From: Dan Winship Date: Tue, 7 Dec 2010 13:58:42 +0000 (+0100) Subject: Change the handling of the peer certificate in GTlsConnection X-Git-Tag: 2.27.5~47 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f5c3e0d3d5aeed065fd09293dae6574b4a31568c;p=platform%2Fupstream%2Fglib.git Change the handling of the peer certificate in GTlsConnection Make the certificate and peer-certificate properties virtual, and add peer-certificate-errors as well. Change the documentation on peer-certificate to say that it's not set until after the handshake succeeds (which means notify::peer-certificate can be used to tell when a handshake has completed). --- diff --git a/docs/reference/gio/gio-sections.txt b/docs/reference/gio/gio-sections.txt index 5b27d50..a9efdd3 100644 --- a/docs/reference/gio/gio-sections.txt +++ b/docs/reference/gio/gio-sections.txt @@ -3059,6 +3059,7 @@ GTlsConnection g_tls_connection_set_certificate g_tls_connection_get_certificate g_tls_connection_get_peer_certificate +g_tls_connection_get_peer_certificate_errors g_tls_connection_set_require_close_notify g_tls_connection_get_require_close_notify GTlsRehandshakeMode @@ -3071,7 +3072,6 @@ g_tls_connection_handshake g_tls_connection_handshake_async g_tls_connection_handshake_finish -g_tls_connection_set_peer_certificate g_tls_connection_emit_accept_certificate GTlsConnectionClass diff --git a/gio/gio.symbols b/gio/gio.symbols index 34163ba..b76cc5c 100644 --- a/gio/gio.symbols +++ b/gio/gio.symbols @@ -2040,6 +2040,7 @@ g_tls_certificate_verify g_tls_connection_emit_accept_certificate g_tls_connection_get_certificate g_tls_connection_get_peer_certificate +g_tls_connection_get_peer_certificate_errors g_tls_connection_get_rehandshake_mode g_tls_connection_get_require_close_notify g_tls_connection_get_use_system_certdb @@ -2048,7 +2049,6 @@ g_tls_connection_handshake g_tls_connection_handshake_async g_tls_connection_handshake_finish g_tls_connection_set_certificate -g_tls_connection_set_peer_certificate g_tls_connection_set_rehandshake_mode g_tls_connection_set_require_close_notify g_tls_connection_set_use_system_certdb diff --git a/gio/gtlsconnection.c b/gio/gtlsconnection.c index 8f9fbab..a652ac3 100644 --- a/gio/gtlsconnection.c +++ b/gio/gtlsconnection.c @@ -63,12 +63,6 @@ static void g_tls_connection_set_property (GObject *object, guint prop_id, const GValue *value, GParamSpec *pspec); -static void g_tls_connection_finalize (GObject *object); - -static gboolean g_tls_connection_certificate_accumulator (GSignalInvocationHint *ihint, - GValue *return_accu, - const GValue *handler_return, - gpointer dummy); enum { ACCEPT_CERTIFICATE, @@ -85,11 +79,8 @@ enum { PROP_REHANDSHAKE_MODE, PROP_USE_SYSTEM_CERTDB, PROP_CERTIFICATE, - PROP_PEER_CERTIFICATE -}; - -struct _GTlsConnectionPrivate { - GTlsCertificate *certificate, *peer_certificate; + PROP_PEER_CERTIFICATE, + PROP_PEER_CERTIFICATE_ERRORS }; static void @@ -97,11 +88,8 @@ g_tls_connection_class_init (GTlsConnectionClass *klass) { GObjectClass *gobject_class = G_OBJECT_CLASS (klass); - g_type_class_add_private (klass, sizeof (GTlsConnectionPrivate)); - gobject_class->get_property = g_tls_connection_get_property; gobject_class->set_property = g_tls_connection_set_property; - gobject_class->finalize = g_tls_connection_finalize; /** * GTlsConnection:base-io-stream: @@ -186,8 +174,13 @@ g_tls_connection_class_init (GTlsConnectionClass *klass) /** * GTlsConnection:peer-certificate: * - * The connection's peer's certificate, after it has been set during - * the TLS handshake. + * The connection's peer's certificate, after the TLS handshake has + * completed and the certificate has been accepted. Note in + * particular that this is not yet set during the emission of + * #GTlsConnection::accept-certificate. + * + * (You can watch for a #GObject::notify signal on this property to + * detect when a handshake has occurred.) * * Since: 2.28 */ @@ -198,6 +191,26 @@ g_tls_connection_class_init (GTlsConnectionClass *klass) G_TYPE_TLS_CERTIFICATE, G_PARAM_READABLE | G_PARAM_STATIC_STRINGS)); + /** + * GTlsConnection:peer-certificate-errors: + * + * The errors noticed-and-ignored while verifying + * #GTlsConnection:peer-certificate. Normally this should be %0, but + * it may not be if #GTlsClientConnection::validation-flags is not + * %G_TLS_CERTIFICATE_VALIDATE_ALL, or if + * #GTlsConnection::accept-certificate overrode the default + * behavior. + * + * Since: 2.28 + */ + g_object_class_install_property (gobject_class, PROP_PEER_CERTIFICATE_ERRORS, + g_param_spec_flags ("peer-certificate-errors", + P_("Peer Certificate Errors"), + P_("Errors found with the peer's certificate"), + G_TYPE_TLS_CERTIFICATE_FLAGS, + 0, + G_PARAM_READABLE | + G_PARAM_STATIC_STRINGS)); /** * GTlsConnection::accept-certificate: @@ -261,20 +274,6 @@ g_tls_connection_class_init (GTlsConnectionClass *klass) static void g_tls_connection_init (GTlsConnection *conn) { - conn->priv = G_TYPE_INSTANCE_GET_PRIVATE (conn, G_TYPE_TLS_CONNECTION, GTlsConnectionPrivate); -} - -static void -g_tls_connection_finalize (GObject *object) -{ - GTlsConnection *conn = G_TLS_CONNECTION (object); - - if (conn->priv->certificate) - g_object_unref (conn->priv->certificate); - if (conn->priv->peer_certificate) - g_object_unref (conn->priv->peer_certificate); - - G_OBJECT_CLASS (g_tls_connection_parent_class)->finalize (object); } static void @@ -283,22 +282,7 @@ g_tls_connection_get_property (GObject *object, GValue *value, GParamSpec *pspec) { - GTlsConnection *conn = G_TLS_CONNECTION (object); - - switch (prop_id) - { - case PROP_CERTIFICATE: - g_value_set_object (value, conn->priv->certificate); - break; - - case PROP_PEER_CERTIFICATE: - g_value_set_object (value, conn->priv->peer_certificate); - break; - - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; - } + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); } static void @@ -307,18 +291,7 @@ g_tls_connection_set_property (GObject *object, const GValue *value, GParamSpec *pspec) { - GTlsConnection *conn = G_TLS_CONNECTION (object); - - switch (prop_id) - { - case PROP_CERTIFICATE: - g_tls_connection_set_certificate (conn, g_value_get_object (value)); - break; - - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; - } + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); } /** @@ -404,10 +377,7 @@ g_tls_connection_set_certificate (GTlsConnection *conn, g_return_if_fail (G_IS_TLS_CONNECTION (conn)); g_return_if_fail (G_IS_TLS_CERTIFICATE (certificate)); - if (conn->priv->certificate) - g_object_unref (conn->priv->certificate); - conn->priv->certificate = certificate ? g_object_ref (certificate) : NULL; - g_object_notify (G_OBJECT (conn), "certificate"); + g_object_set (G_OBJECT (conn), "certificate", certificate, NULL); } /** @@ -417,35 +387,71 @@ g_tls_connection_set_certificate (GTlsConnection *conn, * Gets @conn's certificate, as set by * g_tls_connection_set_certificate(). * - * Return value: @conn's certificate, or %NULL + * Return value: (transfer none): @conn's certificate, or %NULL * * Since: 2.28 */ GTlsCertificate * g_tls_connection_get_certificate (GTlsConnection *conn) { + GTlsCertificate *certificate; + g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), NULL); - return conn->priv->certificate; + g_object_get (G_OBJECT (conn), "certificate", &certificate, NULL); + if (certificate) + g_object_unref (certificate); + + return certificate; } /** * g_tls_connection_get_peer_certificate: * @conn: a #GTlsConnection * - * Gets @conn's peer's certificate after it has been set during the - * handshake. + * Gets @conn's peer's certificate after the handshake has completed. + * (It is not set during the emission of + * #GTlsConnection::accept-certificate.) * - * Return value: @conn's peer's certificate, or %NULL + * Return value: (transfer none): @conn's peer's certificate, or %NULL * * Since: 2.28 */ GTlsCertificate * g_tls_connection_get_peer_certificate (GTlsConnection *conn) { + GTlsCertificate *peer_certificate; + g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), NULL); - return conn->priv->peer_certificate; + g_object_get (G_OBJECT (conn), "peer-certificate", &peer_certificate, NULL); + if (peer_certificate) + g_object_unref (peer_certificate); + + return peer_certificate; +} + +/** + * g_tls_connection_get_peer_certificate_errors: + * @conn: a #GTlsConnection + * + * Gets the errors associated with validating @conn's peer's + * certificate, after the handshake has completed. (It is not set + * during the emission of #GTlsConnection::accept-certificate.) + * + * Return value: @conn's peer's certificate errors + * + * Since: 2.28 + */ +GTlsCertificateFlags +g_tls_connection_get_peer_certificate_errors (GTlsConnection *conn) +{ + GTlsCertificateFlags errors; + + g_return_val_if_fail (G_IS_TLS_CONNECTION (conn), 0); + + g_object_get (G_OBJECT (conn), "peer-certificate-errors", &errors, NULL); + return errors; } /** @@ -718,23 +724,3 @@ g_tls_connection_emit_accept_certificate (GTlsConnection *conn, peer_cert, errors, &accept); return accept; } - -/** - * g_tls_connection_set_peer_certificate: - * @conn: a #GTlsConnection - * @certificate: the peer certificate - * - * Used by #GTlsConnection implementations to set the connection's - * peer certificate. - * - * Since: 2.28 - */ -void -g_tls_connection_set_peer_certificate (GTlsConnection *conn, - GTlsCertificate *certificate) -{ - if (conn->priv->peer_certificate) - g_object_unref (conn->priv->peer_certificate); - conn->priv->peer_certificate = certificate ? g_object_ref (certificate) : NULL; - g_object_notify (G_OBJECT (conn), "peer-certificate"); -} diff --git a/gio/gtlsconnection.h b/gio/gtlsconnection.h index 3e549ea..7786c43 100644 --- a/gio/gtlsconnection.h +++ b/gio/gtlsconnection.h @@ -81,38 +81,39 @@ struct _GTlsConnectionClass gpointer padding[8]; }; -GType g_tls_connection_get_type (void) G_GNUC_CONST; +GType g_tls_connection_get_type (void) G_GNUC_CONST; -void g_tls_connection_set_use_system_certdb (GTlsConnection *conn, - gboolean use_system_certdb); -gboolean g_tls_connection_get_use_system_certdb (GTlsConnection *conn); +void g_tls_connection_set_use_system_certdb (GTlsConnection *conn, + gboolean use_system_certdb); +gboolean g_tls_connection_get_use_system_certdb (GTlsConnection *conn); -void g_tls_connection_set_certificate (GTlsConnection *conn, - GTlsCertificate *certificate); -GTlsCertificate *g_tls_connection_get_certificate (GTlsConnection *conn); +void g_tls_connection_set_certificate (GTlsConnection *conn, + GTlsCertificate *certificate); +GTlsCertificate *g_tls_connection_get_certificate (GTlsConnection *conn); -GTlsCertificate *g_tls_connection_get_peer_certificate (GTlsConnection *conn); +GTlsCertificate *g_tls_connection_get_peer_certificate (GTlsConnection *conn); +GTlsCertificateFlags g_tls_connection_get_peer_certificate_errors (GTlsConnection *conn); -void g_tls_connection_set_require_close_notify (GTlsConnection *conn, - gboolean require_close_notify); -gboolean g_tls_connection_get_require_close_notify (GTlsConnection *conn); +void g_tls_connection_set_require_close_notify (GTlsConnection *conn, + gboolean require_close_notify); +gboolean g_tls_connection_get_require_close_notify (GTlsConnection *conn); -void g_tls_connection_set_rehandshake_mode (GTlsConnection *conn, - GTlsRehandshakeMode mode); -GTlsRehandshakeMode g_tls_connection_get_rehandshake_mode (GTlsConnection *conn); +void g_tls_connection_set_rehandshake_mode (GTlsConnection *conn, + GTlsRehandshakeMode mode); +GTlsRehandshakeMode g_tls_connection_get_rehandshake_mode (GTlsConnection *conn); -gboolean g_tls_connection_handshake (GTlsConnection *conn, - GCancellable *cancellable, - GError **error); +gboolean g_tls_connection_handshake (GTlsConnection *conn, + GCancellable *cancellable, + GError **error); -void g_tls_connection_handshake_async (GTlsConnection *conn, - int io_priority, - GCancellable *cancellable, - GAsyncReadyCallback callback, - gpointer user_data); -gboolean g_tls_connection_handshake_finish (GTlsConnection *conn, - GAsyncResult *result, - GError **error); +void g_tls_connection_handshake_async (GTlsConnection *conn, + int io_priority, + GCancellable *cancellable, + GAsyncReadyCallback callback, + gpointer user_data); +gboolean g_tls_connection_handshake_finish (GTlsConnection *conn, + GAsyncResult *result, + GError **error); /** * G_TLS_ERROR: @@ -126,12 +127,9 @@ GQuark g_tls_error_quark (void); /*< protected >*/ -gboolean g_tls_connection_emit_accept_certificate (GTlsConnection *conn, - GTlsCertificate *peer_cert, - GTlsCertificateFlags errors); - -void g_tls_connection_set_peer_certificate (GTlsConnection *conn, - GTlsCertificate *certificate); +gboolean g_tls_connection_emit_accept_certificate (GTlsConnection *conn, + GTlsCertificate *peer_cert, + GTlsCertificateFlags errors); G_END_DECLS