Change the handling of the peer certificate in GTlsConnection

Make the certificate and peer-certificate properties virtual, and add
peer-certificate-errors as well. Change the documentation on
peer-certificate to say that it's not set until after the handshake
succeeds (which means notify::peer-certificate can be used to tell
when a handshake has completed).

diff --git a/docs/reference/gio/gio-sections.txt b/docs/reference/gio/gio-sections.txt
index 5b27d50..a9efdd3 100644 (file)
--- a/docs/reference/gio/gio-sections.txt
+++ b/docs/reference/gio/gio-sections.txt
@@ -3059,6 +3059,7 @@ GTlsConnection
 g_tls_connection_set_certificate
 g_tls_connection_get_certificate
 g_tls_connection_get_peer_certificate
+g_tls_connection_get_peer_certificate_errors
 g_tls_connection_set_require_close_notify
 g_tls_connection_get_require_close_notify
 GTlsRehandshakeMode
@@ -3071,7 +3072,6 @@ g_tls_connection_handshake
 g_tls_connection_handshake_async
 g_tls_connection_handshake_finish
 <SUBSECTION>
-g_tls_connection_set_peer_certificate
 g_tls_connection_emit_accept_certificate
 <SUBSECTION Standard>
 GTlsConnectionClass

diff --git a/gio/gio.symbols b/gio/gio.symbols
index 34163ba..b76cc5c 100644 (file)
--- a/gio/gio.symbols
+++ b/gio/gio.symbols
@@ -2040,6 +2040,7 @@ g_tls_certificate_verify
 g_tls_connection_emit_accept_certificate
 g_tls_connection_get_certificate
 g_tls_connection_get_peer_certificate
+g_tls_connection_get_peer_certificate_errors
 g_tls_connection_get_rehandshake_mode
 g_tls_connection_get_require_close_notify
 g_tls_connection_get_use_system_certdb
@@ -2048,7 +2049,6 @@ g_tls_connection_handshake
 g_tls_connection_handshake_async
 g_tls_connection_handshake_finish
 g_tls_connection_set_certificate
-g_tls_connection_set_peer_certificate
 g_tls_connection_set_rehandshake_mode
 g_tls_connection_set_require_close_notify
 g_tls_connection_set_use_system_certdb

diff --git a/gio/gtlsconnection.c b/gio/gtlsconnection.c
index 8f9fbab..a652ac3 100644 (file)
--- a/gio/gtlsconnection.c
+++ b/gio/gtlsconnection.c
@@ -63,12 +63,6 @@ static void g_tls_connection_set_property (GObject      *object,
                                           guint         prop_id,
                                           const GValue *value,
                                           GParamSpec   *pspec);
-static void g_tls_connection_finalize     (GObject      *object);
-
-static gboolean g_tls_connection_certificate_accumulator (GSignalInvocationHint *ihint,
-                                                         GValue                *return_accu,
-                                                         const GValue          *handler_return,
-                                                         gpointer               dummy);
 
 enum {
   ACCEPT_CERTIFICATE,
@@ -85,11 +79,8 @@ enum {
   PROP_REHANDSHAKE_MODE,
   PROP_USE_SYSTEM_CERTDB,
   PROP_CERTIFICATE,
-  PROP_PEER_CERTIFICATE
-};
-
-struct _GTlsConnectionPrivate {
-  GTlsCertificate *certificate, *peer_certificate;
+  PROP_PEER_CERTIFICATE,
+  PROP_PEER_CERTIFICATE_ERRORS
 };
 
 static void
@@ -97,11 +88,8 @@ g_tls_connection_class_init (GTlsConnectionClass *klass)
 {
   GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
 
-  g_type_class_add_private (klass, sizeof (GTlsConnectionPrivate));
-
   gobject_class->get_property = g_tls_connection_get_property;
   gobject_class->set_property = g_tls_connection_set_property;
-  gobject_class->finalize = g_tls_connection_finalize;
 
   /**
    * GTlsConnection:base-io-stream:
@@ -186,8 +174,13 @@ g_tls_connection_class_init (GTlsConnectionClass *klass)
   /**
    * GTlsConnection:peer-certificate:
    *
-   * The connection's peer's certificate, after it has been set during
-   * the TLS handshake.
+   * The connection's peer's certificate, after the TLS handshake has
+   * completed and the certificate has been accepted. Note in
+   * particular that this is not yet set during the emission of
+   * #GTlsConnection::accept-certificate.
+   *
+   * (You can watch for a #GObject::notify signal on this property to
+   * detect when a handshake has occurred.)
    *
    * Since: 2.28
    */
@@ -198,6 +191,26 @@ g_tls_connection_class_init (GTlsConnectionClass *klass)
                                                        G_TYPE_TLS_CERTIFICATE,
                                                        G_PARAM_READABLE |
                                                        G_PARAM_STATIC_STRINGS));
+  /**
+   * GTlsConnection:peer-certificate-errors:
+   *
+   * The errors noticed-and-ignored while verifying
+   * #GTlsConnection:peer-certificate. Normally this should be %0, but
+   * it may not be if #GTlsClientConnection::validation-flags is not
+   * %G_TLS_CERTIFICATE_VALIDATE_ALL, or if
+   * #GTlsConnection::accept-certificate overrode the default
+   * behavior.
+   *
+   * Since: 2.28
+   */
+  g_object_class_install_property (gobject_class, PROP_PEER_CERTIFICATE_ERRORS,
+                                  g_param_spec_flags ("peer-certificate-errors",
+                                                      P_("Peer Certificate Errors"),
+                                                      P_("Errors found with the peer's certificate"),
+                                                      G_TYPE_TLS_CERTIFICATE_FLAGS,
+                                                      0,
+                                                      G_PARAM_READABLE |
+                                                      G_PARAM_STATIC_STRINGS));
 
   /**
    * GTlsConnection::accept-certificate:
@@ -261,20 +274,6 @@ g_tls_connection_class_init (GTlsConnectionClass *klass)
 static void
 g_tls_connection_init (GTlsConnection *conn)
 {
-  conn->priv = G_TYPE_INSTANCE_GET_PRIVATE (conn, G_TYPE_TLS_CONNECTION, GTlsConnectionPrivate);
-}
-
-static void
-g_tls_connection_finalize (GObject *object)
-{
-  GTlsConnection *conn = G_TLS_CONNECTION (object);
-
-  if (conn->priv->certificate)
-    g_object_unref (conn->priv->certificate);
-  if (conn->priv->peer_certificate)
-    g_object_unref (conn->priv->peer_certificate);
-
-  G_OBJECT_CLASS (g_tls_connection_parent_class)->finalize (object);
 }
 
 static void
@@ -283,22 +282,7 @@ g_tls_connection_get_property (GObject    *object,
                               GValue     *value,
                               GParamSpec *pspec)
 {
-  GTlsConnection *conn = G_TLS_CONNECTION (object);
-
-  switch (prop_id)
-    {
-    case PROP_CERTIFICATE:
-      g_value_set_object (value, conn->priv->certificate);
-      break;
-
-    case PROP_PEER_CERTIFICATE:
-      g_value_set_object (value, conn->priv->peer_certificate);
-      break;
-
-    default:
-      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-      break;
-    }
+  G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 }
 
 static void
@@ -307,18 +291,7 @@ g_tls_connection_set_property (GObject      *object,
                               const GValue *value,
                               GParamSpec   *pspec)
 {
-  GTlsConnection *conn = G_TLS_CONNECTION (object);
-
-  switch (prop_id)
-    {
-    case PROP_CERTIFICATE:
-      g_tls_connection_set_certificate (conn, g_value_get_object (value));
-      break;
-
-    default:
-      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-      break;
-    }
+  G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 }
 
 /**
@@ -404,10 +377,7 @@ g_tls_connection_set_certificate (GTlsConnection  *conn,
   g_return_if_fail (G_IS_TLS_CONNECTION (conn));
   g_return_if_fail (G_IS_TLS_CERTIFICATE (certificate));
 
-  if (conn->priv->certificate)
-    g_object_unref (conn->priv->certificate);
-  conn->priv->certificate = certificate ? g_object_ref (certificate) : NULL;
-  g_object_notify (G_OBJECT (conn), "certificate");
+  g_object_set (G_OBJECT (conn), "certificate", certificate, NULL);
 }
 
 /**
@@ -417,35 +387,71 @@ g_tls_connection_set_certificate (GTlsConnection  *conn,
  * Gets @conn's certificate, as set by
  * g_tls_connection_set_certificate().
  *
- * Return value: @conn's certificate, or %NULL
+ * Return value: (transfer none): @conn's certificate, or %NULL
  *
  * Since: 2.28
  */
 GTlsCertificate *
 g_tls_connection_get_certificate (GTlsConnection *conn)
 {
+  GTlsCertificate *certificate;
+
   g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), NULL);
 
-  return conn->priv->certificate;
+  g_object_get (G_OBJECT (conn), "certificate", &certificate, NULL);
+  if (certificate)
+    g_object_unref (certificate);
+
+  return certificate;
 }
 
 /**
  * g_tls_connection_get_peer_certificate:
  * @conn: a #GTlsConnection
  *
- * Gets @conn's peer's certificate after it has been set during the
- * handshake.
+ * Gets @conn's peer's certificate after the handshake has completed.
+ * (It is not set during the emission of
+ * #GTlsConnection::accept-certificate.)
  *
- * Return value: @conn's peer's certificate, or %NULL
+ * Return value: (transfer none): @conn's peer's certificate, or %NULL
  *
  * Since: 2.28
  */
 GTlsCertificate *
 g_tls_connection_get_peer_certificate (GTlsConnection *conn)
 {
+  GTlsCertificate *peer_certificate;
+
   g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), NULL);
 
-  return conn->priv->peer_certificate;
+  g_object_get (G_OBJECT (conn), "peer-certificate", &peer_certificate, NULL);
+  if (peer_certificate)
+    g_object_unref (peer_certificate);
+
+  return peer_certificate;
+}
+
+/**
+ * g_tls_connection_get_peer_certificate_errors:
+ * @conn: a #GTlsConnection
+ *
+ * Gets the errors associated with validating @conn's peer's
+ * certificate, after the handshake has completed. (It is not set
+ * during the emission of #GTlsConnection::accept-certificate.)
+ *
+ * Return value: @conn's peer's certificate errors
+ *
+ * Since: 2.28
+ */
+GTlsCertificateFlags
+g_tls_connection_get_peer_certificate_errors (GTlsConnection *conn)
+{
+  GTlsCertificateFlags errors;
+
+  g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), 0);
+
+  g_object_get (G_OBJECT (conn), "peer-certificate-errors", &errors, NULL);
+  return errors;
 }
 
 /**
@@ -718,23 +724,3 @@ g_tls_connection_emit_accept_certificate (GTlsConnection       *conn,
                 peer_cert, errors, &accept);
   return accept;
 }
-
-/**
- * g_tls_connection_set_peer_certificate:
- * @conn: a #GTlsConnection
- * @certificate: the peer certificate
- *
- * Used by #GTlsConnection implementations to set the connection's
- * peer certificate.
- *
- * Since: 2.28
- */
-void
-g_tls_connection_set_peer_certificate (GTlsConnection  *conn,
-                                      GTlsCertificate *certificate)
-{
-  if (conn->priv->peer_certificate)
-    g_object_unref (conn->priv->peer_certificate);
-  conn->priv->peer_certificate = certificate ? g_object_ref (certificate) : NULL;
-  g_object_notify (G_OBJECT (conn), "peer-certificate");
-}

diff --git a/gio/gtlsconnection.h b/gio/gtlsconnection.h
index 3e549ea..7786c43 100644 (file)
--- a/gio/gtlsconnection.h
+++ b/gio/gtlsconnection.h
@@ -81,38 +81,39 @@ struct _GTlsConnectionClass
   gpointer padding[8];
 };
 
-GType                g_tls_connection_get_type                 (void) G_GNUC_CONST;
+GType                 g_tls_connection_get_type                    (void) G_GNUC_CONST;
 
-void                 g_tls_connection_set_use_system_certdb    (GTlsConnection       *conn,
-                                                               gboolean              use_system_certdb);
-gboolean             g_tls_connection_get_use_system_certdb    (GTlsConnection       *conn);
+void                  g_tls_connection_set_use_system_certdb       (GTlsConnection       *conn,
+                                                                   gboolean              use_system_certdb);
+gboolean              g_tls_connection_get_use_system_certdb       (GTlsConnection       *conn);
 
-void                 g_tls_connection_set_certificate          (GTlsConnection       *conn,
-                                                               GTlsCertificate      *certificate);
-GTlsCertificate     *g_tls_connection_get_certificate          (GTlsConnection       *conn);
+void                  g_tls_connection_set_certificate             (GTlsConnection       *conn,
+                                                                   GTlsCertificate      *certificate);
+GTlsCertificate      *g_tls_connection_get_certificate             (GTlsConnection       *conn);
 
-GTlsCertificate     *g_tls_connection_get_peer_certificate     (GTlsConnection       *conn);
+GTlsCertificate      *g_tls_connection_get_peer_certificate        (GTlsConnection       *conn);
+GTlsCertificateFlags  g_tls_connection_get_peer_certificate_errors (GTlsConnection       *conn);
 
-void                 g_tls_connection_set_require_close_notify (GTlsConnection       *conn,
-                                                               gboolean              require_close_notify);
-gboolean             g_tls_connection_get_require_close_notify (GTlsConnection       *conn);
+void                  g_tls_connection_set_require_close_notify    (GTlsConnection       *conn,
+                                                                   gboolean              require_close_notify);
+gboolean              g_tls_connection_get_require_close_notify    (GTlsConnection       *conn);
 
-void                 g_tls_connection_set_rehandshake_mode     (GTlsConnection       *conn,
-                                                               GTlsRehandshakeMode   mode);
-GTlsRehandshakeMode  g_tls_connection_get_rehandshake_mode     (GTlsConnection       *conn);
+void                  g_tls_connection_set_rehandshake_mode        (GTlsConnection       *conn,
+                                                                   GTlsRehandshakeMode   mode);
+GTlsRehandshakeMode   g_tls_connection_get_rehandshake_mode        (GTlsConnection       *conn);
 
-gboolean             g_tls_connection_handshake                (GTlsConnection       *conn,
-                                                               GCancellable         *cancellable,
-                                                               GError              **error);
+gboolean              g_tls_connection_handshake                   (GTlsConnection       *conn,
+                                                                   GCancellable         *cancellable,
+                                                                   GError              **error);
 
-void                 g_tls_connection_handshake_async          (GTlsConnection       *conn,
-                                                               int                   io_priority,
-                                                               GCancellable         *cancellable,
-                                                               GAsyncReadyCallback   callback,
-                                                               gpointer              user_data);
-gboolean             g_tls_connection_handshake_finish         (GTlsConnection       *conn,
-                                                               GAsyncResult         *result,
-                                                               GError              **error);
+void                  g_tls_connection_handshake_async             (GTlsConnection       *conn,
+                                                                   int                   io_priority,
+                                                                   GCancellable         *cancellable,
+                                                                   GAsyncReadyCallback   callback,
+                                                                   gpointer              user_data);
+gboolean              g_tls_connection_handshake_finish            (GTlsConnection       *conn,
+                                                                   GAsyncResult         *result,
+                                                                   GError              **error);
 
 /**
  * G_TLS_ERROR:
@@ -126,12 +127,9 @@ GQuark g_tls_error_quark (void);
 
 
 /*< protected >*/
-gboolean             g_tls_connection_emit_accept_certificate  (GTlsConnection       *conn,
-                                                               GTlsCertificate      *peer_cert,
-                                                               GTlsCertificateFlags  errors);
-
-void                 g_tls_connection_set_peer_certificate     (GTlsConnection       *conn,
-                                                               GTlsCertificate      *certificate);
+gboolean              g_tls_connection_emit_accept_certificate     (GTlsConnection       *conn,
+                                                                   GTlsCertificate      *peer_cert,
+                                                                   GTlsCertificateFlags  errors);
 
 G_END_DECLS