Struct TlsClientConnection

pub struct TlsClientConnection { /* private fields */ }

GTlsClientConnection is the client-side subclass of TlsConnection, representing a client-side TLS connection.

Properties

accepted-cas

A list of the distinguished names of the Certificate Authorities that the server will accept client certificates signed by. If the server requests a client certificate during the handshake, then this property will be set after the handshake completes.

Each item in the list is a #GByteArray which contains the complete subject DN of the certificate authority.

Readable

server-identity

A #GSocketConnectable describing the identity of the server that is expected on the other end of the connection.

If the TlsCertificateFlags::BAD_IDENTITY flag is set in #GTlsClientConnection:validation-flags, this object will be used to determine the expected identify of the remote end of the connection; if #GTlsClientConnection:server-identity is not set, or does not match the identity presented by the server, then the TlsCertificateFlags::BAD_IDENTITY validation will fail.

In addition to its use in verifying the server certificate, this is also used to give a hint to the server about what certificate we expect, which is useful for servers that serve virtual hosts.

Readable | Writeable | Construct

use-ssl3

SSL 3.0 is no longer supported. See g_tls_client_connection_set_use_ssl3() for details.

Readable | Writeable | Construct

validation-flags

What steps to perform when validating a certificate received from a server. Server certificates that fail to validate in any of the ways indicated here will be rejected unless the application overrides the default via #GTlsConnection::accept-certificate.

GLib guarantees that if certificate verification fails, at least one flag will be set, but it does not guarantee that all possible flags will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask TlsCertificateFlags::EXPIRED if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate. Therefore, there is no safe way to use this property. This is not a horrible problem, though, because you should not be attempting to ignore validation errors anyway. If you really must ignore TLS certificate errors, connect to #GTlsConnection::accept-certificate.

Readable | Writeable | Construct

TlsConnection

advertised-protocols

The list of application-layer protocols that the connection advertises that it is willing to speak. See g_tls_connection_set_advertised_protocols().

Readable | Writeable

base-io-stream

The #GIOStream that the connection wraps. The connection holds a reference to this stream, and may run operations on the stream from other threads throughout its lifetime. Consequently, after the #GIOStream has been constructed, application code may only run its own operations on this stream when no #GIOStream operations are running.

Readable | Writeable | Construct Only

certificate

The connection’s certificate; see g_tls_connection_set_certificate().

Readable | Writeable

ciphersuite-name

The name of the TLS ciphersuite in use. See g_tls_connection_get_ciphersuite_name().

Readable

database

The certificate database to use when verifying this TLS connection. If no certificate database is set, then the default database will be used. See g_tls_backend_get_default_database().

When using a non-default database, #GTlsConnection must fall back to using the #GTlsDatabase to perform certificate verification using g_tls_database_verify_chain(), which means certificate verification will not be able to make use of TLS session context. This may be less secure. For example, if you create your own #GTlsDatabase that just wraps the default #GTlsDatabase, you might expect that you have not changed anything, but this is not true because you may have altered the behavior of #GTlsConnection by causing it to use g_tls_database_verify_chain(). See the documentation of g_tls_database_verify_chain() for more details on specific security checks that may not be performed. Accordingly, setting a non-default database is discouraged except for specialty applications with unusual security requirements.

Readable | Writeable

interaction

A #GTlsInteraction object to be used when the connection or certificate database need to interact with the user. This will be used to prompt the user for passwords where necessary.

Readable | Writeable

negotiated-protocol

The application-layer protocol negotiated during the TLS handshake. See g_tls_connection_get_negotiated_protocol().

Readable

peer-certificate

The connection’s peer’s certificate, after the TLS handshake has completed or failed. Note in particular that this is not yet set during the emission of #GTlsConnection::accept-certificate.

(You can watch for a #GObject::notify signal on this property to detect when a handshake has occurred.)

Readable

peer-certificate-errors

The errors noticed while verifying #GTlsConnection:peer-certificate. Normally this should be 0, but it may not be if #GTlsClientConnection:validation-flags is not TlsCertificateFlags::VALIDATE_ALL, or if #GTlsConnection::accept-certificate overrode the default behavior.

GLib guarantees that if certificate verification fails, at least one error will be set, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask TlsCertificateFlags::EXPIRED if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate.

Readable

protocol-version

The TLS protocol version in use. See g_tls_connection_get_protocol_version().

Readable

rehandshake-mode

The rehandshaking mode. See g_tls_connection_set_rehandshake_mode().

Readable | Writeable | Construct

require-close-notify

Whether or not proper TLS close notification is required. See g_tls_connection_set_require_close_notify().

Readable | Writeable | Construct

use-system-certdb

Whether or not the system certificate database will be used to verify peer certificates. See g_tls_connection_set_use_system_certdb().

Readable | Writeable | Construct

IOStream

closed

Whether the stream is closed.

Readable

input-stream

The InputStream to read from.

Readable

output-stream

The OutputStream to write to.

Readable

Implements

TlsClientConnectionExt, TlsConnectionExt, IOStreamExt, [trait@glib::ObjectExt], TlsConnectionExtManual, IOStreamExtManual

GLib type: GObject with reference counted clone semantics.

Implementations

impl TlsClientConnection

pub const NONE: Option<&'static TlsClientConnection> = None

pub fn new( base_io_stream: &impl IsA<IOStream>, server_identity: Option<&impl IsA<SocketConnectable>>, ) -> Result<TlsClientConnection, Error>

Creates a new #GTlsClientConnection wrapping @base_io_stream (which must have pollable input and output streams) which is assumed to communicate with the server identified by @server_identity.

See the documentation for #GTlsConnection:base-io-stream for restrictions on when application code can run operations on the @base_io_stream after this function has returned.

base_io_stream

the #GIOStream to wrap

server_identity

the expected identity of the server

Returns

the new #GTlsClientConnection, or None on error

Trait Implementations

impl Clone for TlsClientConnection

fn clone(&self) -> Self

Makes a clone of this shared reference.

This increments the strong reference count of the object. Dropping the object will decrement it again.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsClientConnection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl HasParamSpec for TlsClientConnection

type ParamSpec = ParamSpecObject

type SetValue = TlsClientConnection

Preferred value to be used as setter for the associated ParamSpec.

type BuilderFn = fn(_: &str) -> ParamSpecObjectBuilder<'_, TlsClientConnection>

fn param_spec_builder() -> Self::BuilderFn

impl Hash for TlsClientConnection

fn hash<H>(&self, state: &mut H)

where H: Hasher,

Hashes the memory address of this object.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for TlsClientConnection

fn cmp(&self, other: &Self) -> Ordering

Comparison for two GObjects.

Compares the memory addresses of the provided objects.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl<OT: ObjectType> PartialEq<OT> for TlsClientConnection

fn eq(&self, other: &OT) -> bool

Equality for two GObjects.

Two GObjects are equal if their memory addresses are equal.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<OT: ObjectType> PartialOrd<OT> for TlsClientConnection

fn partial_cmp(&self, other: &OT) -> Option<Ordering>

Partial comparison for two GObjects.

Compares the memory addresses of the provided objects.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StaticType for TlsClientConnection

fn static_type() -> Type

Returns the type identifier of Self.

impl Eq for TlsClientConnection

impl IsA<IOStream> for TlsClientConnection

impl IsA<TlsConnection> for TlsClientConnection