllOverrideHostsWithPorts(PRUint32 *aCount, 
                                                    PRUnichar ***aHostsWithPortsArray)
{
  return NS_ERROR_NOT_IMPLEMENTED;
}

As an embeddor using the 1.9.0 branch, how are we expected to write UI that's a necessary part of making the new cert override system fully usable? So far the only options I'm seeing are:
1) Steal the internal nsCertOverrideService header (which isn't readily available during the build process), cross our fingers and cast the nsICertOverrideService pointer we get to nsCertOverrideService, and use EnumerateCertOverrides
2) Hard-code the name of the cert_override.txt file, assume its format is stable, parse it ourselves on launch to get a list, and update our own duplicate in-memory structure whenever we interact with nsICertOverrideService.

Obviously those are both really bad options; is there a better way to get the list?

Comment 1

[:Gavin Sharp [email: [e-mail]]]

It looks like Firefox exposes it's exceptions using nsICertTree... I don't know whether using the relevant nsITreeView/nsICertTree methods give you enough information to do what you want, but if so it might be a better option than either of the alternatives you listed, despite sitll being rather hacky.

Comment 2

[Stuart Morgan]

Thanks for the pointer; it turns out that we already have a bunch of hacky nsICertTree stuff thanks to bug 306500, so that works out. At least the lack of basic APIs for certs is consistent in what hacky workaround clients are forced to use :P

Comment 3

[:Cykesiopka]

Bug 1085509 removed this method entirely:
https://hg.mozilla.org/mozilla-central/diff/c1d47db66068/security/manager/ssl/src/nsCertOverrideService.cpp

... so marking as "invalid".