gio/auto/

tls_connection.rs

// This file was generated by gir (https://github.com/gtk-rs/gir)
// from gir-files (https://github.com/gtk-rs/gir-files)
// DO NOT EDIT
#![allow(deprecated)]

#[cfg(feature = "v2_70")]
#[cfg_attr(docsrs, doc(cfg(feature = "v2_70")))]
use crate::TlsProtocolVersion;
use crate::{
    AsyncResult, Cancellable, IOStream, TlsCertificate, TlsCertificateFlags, TlsDatabase,
    TlsInteraction, TlsRehandshakeMode, ffi,
};
use glib::{
    object::ObjectType as _,
    prelude::*,
    signal::{SignalHandlerId, connect_raw},
    translate::*,
};
use std::{boxed::Box as Box_, pin::Pin};

glib::wrapper! {
    /// `GTlsConnection` is the base TLS connection class type, which wraps
    /// a [`IOStream`][crate::IOStream] and provides TLS encryption on top of it. Its
    /// subclasses, [`TlsClientConnection`][crate::TlsClientConnection] and
    /// [`TlsServerConnection`][crate::TlsServerConnection], implement client-side and server-side TLS,
    /// respectively.
    ///
    /// For DTLS (Datagram TLS) support, see [`DtlsConnection`][crate::DtlsConnection].
    ///
    /// This is an Abstract Base Class, you cannot instantiate it.
    ///
    /// ## Properties
    ///
    ///
    /// #### `advertised-protocols`
    ///  The list of application-layer protocols that the connection
    /// advertises that it is willing to speak. See
    /// g_tls_connection_set_advertised_protocols().
    ///
    /// Readable | Writeable
    ///
    ///
    /// #### `base-io-stream`
    ///  The #GIOStream that the connection wraps. The connection holds a reference
    /// to this stream, and may run operations on the stream from other threads
    /// throughout its lifetime. Consequently, after the #GIOStream has been
    /// constructed, application code may only run its own operations on this
    /// stream when no #GIOStream operations are running.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `certificate`
    ///  The connection's certificate; see
    /// g_tls_connection_set_certificate().
    ///
    /// Readable | Writeable
    ///
    ///
    /// #### `ciphersuite-name`
    ///  The name of the TLS ciphersuite in use. See g_tls_connection_get_ciphersuite_name().
    ///
    /// Readable
    ///
    ///
    /// #### `database`
    ///  The certificate database to use when verifying this TLS connection.
    /// If no certificate database is set, then the default database will be
    /// used. See g_tls_backend_get_default_database().
    ///
    /// When using a non-default database, #GTlsConnection must fall back to using
    /// the #GTlsDatabase to perform certificate verification using
    /// g_tls_database_verify_chain(), which means certificate verification will
    /// not be able to make use of TLS session context. This may be less secure.
    /// For example, if you create your own #GTlsDatabase that just wraps the
    /// default #GTlsDatabase, you might expect that you have not changed anything,
    /// but this is not true because you may have altered the behavior of
    /// #GTlsConnection by causing it to use g_tls_database_verify_chain(). See the
    /// documentation of g_tls_database_verify_chain() for more details on specific
    /// security checks that may not be performed. Accordingly, setting a
    /// non-default database is discouraged except for specialty applications with
    /// unusual security requirements.
    ///
    /// Readable | Writeable
    ///
    ///
    /// #### `interaction`
    ///  A #GTlsInteraction object to be used when the connection or certificate
    /// database need to interact with the user. This will be used to prompt the
    /// user for passwords where necessary.
    ///
    /// Readable | Writeable
    ///
    ///
    /// #### `negotiated-protocol`
    ///  The application-layer protocol negotiated during the TLS
    /// handshake. See g_tls_connection_get_negotiated_protocol().
    ///
    /// Readable
    ///
    ///
    /// #### `peer-certificate`
    ///  The connection's peer's certificate, after the TLS handshake has
    /// completed or failed. Note in particular that this is not yet set
    /// during the emission of #GTlsConnection::accept-certificate.
    ///
    /// (You can watch for a #GObject::notify signal on this property to
    /// detect when a handshake has occurred.)
    ///
    /// Readable
    ///
    ///
    /// #### `peer-certificate-errors`
    ///  The errors noticed while verifying
    /// #GTlsConnection:peer-certificate. Normally this should be 0, but
    /// it may not be if #GTlsClientConnection:validation-flags is not
    /// [`TlsCertificateFlags::VALIDATE_ALL`][crate::TlsCertificateFlags::VALIDATE_ALL], or if
    /// #GTlsConnection::accept-certificate overrode the default
    /// behavior.
    ///
    /// GLib guarantees that if certificate verification fails, at least
    /// one error will be set, but it does not guarantee that all possible
    /// errors will be set. Accordingly, you may not safely decide to
    /// ignore any particular type of error. For example, it would be
    /// incorrect to mask [`TlsCertificateFlags::EXPIRED`][crate::TlsCertificateFlags::EXPIRED] if you want to allow
    /// expired certificates, because this could potentially be the only
    /// error flag set even if other problems exist with the certificate.
    ///
    /// Readable
    ///
    ///
    /// #### `protocol-version`
    ///  The TLS protocol version in use. See g_tls_connection_get_protocol_version().
    ///
    /// Readable
    ///
    ///
    /// #### `rehandshake-mode`
    ///  The rehandshaking mode. See
    /// g_tls_connection_set_rehandshake_mode().
    ///
    /// Readable | Writeable | Construct
    ///
    ///
    /// #### `require-close-notify`
    ///  Whether or not proper TLS close notification is required.
    /// See g_tls_connection_set_require_close_notify().
    ///
    /// Readable | Writeable | Construct
    ///
    ///
    /// #### `use-system-certdb`
    ///  Whether or not the system certificate database will be used to
    /// verify peer certificates. See
    /// g_tls_connection_set_use_system_certdb().
    ///
    /// Readable | Writeable | Construct
    /// <details><summary><h4>IOStream</h4></summary>
    ///
    ///
    /// #### `closed`
    ///  Whether the stream is closed.
    ///
    /// Readable
    ///
    ///
    /// #### `input-stream`
    ///  The [`InputStream`][crate::InputStream] to read from.
    ///
    /// Readable
    ///
    ///
    /// #### `output-stream`
    ///  The [`OutputStream`][crate::OutputStream] to write to.
    ///
    /// Readable
    /// </details>
    ///
    /// ## Signals
    ///
    ///
    /// #### `accept-certificate`
    ///  Emitted during the TLS handshake after the peer certificate has
    /// been received. You can examine @peer_cert's certification path by
    /// calling g_tls_certificate_get_issuer() on it.
    ///
    /// For a client-side connection, @peer_cert is the server's
    /// certificate, and the signal will only be emitted if the
    /// certificate was not acceptable according to @conn's
    /// #GTlsClientConnection:validation_flags. If you would like the
    /// certificate to be accepted despite @errors, return [`true`] from the
    /// signal handler. Otherwise, if no handler accepts the certificate,
    /// the handshake will fail with [`TlsError::BadCertificate`][crate::TlsError::BadCertificate].
    ///
    /// GLib guarantees that if certificate verification fails, this signal
    /// will be emitted with at least one error will be set in @errors, but
    /// it does not guarantee that all possible errors will be set.
    /// Accordingly, you may not safely decide to ignore any particular
    /// type of error. For example, it would be incorrect to ignore
    /// [`TlsCertificateFlags::EXPIRED`][crate::TlsCertificateFlags::EXPIRED] if you want to allow expired
    /// certificates, because this could potentially be the only error flag
    /// set even if other problems exist with the certificate.
    ///
    /// For a server-side connection, @peer_cert is the certificate
    /// presented by the client, if this was requested via the server's
    /// #GTlsServerConnection:authentication_mode. On the server side,
    /// the signal is always emitted when the client presents a
    /// certificate, and the certificate will only be accepted if a
    /// handler returns [`true`].
    ///
    /// Note that if this signal is emitted as part of asynchronous I/O
    /// in the main thread, then you should not attempt to interact with
    /// the user before returning from the signal handler. If you want to
    /// let the user decide whether or not to accept the certificate, you
    /// would have to return [`false`] from the signal handler on the first
    /// attempt, and then after the connection attempt returns a
    /// [`TlsError::BadCertificate`][crate::TlsError::BadCertificate], you can interact with the user, and
    /// if the user decides to accept the certificate, remember that fact,
    /// create a new connection, and return [`true`] from the signal handler
    /// the next time.
    ///
    /// If you are doing I/O in another thread, you do not
    /// need to worry about this, and can simply block in the signal
    /// handler until the UI thread returns an answer.
    ///
    ///
    ///
    /// # Implements
    ///
    /// [`TlsConnectionExt`][trait@crate::prelude::TlsConnectionExt], [`IOStreamExt`][trait@crate::prelude::IOStreamExt], [`trait@glib::ObjectExt`], [`TlsConnectionExtManual`][trait@crate::prelude::TlsConnectionExtManual], [`IOStreamExtManual`][trait@crate::prelude::IOStreamExtManual]
    #[doc(alias = "GTlsConnection")]
    pub struct TlsConnection(Object<ffi::GTlsConnection, ffi::GTlsConnectionClass>) @extends IOStream;

    match fn {
        type_ => || ffi::g_tls_connection_get_type(),
    }
}

impl TlsConnection {
    pub const NONE: Option<&'static TlsConnection> = None;
}

/// Trait containing all [`struct@TlsConnection`] methods.
///
/// # Implementors
///
/// [`TlsClientConnection`][struct@crate::TlsClientConnection], [`TlsConnection`][struct@crate::TlsConnection], [`TlsServerConnection`][struct@crate::TlsServerConnection]
pub trait TlsConnectionExt: IsA<TlsConnection> + 'static {
    /// Used by #GTlsConnection implementations to emit the
    /// #GTlsConnection::accept-certificate signal.
    /// ## `peer_cert`
    /// the peer's #GTlsCertificate
    /// ## `errors`
    /// the problems with @peer_cert
    ///
    /// # Returns
    ///
    /// [`true`] if one of the signal handlers has returned
    ///     [`true`] to accept @peer_cert
    #[doc(alias = "g_tls_connection_emit_accept_certificate")]
    fn emit_accept_certificate(
        &self,
        peer_cert: &impl IsA<TlsCertificate>,
        errors: TlsCertificateFlags,
    ) -> bool {
        unsafe {
            from_glib(ffi::g_tls_connection_emit_accept_certificate(
                self.as_ref().to_glib_none().0,
                peer_cert.as_ref().to_glib_none().0,
                errors.into_glib(),
            ))
        }
    }

    /// Gets @self's certificate, as set by
    /// g_tls_connection_set_certificate().
    ///
    /// # Returns
    ///
    /// @self's certificate, or [`None`]
    #[doc(alias = "g_tls_connection_get_certificate")]
    #[doc(alias = "get_certificate")]
    fn certificate(&self) -> Option<TlsCertificate> {
        unsafe {
            from_glib_none(ffi::g_tls_connection_get_certificate(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Returns the name of the current TLS ciphersuite, or [`None`] if the
    /// connection has not handshaked or has been closed. Beware that the TLS
    /// backend may use any of multiple different naming conventions, because
    /// OpenSSL and GnuTLS have their own ciphersuite naming conventions that
    /// are different from each other and different from the standard, IANA-
    /// registered ciphersuite names. The ciphersuite name is intended to be
    /// displayed to the user for informative purposes only, and parsing it
    /// is not recommended.
    ///
    /// # Returns
    ///
    /// The name of the current TLS ciphersuite, or [`None`]
    #[cfg(feature = "v2_70")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_connection_get_ciphersuite_name")]
    #[doc(alias = "get_ciphersuite_name")]
    #[doc(alias = "ciphersuite-name")]
    fn ciphersuite_name(&self) -> Option<glib::GString> {
        unsafe {
            from_glib_full(ffi::g_tls_connection_get_ciphersuite_name(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Gets the certificate database that @self uses to verify
    /// peer certificates. See g_tls_connection_set_database().
    ///
    /// # Returns
    ///
    /// the certificate database that @self uses or [`None`]
    #[doc(alias = "g_tls_connection_get_database")]
    #[doc(alias = "get_database")]
    fn database(&self) -> Option<TlsDatabase> {
        unsafe {
            from_glib_none(ffi::g_tls_connection_get_database(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Get the object that will be used to interact with the user. It will be used
    /// for things like prompting the user for passwords. If [`None`] is returned, then
    /// no user interaction will occur for this connection.
    ///
    /// # Returns
    ///
    /// The interaction object.
    #[doc(alias = "g_tls_connection_get_interaction")]
    #[doc(alias = "get_interaction")]
    fn interaction(&self) -> Option<TlsInteraction> {
        unsafe {
            from_glib_none(ffi::g_tls_connection_get_interaction(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Gets the name of the application-layer protocol negotiated during
    /// the handshake.
    ///
    /// If the peer did not use the ALPN extension, or did not advertise a
    /// protocol that matched one of @self's protocols, or the TLS backend
    /// does not support ALPN, then this will be [`None`]. See
    /// g_tls_connection_set_advertised_protocols().
    ///
    /// # Returns
    ///
    /// the negotiated protocol, or [`None`]
    #[cfg(feature = "v2_60")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_60")))]
    #[doc(alias = "g_tls_connection_get_negotiated_protocol")]
    #[doc(alias = "get_negotiated_protocol")]
    #[doc(alias = "negotiated-protocol")]
    fn negotiated_protocol(&self) -> Option<glib::GString> {
        unsafe {
            from_glib_none(ffi::g_tls_connection_get_negotiated_protocol(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Gets @self's peer's certificate after the handshake has completed
    /// or failed. (It is not set during the emission of
    /// #GTlsConnection::accept-certificate.)
    ///
    /// # Returns
    ///
    /// @self's peer's certificate, or [`None`]
    #[doc(alias = "g_tls_connection_get_peer_certificate")]
    #[doc(alias = "get_peer_certificate")]
    #[doc(alias = "peer-certificate")]
    fn peer_certificate(&self) -> Option<TlsCertificate> {
        unsafe {
            from_glib_none(ffi::g_tls_connection_get_peer_certificate(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Gets the errors associated with validating @self's peer's
    /// certificate, after the handshake has completed or failed. (It is
    /// not set during the emission of #GTlsConnection::accept-certificate.)
    ///
    /// See #GTlsConnection:peer-certificate-errors for more information.
    ///
    /// # Returns
    ///
    /// @self's peer's certificate errors
    #[doc(alias = "g_tls_connection_get_peer_certificate_errors")]
    #[doc(alias = "get_peer_certificate_errors")]
    #[doc(alias = "peer-certificate-errors")]
    fn peer_certificate_errors(&self) -> TlsCertificateFlags {
        unsafe {
            from_glib(ffi::g_tls_connection_get_peer_certificate_errors(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Returns the current TLS protocol version, which may be
    /// [`TlsProtocolVersion::Unknown`][crate::TlsProtocolVersion::Unknown] if the connection has not handshaked, or
    /// has been closed, or if the TLS backend has implemented a protocol version
    /// that is not a recognized #GTlsProtocolVersion.
    ///
    /// # Returns
    ///
    /// The current TLS protocol version
    #[cfg(feature = "v2_70")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_connection_get_protocol_version")]
    #[doc(alias = "get_protocol_version")]
    #[doc(alias = "protocol-version")]
    fn protocol_version(&self) -> TlsProtocolVersion {
        unsafe {
            from_glib(ffi::g_tls_connection_get_protocol_version(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Gets @self rehandshaking mode. See
    /// g_tls_connection_set_rehandshake_mode() for details.
    ///
    /// # Deprecated since 2.60
    ///
    /// Changing the rehandshake mode is no longer
    ///   required for compatibility. Also, rehandshaking has been removed
    ///   from the TLS protocol in TLS 1.3.
    ///
    /// # Returns
    ///
    /// [`TlsRehandshakeMode::Safely`][crate::TlsRehandshakeMode::Safely]
    #[cfg_attr(feature = "v2_60", deprecated = "Since 2.60")]
    #[allow(deprecated)]
    #[doc(alias = "g_tls_connection_get_rehandshake_mode")]
    #[doc(alias = "get_rehandshake_mode")]
    #[doc(alias = "rehandshake-mode")]
    fn rehandshake_mode(&self) -> TlsRehandshakeMode {
        unsafe {
            from_glib(ffi::g_tls_connection_get_rehandshake_mode(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Tests whether or not @self expects a proper TLS close notification
    /// when the connection is closed. See
    /// g_tls_connection_set_require_close_notify() for details.
    ///
    /// # Returns
    ///
    /// [`true`] if @self requires a proper TLS close
    /// notification.
    #[doc(alias = "g_tls_connection_get_require_close_notify")]
    #[doc(alias = "get_require_close_notify")]
    #[doc(alias = "require-close-notify")]
    fn requires_close_notify(&self) -> bool {
        unsafe {
            from_glib(ffi::g_tls_connection_get_require_close_notify(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    /// Attempts a TLS handshake on @self.
    ///
    /// On the client side, it is never necessary to call this method;
    /// although the connection needs to perform a handshake after
    /// connecting (or after sending a "STARTTLS"-type command),
    /// #GTlsConnection will handle this for you automatically when you try
    /// to send or receive data on the connection. You can call
    /// g_tls_connection_handshake() manually if you want to know whether
    /// the initial handshake succeeded or failed (as opposed to just
    /// immediately trying to use @self to read or write, in which case,
    /// if it fails, it may not be possible to tell if it failed before or
    /// after completing the handshake), but beware that servers may reject
    /// client authentication after the handshake has completed, so a
    /// successful handshake does not indicate the connection will be usable.
    ///
    /// Likewise, on the server side, although a handshake is necessary at
    /// the beginning of the communication, you do not need to call this
    /// function explicitly unless you want clearer error reporting.
    ///
    /// Previously, calling g_tls_connection_handshake() after the initial
    /// handshake would trigger a rehandshake; however, this usage was
    /// deprecated in GLib 2.60 because rehandshaking was removed from the
    /// TLS protocol in TLS 1.3. Since GLib 2.64, calling this function after
    /// the initial handshake will no longer do anything.
    ///
    /// When using a #GTlsConnection created by #GSocketClient, the
    /// #GSocketClient performs the initial handshake, so calling this
    /// function manually is not recommended.
    ///
    /// #GTlsConnection::accept_certificate may be emitted during the
    /// handshake.
    /// ## `cancellable`
    /// a #GCancellable, or [`None`]
    ///
    /// # Returns
    ///
    /// success or failure
    #[doc(alias = "g_tls_connection_handshake")]
    fn handshake(&self, cancellable: Option<&impl IsA<Cancellable>>) -> Result<(), glib::Error> {
        unsafe {
            let mut error = std::ptr::null_mut();
            let is_ok = ffi::g_tls_connection_handshake(
                self.as_ref().to_glib_none().0,
                cancellable.map(|p| p.as_ref()).to_glib_none().0,
                &mut error,
            );
            debug_assert_eq!(is_ok == glib::ffi::GFALSE, !error.is_null());
            if error.is_null() {
                Ok(())
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Asynchronously performs a TLS handshake on @self. See
    /// g_tls_connection_handshake() for more information.
    /// ## `io_priority`
    /// the [I/O priority](iface.AsyncResult.html#io-priority) of the request
    /// ## `cancellable`
    /// a #GCancellable, or [`None`]
    /// ## `callback`
    /// callback to call when the handshake is complete
    #[doc(alias = "g_tls_connection_handshake_async")]
    fn handshake_async<P: FnOnce(Result<(), glib::Error>) + 'static>(
        &self,
        io_priority: glib::Priority,
        cancellable: Option<&impl IsA<Cancellable>>,
        callback: P,
    ) {
        let main_context = glib::MainContext::ref_thread_default();
        let is_main_context_owner = main_context.is_owner();
        let has_acquired_main_context = (!is_main_context_owner)
            .then(|| main_context.acquire().ok())
            .flatten();
        assert!(
            is_main_context_owner || has_acquired_main_context.is_some(),
            "Async operations only allowed if the thread is owning the MainContext"
        );

        let user_data: Box_<glib::thread_guard::ThreadGuard<P>> =
            Box_::new(glib::thread_guard::ThreadGuard::new(callback));
        unsafe extern "C" fn handshake_async_trampoline<
            P: FnOnce(Result<(), glib::Error>) + 'static,
        >(
            _source_object: *mut glib::gobject_ffi::GObject,
            res: *mut crate::ffi::GAsyncResult,
            user_data: glib::ffi::gpointer,
        ) {
            unsafe {
                let mut error = std::ptr::null_mut();
                ffi::g_tls_connection_handshake_finish(_source_object as *mut _, res, &mut error);
                let result = if error.is_null() {
                    Ok(())
                } else {
                    Err(from_glib_full(error))
                };
                let callback: Box_<glib::thread_guard::ThreadGuard<P>> =
                    Box_::from_raw(user_data as *mut _);
                let callback: P = callback.into_inner();
                callback(result);
            }
        }
        let callback = handshake_async_trampoline::<P>;
        unsafe {
            ffi::g_tls_connection_handshake_async(
                self.as_ref().to_glib_none().0,
                io_priority.into_glib(),
                cancellable.map(|p| p.as_ref()).to_glib_none().0,
                Some(callback),
                Box_::into_raw(user_data) as *mut _,
            );
        }
    }

    fn handshake_future(
        &self,
        io_priority: glib::Priority,
    ) -> Pin<Box_<dyn std::future::Future<Output = Result<(), glib::Error>> + 'static>> {
        Box_::pin(crate::GioFuture::new(
            self,
            move |obj, cancellable, send| {
                obj.handshake_async(io_priority, Some(cancellable), move |res| {
                    send.resolve(res);
                });
            },
        ))
    }

    /// This sets the certificate that @self will present to its peer
    /// during the TLS handshake. For a #GTlsServerConnection, it is
    /// mandatory to set this, and that will normally be done at construct
    /// time.
    ///
    /// For a #GTlsClientConnection, this is optional. If a handshake fails
    /// with [`TlsError::CertificateRequired`][crate::TlsError::CertificateRequired], that means that the server
    /// requires a certificate, and if you try connecting again, you should
    /// call this method first. You can call
    /// g_tls_client_connection_get_accepted_cas() on the failed connection
    /// to get a list of Certificate Authorities that the server will
    /// accept certificates from.
    ///
    /// (It is also possible that a server will allow the connection with
    /// or without a certificate; in that case, if you don't provide a
    /// certificate, you can tell that the server requested one by the fact
    /// that g_tls_client_connection_get_accepted_cas() will return
    /// non-[`None`].)
    /// ## `certificate`
    /// the certificate to use for @self
    #[doc(alias = "g_tls_connection_set_certificate")]
    #[doc(alias = "certificate")]
    fn set_certificate(&self, certificate: &impl IsA<TlsCertificate>) {
        unsafe {
            ffi::g_tls_connection_set_certificate(
                self.as_ref().to_glib_none().0,
                certificate.as_ref().to_glib_none().0,
            );
        }
    }

    /// Sets the certificate database that is used to verify peer certificates.
    /// This is set to the default database by default. See
    /// g_tls_backend_get_default_database(). If set to [`None`], then
    /// peer certificate validation will always set the
    /// [`TlsCertificateFlags::UNKNOWN_CA`][crate::TlsCertificateFlags::UNKNOWN_CA] error (meaning
    /// #GTlsConnection::accept-certificate will always be emitted on
    /// client-side connections, unless that bit is not set in
    /// #GTlsClientConnection:validation-flags).
    ///
    /// There are nonintuitive security implications when using a non-default
    /// database. See #GTlsConnection:database for details.
    /// ## `database`
    /// a #GTlsDatabase
    #[doc(alias = "g_tls_connection_set_database")]
    #[doc(alias = "database")]
    fn set_database(&self, database: Option<&impl IsA<TlsDatabase>>) {
        unsafe {
            ffi::g_tls_connection_set_database(
                self.as_ref().to_glib_none().0,
                database.map(|p| p.as_ref()).to_glib_none().0,
            );
        }
    }

    /// Set the object that will be used to interact with the user. It will be used
    /// for things like prompting the user for passwords.
    ///
    /// The @interaction argument will normally be a derived subclass of
    /// #GTlsInteraction. [`None`] can also be provided if no user interaction
    /// should occur for this connection.
    /// ## `interaction`
    /// an interaction object, or [`None`]
    #[doc(alias = "g_tls_connection_set_interaction")]
    #[doc(alias = "interaction")]
    fn set_interaction(&self, interaction: Option<&impl IsA<TlsInteraction>>) {
        unsafe {
            ffi::g_tls_connection_set_interaction(
                self.as_ref().to_glib_none().0,
                interaction.map(|p| p.as_ref()).to_glib_none().0,
            );
        }
    }

    /// Since GLib 2.64, changing the rehandshake mode is no longer supported
    /// and will have no effect. With TLS 1.3, rehandshaking has been removed from
    /// the TLS protocol, replaced by separate post-handshake authentication and
    /// rekey operations.
    ///
    /// # Deprecated since 2.60
    ///
    /// Changing the rehandshake mode is no longer
    ///   required for compatibility. Also, rehandshaking has been removed
    ///   from the TLS protocol in TLS 1.3.
    /// ## `mode`
    /// the rehandshaking mode
    #[cfg_attr(feature = "v2_60", deprecated = "Since 2.60")]
    #[allow(deprecated)]
    #[doc(alias = "g_tls_connection_set_rehandshake_mode")]
    #[doc(alias = "rehandshake-mode")]
    fn set_rehandshake_mode(&self, mode: TlsRehandshakeMode) {
        unsafe {
            ffi::g_tls_connection_set_rehandshake_mode(
                self.as_ref().to_glib_none().0,
                mode.into_glib(),
            );
        }
    }

    /// Sets whether or not @self expects a proper TLS close notification
    /// before the connection is closed. If this is [`true`] (the default),
    /// then @self will expect to receive a TLS close notification from its
    /// peer before the connection is closed, and will return a
    /// [`TlsError::Eof`][crate::TlsError::Eof] error if the connection is closed without proper
    /// notification (since this may indicate a network error, or
    /// man-in-the-middle attack).
    ///
    /// In some protocols, the application will know whether or not the
    /// connection was closed cleanly based on application-level data
    /// (because the application-level data includes a length field, or is
    /// somehow self-delimiting); in this case, the close notify is
    /// redundant and sometimes omitted. (TLS 1.1 explicitly allows this;
    /// in TLS 1.0 it is technically an error, but often done anyway.) You
    /// can use g_tls_connection_set_require_close_notify() to tell @self
    /// to allow an "unannounced" connection close, in which case the close
    /// will show up as a 0-length read, as in a non-TLS
    /// #GSocketConnection, and it is up to the application to check that
    /// the data has been fully received.
    ///
    /// Note that this only affects the behavior when the peer closes the
    /// connection; when the application calls g_io_stream_close() itself
    /// on @self, this will send a close notification regardless of the
    /// setting of this property. If you explicitly want to do an unclean
    /// close, you can close @self's #GTlsConnection:base-io-stream rather
    /// than closing @self itself, but note that this may only be done when no other
    /// operations are pending on @self or the base I/O stream.
    /// ## `require_close_notify`
    /// whether or not to require close notification
    #[doc(alias = "g_tls_connection_set_require_close_notify")]
    #[doc(alias = "require-close-notify")]
    fn set_require_close_notify(&self, require_close_notify: bool) {
        unsafe {
            ffi::g_tls_connection_set_require_close_notify(
                self.as_ref().to_glib_none().0,
                require_close_notify.into_glib(),
            );
        }
    }

    /// The list of application-layer protocols that the connection
    /// advertises that it is willing to speak. See
    /// g_tls_connection_set_advertised_protocols().
    #[cfg(feature = "v2_60")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_60")))]
    #[doc(alias = "advertised-protocols")]
    fn advertised_protocols(&self) -> Vec<glib::GString> {
        ObjectExt::property(self.as_ref(), "advertised-protocols")
    }

    /// The #GIOStream that the connection wraps. The connection holds a reference
    /// to this stream, and may run operations on the stream from other threads
    /// throughout its lifetime. Consequently, after the #GIOStream has been
    /// constructed, application code may only run its own operations on this
    /// stream when no #GIOStream operations are running.
    #[doc(alias = "base-io-stream")]
    fn base_io_stream(&self) -> Option<IOStream> {
        ObjectExt::property(self.as_ref(), "base-io-stream")
    }

    /// Emitted during the TLS handshake after the peer certificate has
    /// been received. You can examine @peer_cert's certification path by
    /// calling g_tls_certificate_get_issuer() on it.
    ///
    /// For a client-side connection, @peer_cert is the server's
    /// certificate, and the signal will only be emitted if the
    /// certificate was not acceptable according to @conn's
    /// #GTlsClientConnection:validation_flags. If you would like the
    /// certificate to be accepted despite @errors, return [`true`] from the
    /// signal handler. Otherwise, if no handler accepts the certificate,
    /// the handshake will fail with [`TlsError::BadCertificate`][crate::TlsError::BadCertificate].
    ///
    /// GLib guarantees that if certificate verification fails, this signal
    /// will be emitted with at least one error will be set in @errors, but
    /// it does not guarantee that all possible errors will be set.
    /// Accordingly, you may not safely decide to ignore any particular
    /// type of error. For example, it would be incorrect to ignore
    /// [`TlsCertificateFlags::EXPIRED`][crate::TlsCertificateFlags::EXPIRED] if you want to allow expired
    /// certificates, because this could potentially be the only error flag
    /// set even if other problems exist with the certificate.
    ///
    /// For a server-side connection, @peer_cert is the certificate
    /// presented by the client, if this was requested via the server's
    /// #GTlsServerConnection:authentication_mode. On the server side,
    /// the signal is always emitted when the client presents a
    /// certificate, and the certificate will only be accepted if a
    /// handler returns [`true`].
    ///
    /// Note that if this signal is emitted as part of asynchronous I/O
    /// in the main thread, then you should not attempt to interact with
    /// the user before returning from the signal handler. If you want to
    /// let the user decide whether or not to accept the certificate, you
    /// would have to return [`false`] from the signal handler on the first
    /// attempt, and then after the connection attempt returns a
    /// [`TlsError::BadCertificate`][crate::TlsError::BadCertificate], you can interact with the user, and
    /// if the user decides to accept the certificate, remember that fact,
    /// create a new connection, and return [`true`] from the signal handler
    /// the next time.
    ///
    /// If you are doing I/O in another thread, you do not
    /// need to worry about this, and can simply block in the signal
    /// handler until the UI thread returns an answer.
    /// ## `peer_cert`
    /// the peer's #GTlsCertificate
    /// ## `errors`
    /// the problems with @peer_cert.
    ///
    /// # Returns
    ///
    /// [`true`] to accept @peer_cert (which will also
    /// immediately end the signal emission). [`false`] to allow the signal
    /// emission to continue, which will cause the handshake to fail if
    /// no one else overrides it.
    #[doc(alias = "accept-certificate")]
    fn connect_accept_certificate<
        F: Fn(&Self, &TlsCertificate, TlsCertificateFlags) -> bool + 'static,
    >(
        &self,
        f: F,
    ) -> SignalHandlerId {
        unsafe extern "C" fn accept_certificate_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P, &TlsCertificate, TlsCertificateFlags) -> bool + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            peer_cert: *mut ffi::GTlsCertificate,
            errors: ffi::GTlsCertificateFlags,
            f: glib::ffi::gpointer,
        ) -> glib::ffi::gboolean {
            unsafe {
                let f: &F = &*(f as *const F);
                f(
                    TlsConnection::from_glib_borrow(this).unsafe_cast_ref(),
                    &from_glib_borrow(peer_cert),
                    from_glib(errors),
                )
                .into_glib()
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"accept-certificate".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    accept_certificate_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(feature = "v2_60")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_60")))]
    #[doc(alias = "advertised-protocols")]
    fn connect_advertised_protocols_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_advertised_protocols_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::advertised-protocols".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_advertised_protocols_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "certificate")]
    fn connect_certificate_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_certificate_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::certificate".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_certificate_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(feature = "v2_70")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_70")))]
    #[doc(alias = "ciphersuite-name")]
    fn connect_ciphersuite_name_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_ciphersuite_name_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::ciphersuite-name".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_ciphersuite_name_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "database")]
    fn connect_database_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_database_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::database".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_database_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "interaction")]
    fn connect_interaction_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_interaction_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::interaction".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_interaction_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(feature = "v2_60")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_60")))]
    #[doc(alias = "negotiated-protocol")]
    fn connect_negotiated_protocol_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_negotiated_protocol_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::negotiated-protocol".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_negotiated_protocol_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "peer-certificate")]
    fn connect_peer_certificate_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_peer_certificate_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::peer-certificate".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_peer_certificate_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "peer-certificate-errors")]
    fn connect_peer_certificate_errors_notify<F: Fn(&Self) + 'static>(
        &self,
        f: F,
    ) -> SignalHandlerId {
        unsafe extern "C" fn notify_peer_certificate_errors_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::peer-certificate-errors".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_peer_certificate_errors_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(feature = "v2_70")]
    #[cfg_attr(docsrs, doc(cfg(feature = "v2_70")))]
    #[doc(alias = "protocol-version")]
    fn connect_protocol_version_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_protocol_version_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::protocol-version".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_protocol_version_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg_attr(feature = "v2_60", deprecated = "Since 2.60")]
    #[doc(alias = "rehandshake-mode")]
    fn connect_rehandshake_mode_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_rehandshake_mode_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::rehandshake-mode".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_rehandshake_mode_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[doc(alias = "require-close-notify")]
    fn connect_require_close_notify_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_require_close_notify_trampoline<
            P: IsA<TlsConnection>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsConnection,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            unsafe {
                let f: &F = &*(f as *const F);
                f(TlsConnection::from_glib_borrow(this).unsafe_cast_ref())
            }
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                c"notify::require-close-notify".as_ptr() as *const _,
                Some(std::mem::transmute::<*const (), unsafe extern "C" fn()>(
                    notify_require_close_notify_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }
}

impl<O: IsA<TlsConnection>> TlsConnectionExt for O {}