![]() |
![]() |
![]() |
GIO Reference Manual | ![]() |
---|---|---|---|---|
Top | Description | Object Hierarchy | Known Derived Interfaces | Properties | Signals |
#include <gio/gio.h> GTlsConnection; void g_tls_connection_set_certificate (GTlsConnection *conn
,GTlsCertificate *certificate
); GTlsCertificate * g_tls_connection_get_certificate (GTlsConnection *conn
); GTlsCertificate * g_tls_connection_get_peer_certificate (GTlsConnection *conn
); void g_tls_connection_set_require_close_notify (GTlsConnection *conn
,gboolean require_close_notify
); gboolean g_tls_connection_get_require_close_notify (GTlsConnection *conn
); enum GTlsRehandshakeMode; void g_tls_connection_set_rehandshake_mode (GTlsConnection *conn
,GTlsRehandshakeMode mode
); GTlsRehandshakeMode g_tls_connection_get_rehandshake_mode (GTlsConnection *conn
); gboolean g_tls_connection_handshake (GTlsConnection *conn
,GCancellable *cancellable
,GError **error
); void g_tls_connection_handshake_async (GTlsConnection *conn
,int io_priority
,GCancellable *cancellable
,GAsyncReadyCallback callback
,gpointer user_data
); gboolean g_tls_connection_handshake_finish (GTlsConnection *conn
,GAsyncResult *result
,GError **error
); void g_tls_connection_set_peer_certificate (GTlsConnection *conn
,GTlsCertificate *certificate
); gboolean g_tls_connection_emit_accept_certificate (GTlsConnection *conn
,GTlsCertificate *peer_cert
,GTlsCertificateFlags errors
); GTlsCertificate * g_tls_connection_emit_need_certificate (GTlsConnection *conn
);
GTlsConnection is required by GTlsClientConnection and GTlsServerConnection.
"base-io-stream" GIOStream* : Read / Write / Construct Only "certificate" GTlsCertificate* : Read / Write "peer-certificate" GTlsCertificate* : Read "rehandshake-mode" GTlsRehandshakeMode : Read / Write "require-close-notify" gboolean : Read / Write
GTlsConnection is the base TLS connection class type, which wraps a GIOStream and provides TLS encryption on top of it. Its subclasses, GTlsClientConnection and GTlsServerConnection, implement client-side and server-side TLS, respectively.
typedef struct _GTlsConnection GTlsConnection;
TLS connection. This is an abstract type that will be subclassed by a TLS-library-specific subtype.
Since 2.28
void g_tls_connection_set_certificate (GTlsConnection *conn
,GTlsCertificate *certificate
);
This sets the certificate that conn
will present to its peer
during the TLS handshake. If this is not set,
"need-certificate" will be emitted during the
handshake if needed.
|
a GTlsConnection |
|
the certificate to use for conn
|
Since 2.28
GTlsCertificate * g_tls_connection_get_certificate (GTlsConnection *conn
);
Gets conn
's certificate, as set by
g_tls_connection_set_certificate()
or returned from one of the
signals.
|
a GTlsConnection |
Returns : |
conn 's certificate, or NULL
|
Since 2.28
GTlsCertificate * g_tls_connection_get_peer_certificate
(GTlsConnection *conn
);
Gets conn
's peer's certificate after it has been set during the
handshake.
|
a GTlsConnection |
Returns : |
conn 's peer's certificate, or NULL
|
Since 2.28
void g_tls_connection_set_require_close_notify (GTlsConnection *conn
,gboolean require_close_notify
);
Sets whether or not conn
requires a proper TLS close notification
before closing the connection. If this is TRUE
(the default), then
calling g_io_stream_close()
on conn
will send a TLS close
notification, and likewise it will expect to receive a close
notification before the connection is closed when reading, and will
return a G_TLS_ERROR_EOF
error if the connection is closed without
proper notification (since this may indicate a network error, or
man-in-the-middle attack).
In some protocols, the application will know whether or not the
connection was closed cleanly based on application-level data
(because the application-level data includes a length field, or is
somehow self-delimiting); in this case, the close notify is
redundant and sometimes omitted. (TLS 1.1 explicitly allows this;
in TLS 1.0 it is technically an error, but often done anyway.) You
can use g_tls_connection_set_require_close_notify()
to tell conn
to
allow an "unannounced" connection close, in which case it is up to
the application to check that the data has been fully received.
|
a GTlsConnection |
|
whether or not to require close notification |
Since 2.28
gboolean g_tls_connection_get_require_close_notify
(GTlsConnection *conn
);
Tests whether or not conn
requires a proper TLS close notification
before closing the connection. See
g_tls_connection_set_require_close_notify()
for details.
|
a GTlsConnection |
Returns : |
TRUE if conn requires a proper TLS close
notification.
|
Since 2.28
typedef enum { G_TLS_REHANDSHAKE_NEVER, G_TLS_REHANDSHAKE_SAFELY, G_TLS_REHANDSHAKE_UNSAFELY } GTlsRehandshakeMode;
When to allow rehandshaking. See
g_tls_connection_set_rehandshake_mode()
.
Never allow rehandshaking | |
Allow safe rehandshaking only | |
Allow unsafe rehandshaking |
Since 2.28
void g_tls_connection_set_rehandshake_mode (GTlsConnection *conn
,GTlsRehandshakeMode mode
);
Sets how conn
behaves with respect to rehandshaking requests.
G_TLS_REHANDSHAKE_NEVER
means that it will never agree to
rehandshake after the initial handshake is complete. (For a client,
this means it will refuse rehandshake requests from the server, and
for a server, this means it will close the connection with an error
if the client attempts to rehandshake.)
G_TLS_REHANDSHAKE_SAFELY
means that the connection will allow a
rehandshake only if the other end of the connection supports the
TLS renegotiation_info
extension. This is the
default behavior, but means that rehandshaking will not work
against older implementations that do not support that extension.
G_TLS_REHANDSHAKE_UNSAFELY
means that the connection will allow
rehandshaking even without the
renegotiation_info
extension. On the server side
in particular, this is not recommended, since it leaves the server
open to certain attacks. However, this mode is necessary if you
need to allow renegotiation with older client software.
|
a GTlsConnection |
|
the rehandshaking mode |
Since 2.28
GTlsRehandshakeMode g_tls_connection_get_rehandshake_mode
(GTlsConnection *conn
);
Gets conn
rehandshaking mode. See
g_tls_connection_set_rehandshake()
for details.
|
a GTlsConnection |
Returns : |
conn 's rehandshaking mode
|
Since 2.28
gboolean g_tls_connection_handshake (GTlsConnection *conn
,GCancellable *cancellable
,GError **error
);
Attempts a TLS handshake on conn
.
On the client side, it is never necessary to call this method;
although the connection needs to perform a handshake after
connecting (or after sending a "STARTTLS"-type command) and may
need to rehandshake later if the server requests it,
GTlsConnection will handle this for you automatically when you try
to send or receive data on the connection. However, you can call
g_tls_connection_handshake()
manually if you want to know for sure
whether the initial handshake succeeded or failed (as opposed to
just immediately trying to write to conn
's output stream, in which
case if it fails, it may not be possible to tell if it failed
before or after completing the handshake).
Likewise, on the server side, although a handshake is necessary at
the beginning of the communication, you do not need to call this
function explicitly unless you want clearer error reporting.
However, you may call g_tls_connection_handshake()
later on to
renegotiate parameters (encryption methods, etc) with the client.
"accept_certificate" and "need_certificate" may be emitted during the handshake.
|
a GTlsConnection |
|
a GCancellable, or NULL
|
|
a GError, or NULL
|
Returns : |
success or failure |
Since 2.28
void g_tls_connection_handshake_async (GTlsConnection *conn
,int io_priority
,GCancellable *cancellable
,GAsyncReadyCallback callback
,gpointer user_data
);
Asynchronously performs a TLS handshake on conn
. See
g_tls_connection_handshake()
for more information.
|
a GTlsConnection |
|
the I/O priority of the request. |
|
a GCancellable, or NULL
|
|
callback to call when the handshake is complete |
|
the data to pass to the callback function |
Since 2.28
gboolean g_tls_connection_handshake_finish (GTlsConnection *conn
,GAsyncResult *result
,GError **error
);
Finish an asynchronous TLS handshake operation. See
g_tls_connection_handshake()
for more information.
|
a GTlsConnection |
|
a GAsyncResult. |
|
a GError pointer, or NULL
|
Returns : |
TRUE on success, FALSE on failure, in which
case error will be set.
|
Since 2.28
void g_tls_connection_set_peer_certificate (GTlsConnection *conn
,GTlsCertificate *certificate
);
Used by GTlsConnection implementations to set the connection's peer certificate.
|
a GTlsConnection |
|
the peer certificate |
Since 2.28
gboolean g_tls_connection_emit_accept_certificate (GTlsConnection *conn
,GTlsCertificate *peer_cert
,GTlsCertificateFlags errors
);
Used by GTlsConnection implementations to emit the "accept-certificate" signal.
|
a GTlsConnection |
|
the peer's GTlsCertificate |
|
the problems with peer_cert
|
Returns : |
TRUE if one of the signal handlers has returned
TRUE to accept peer_cert
|
Since 2.28
GTlsCertificate * g_tls_connection_emit_need_certificate
(GTlsConnection *conn
);
Used by GTlsConnection implementations to emit the "need-certificate" signal.
|
a GTlsConnection |
Returns : |
a new GTlsCertificate |
Since 2.28
"base-io-stream"
property"base-io-stream" GIOStream* : Read / Write / Construct Only
The GIOStream that the connection wraps
Since 2.28
"certificate"
property"certificate" GTlsCertificate* : Read / Write
The connection's certificate; see
g_tls_connection_set_certificate()
.
Since 2.28
"peer-certificate"
property"peer-certificate" GTlsCertificate* : Read
The connection's peer's certificate, after it has been set during the TLS handshake.
Since 2.28
"rehandshake-mode"
property"rehandshake-mode" GTlsRehandshakeMode : Read / Write
The rehandshaking mode. See
g_tls_connection_set_rehandshake_mode()
.
Default value: G_TLS_REHANDSHAKE_SAFELY
Since 2.28
"require-close-notify"
property"require-close-notify" gboolean : Read / Write
Whether or not proper TLS close notification is required.
See g_tls_connection_set_require_close_notify()
.
Default value: TRUE
Since 2.28
"accept-certificate"
signalgboolean user_function (GTlsConnection *conn, GTlsCertificate *peer_cert, GTlsCertificateFlags errors, gpointer user_data) : Run Last
Emitted during the TLS handshake after the peer certificate has
been received. You can examine peer_cert
's certification path by
calling g_tls_certificate_get_issuer()
on it.
For a client-side connection, peer_cert
is the server's
certificate, and the signal will only be emitted if the
certificate was not acceptable according to conn
's
"validation_flags". If you would like the
certificate to be accepted despite errors
, return TRUE
from the
signal handler. Otherwise, if no handler accepts the certificate,
the handshake will fail with G_TLS_ERROR_BAD_CERTIFICATE
.
For a server-side connection, peer_cert
is the certificate
presented by the client, if this was requested via the server's
"authentication_mode". On the server side,
the signal is always emitted when the client presents a
certificate, and the certificate will only be accepted if a
handler returns TRUE
.
As with "need_certificate", you should not interact with the user during the signal emission if the signal was emitted as part of an asynchronous operation in the main thread.
|
a GTlsConnection |
|
the peer's GTlsCertificate |
|
the problems with peer_cert .
|
|
user data set when the signal handler was connected. |
Returns : |
TRUE to accept peer_cert (which will also
immediately end the signal emission). FALSE to allow the signal
emission to continue, which will cause the handshake to fail if
no one else overrides it.
|
Since 2.28
"need-certificate"
signalGTlsCertificate* user_function (GTlsConnection *conn, gpointer user_data) : Run Last
Emitted during the TLS handshake if a certificate is needed and
one has not been set via g_tls_connection_set_certificate()
.
For server-side connections, a certificate is always needed, and the connection will fail if none is provided.
For client-side connections, the signal will be emitted only if
the server has requested a certificate; you can call
g_tls_client_connection_get_accepted_cas()
to get a list of
Certificate Authorities that the server will accept certificates
from. If you do not return a certificate (and have not provided
one via g_tls_connection_set_certificate()
) then the server may
reject the handshake, in which case the operation will eventually
fail with G_TLS_ERROR_CERTIFICATE_REQUIRED
.
Note that if this signal is emitted as part of asynchronous I/O
in the main thread, then you should not attempt to interact with
the user before returning from the signal handler. If you want to
let the user choose a certificate to return, you would have to
return NULL
from the signal handler on the first attempt, and
then after the connection attempt returns a
G_TLS_ERROR_CERTIFICATE_REQUIRED
, you can interact with the
user, create a new connection, and call
g_tls_connection_set_certificate()
on it before handshaking (or
just connect to the signal again and return the certificate the
next time).
If you are doing I/O in another thread, you do not need to worry about this, and can simply block in the signal handler until the UI thread returns an answer.
|
a GTlsConnection |
|
user data set when the signal handler was connected. |
Returns : |
the certificate to send to the peer, or NULL to
send no certificate. If you return a certificate, the signal
emission will be stopped and further handlers will not be called.
|
Since 2.28