[glib] gio: Add DTLS interfaces
- From: Philip Withnall <pwithnall src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [glib] gio: Add DTLS interfaces
- Date: Mon, 18 Jan 2016 14:26:16 +0000 (UTC)
commit c3d6934f1838ae7c0d961c3d205f4b59789478ee
Author: Philip Withnall <philip withnall collabora co uk>
Date: Thu Jun 25 12:58:14 2015 +0100
gio: Add DTLS interfaces
Add a new GDtlsConnection interface, plus derived GDtlsClientConnection
and GDtlsServerConnection interfaces, for implementing Datagram TLS
support in glib-networking.
A GDtlsConnection is a GDatagramBased, so may be used as a normal
datagram socket, wrapping all datagrams from a base GDatagramBased in
DTLS segments.
Test cases are included in the implementation in glib-networking.
https://bugzilla.gnome.org/show_bug.cgi?id=752240
docs/reference/gio/gio-docs.xml | 3 +
docs/reference/gio/gio-sections.txt | 81 +++
docs/reference/gio/gio.types | 3 +
gio/Makefile.am | 6 +
gio/gdtlsclientconnection.c | 273 ++++++++++
gio/gdtlsclientconnection.h | 75 +++
gio/gdtlsconnection.c | 975 +++++++++++++++++++++++++++++++++++
gio/gdtlsconnection.h | 191 +++++++
gio/gdtlsserverconnection.c | 95 ++++
gio/gdtlsserverconnection.h | 69 +++
gio/gdummytlsbackend.c | 109 ++++
gio/gio.h | 3 +
gio/giotypes.h | 3 +
gio/gtlsbackend.c | 68 +++-
gio/gtlsbackend.h | 14 +
gio/gtlsconnection.c | 2 +
po/POTFILES.in | 3 +
17 files changed, 1970 insertions(+), 3 deletions(-)
---
diff --git a/docs/reference/gio/gio-docs.xml b/docs/reference/gio/gio-docs.xml
index 10f932e..a2e62e0 100644
--- a/docs/reference/gio/gio-docs.xml
+++ b/docs/reference/gio/gio-docs.xml
@@ -152,6 +152,9 @@
<xi:include href="xml/gtlsconnection.xml"/>
<xi:include href="xml/gtlsclientconnection.xml"/>
<xi:include href="xml/gtlsserverconnection.xml"/>
+ <xi:include href="xml/gdtlsconnection.xml"/>
+ <xi:include href="xml/gdtlsclientconnection.xml"/>
+ <xi:include href="xml/gdtlsserverconnection.xml"/>
<xi:include href="xml/gtlsbackend.xml"/>
<xi:include href="xml/gtlsdatabase.xml"/>
<xi:include href="xml/gtlsfiledatabase.xml"/>
diff --git a/docs/reference/gio/gio-sections.txt b/docs/reference/gio/gio-sections.txt
index 9eb68b2..6010a0f 100644
--- a/docs/reference/gio/gio-sections.txt
+++ b/docs/reference/gio/gio-sections.txt
@@ -3578,10 +3578,13 @@ GTlsBackend
GTlsBackendInterface
g_tls_backend_get_default
g_tls_backend_supports_tls
+g_tls_backend_supports_dtls
g_tls_backend_get_default_database
g_tls_backend_get_certificate_type
g_tls_backend_get_client_connection_type
g_tls_backend_get_server_connection_type
+g_tls_backend_get_dtls_client_connection_type
+g_tls_backend_get_dtls_server_connection_type
g_tls_backend_get_file_database_type
<SUBSECTION Standard>
G_IS_TLS_BACKEND
@@ -3808,6 +3811,84 @@ g_tls_interaction_result_get_type
</SECTION>
<SECTION>
+<FILE>gdtlsconnection</FILE>
+<TITLE>GDtlsConnection</TITLE>
+GDtlsConnection
+g_dtls_connection_set_certificate
+g_dtls_connection_get_certificate
+g_dtls_connection_get_peer_certificate
+g_dtls_connection_get_peer_certificate_errors
+g_dtls_connection_set_require_close_notify
+g_dtls_connection_get_require_close_notify
+g_dtls_connection_set_rehandshake_mode
+g_dtls_connection_get_rehandshake_mode
+g_dtls_connection_get_database
+g_dtls_connection_set_database
+g_dtls_connection_get_interaction
+g_dtls_connection_set_interaction
+<SUBSECTION>
+g_dtls_connection_handshake
+g_dtls_connection_handshake_async
+g_dtls_connection_handshake_finish
+<SUBSECTION>
+g_dtls_connection_shutdown
+g_dtls_connection_shutdown_async
+g_dtls_connection_shutdown_finish
+g_dtls_connection_close
+g_dtls_connection_close_async
+g_dtls_connection_close_finish
+<SUBSECTION>
+g_dtls_connection_emit_accept_certificate
+<SUBSECTION Standard>
+GDtlsConnectionClass
+GDtlsConnectionPrivate
+G_IS_DTLS_CONNECTION
+G_IS_DTLS_CONNECTION_CLASS
+G_DTLS_CONNECTION
+G_DTLS_CONNECTION_CLASS
+G_DTLS_CONNECTION_GET_CLASS
+G_TYPE_DTLS_CONNECTION
+G_DTLS_CONNECTION_GET_INTERFACE
+<SUBSECTION Private>
+g_dtls_connection_get_type
+</SECTION>
+
+<SECTION>
+<FILE>gdtlsclientconnection</FILE>
+<TITLE>GDtlsClientConnection</TITLE>
+GDtlsClientConnection
+GDtlsClientConnectionInterface
+g_dtls_client_connection_new
+g_dtls_client_connection_set_server_identity
+g_dtls_client_connection_get_server_identity
+g_dtls_client_connection_set_validation_flags
+g_dtls_client_connection_get_validation_flags
+g_dtls_client_connection_get_accepted_cas
+<SUBSECTION Standard>
+G_IS_DTLS_CLIENT_CONNECTION
+G_DTLS_CLIENT_CONNECTION
+G_DTLS_CLIENT_CONNECTION_GET_INTERFACE
+G_TYPE_DTLS_CLIENT_CONNECTION
+<SUBSECTION Private>
+g_dtls_client_connection_get_type
+</SECTION>
+
+<SECTION>
+<FILE>gdtlsserverconnection</FILE>
+<TITLE>GDtlsServerConnection</TITLE>
+GDtlsServerConnection
+GDtlsServerConnectionInterface
+g_dtls_server_connection_new
+<SUBSECTION Standard>
+G_IS_DTLS_SERVER_CONNECTION
+G_DTLS_SERVER_CONNECTION
+G_DTLS_SERVER_CONNECTION_GET_INTERFACE
+G_TYPE_DTLS_SERVER_CONNECTION
+<SUBSECTION Private>
+g_dtls_server_connection_get_type
+</SECTION>
+
+<SECTION>
<FILE>gdbusinterface</FILE>
<TITLE>GDBusInterface</TITLE>
GDBusInterface
diff --git a/docs/reference/gio/gio.types b/docs/reference/gio/gio.types
index c9be9ed..fdb7a8d 100644
--- a/docs/reference/gio/gio.types
+++ b/docs/reference/gio/gio.types
@@ -45,6 +45,9 @@ g_dbus_signal_info_get_type
g_desktop_app_info_get_type
g_desktop_app_info_lookup_get_type
g_drive_get_type
+g_dtls_client_connection_get_type
+g_dtls_connection_get_type
+g_dtls_server_connection_get_type
g_emblem_get_type
g_emblemed_icon_get_type
g_file_attribute_info_list_get_type
diff --git a/gio/Makefile.am b/gio/Makefile.am
index 3aff3e5..b5b6120 100644
--- a/gio/Makefile.am
+++ b/gio/Makefile.am
@@ -468,6 +468,9 @@ libgio_2_0_la_SOURCES = \
gtlsinteraction.c \
gtlspassword.c \
gtlsserverconnection.c \
+ gdtlsconnection.c \
+ gdtlsclientconnection.c \
+ gdtlsserverconnection.c \
gunionvolumemonitor.c \
gunionvolumemonitor.h \
gvfs.c \
@@ -632,6 +635,9 @@ gio_headers = \
gtlsinteraction.h \
gtlspassword.h \
gtlsserverconnection.h \
+ gdtlsconnection.h \
+ gdtlsclientconnection.h \
+ gdtlsserverconnection.h \
gvfs.h \
gvolume.h \
gvolumemonitor.h \
diff --git a/gio/gdtlsclientconnection.c b/gio/gdtlsclientconnection.c
new file mode 100644
index 0000000..70d9a51
--- /dev/null
+++ b/gio/gdtlsclientconnection.c
@@ -0,0 +1,273 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+#include "glib.h"
+
+#include "gdtlsclientconnection.h"
+#include "ginitable.h"
+#include "gioenumtypes.h"
+#include "gsocket.h"
+#include "gsocketconnectable.h"
+#include "gtlsbackend.h"
+#include "gtlscertificate.h"
+#include "glibintl.h"
+
+/**
+ * SECTION:gdtlsclientconnection
+ * @short_description: DTLS client-side connection
+ * @include: gio/gio.h
+ *
+ * #GDtlsClientConnection is the client-side subclass of
+ * #GDtlsConnection, representing a client-side DTLS connection.
+ *
+ * Since: 2.48
+ */
+
+/**
+ * GDtlsClientConnection:
+ *
+ * Abstract base class for the backend-specific client connection
+ * type.
+ *
+ * Since: 2.48
+ */
+
+G_DEFINE_INTERFACE (GDtlsClientConnection, g_dtls_client_connection,
+ G_TYPE_DTLS_CONNECTION)
+
+static void
+g_dtls_client_connection_default_init (GDtlsClientConnectionInterface *iface)
+{
+ /**
+ * GDtlsClientConnection:validation-flags:
+ *
+ * What steps to perform when validating a certificate received from
+ * a server. Server certificates that fail to validate in all of the
+ * ways indicated here will be rejected unless the application
+ * overrides the default via #GDtlsConnection::accept-certificate.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_flags ("validation-flags",
+ P_("Validation flags"),
+ P_("What certificate validation to perform"),
+ G_TYPE_TLS_CERTIFICATE_FLAGS,
+ G_TLS_CERTIFICATE_VALIDATE_ALL,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ G_PARAM_STATIC_STRINGS));
+
+ /**
+ * GDtlsClientConnection:server-identity:
+ *
+ * A #GSocketConnectable describing the identity of the server that
+ * is expected on the other end of the connection.
+ *
+ * If the %G_TLS_CERTIFICATE_BAD_IDENTITY flag is set in
+ * #GDtlsClientConnection:validation-flags, this object will be used
+ * to determine the expected identify of the remote end of the
+ * connection; if #GDtlsClientConnection:server-identity is not set,
+ * or does not match the identity presented by the server, then the
+ * %G_TLS_CERTIFICATE_BAD_IDENTITY validation will fail.
+ *
+ * In addition to its use in verifying the server certificate,
+ * this is also used to give a hint to the server about what
+ * certificate we expect, which is useful for servers that serve
+ * virtual hosts.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("server-identity",
+ P_("Server identity"),
+ P_("GSocketConnectable identifying the server"),
+ G_TYPE_SOCKET_CONNECTABLE,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ G_PARAM_STATIC_STRINGS));
+
+ /**
+ * GDtlsClientConnection:accepted-cas: (type GLib.List) (element-type GLib.ByteArray)
+ *
+ * A list of the distinguished names of the Certificate Authorities
+ * that the server will accept client certificates signed by. If the
+ * server requests a client certificate during the handshake, then
+ * this property will be set after the handshake completes.
+ *
+ * Each item in the list is a #GByteArray which contains the complete
+ * subject DN of the certificate authority.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_pointer ("accepted-cas",
+ P_("Accepted CAs"),
+ P_("Distinguished names of the CAs the server
accepts certificates from"),
+ G_PARAM_READABLE |
+ G_PARAM_STATIC_STRINGS));
+}
+
+/**
+ * g_dtls_client_connection_new:
+ * @base_socket: the #GDatagramBased to wrap
+ * @server_identity: (allow-none): the expected identity of the server
+ * @error: #GError for error reporting, or %NULL to ignore.
+ *
+ * Creates a new #GDtlsClientConnection wrapping @base_socket which is
+ * assumed to communicate with the server identified by @server_identity.
+ *
+ * Returns: (transfer full) (type GDtlsClientConnection): the new
+ * #GDtlsClientConnection, or %NULL on error
+ *
+ * Since: 2.48
+ */
+GDatagramBased *
+g_dtls_client_connection_new (GDatagramBased *base_socket,
+ GSocketConnectable *server_identity,
+ GError **error)
+{
+ GObject *conn;
+ GTlsBackend *backend;
+
+ backend = g_tls_backend_get_default ();
+ conn = g_initable_new (g_tls_backend_get_dtls_client_connection_type (backend),
+ NULL, error,
+ "base-socket", base_socket,
+ "server-identity", server_identity,
+ NULL);
+ return G_DATAGRAM_BASED (conn);
+}
+
+/**
+ * g_dtls_client_connection_get_validation_flags:
+ * @conn: the #GDtlsClientConnection
+ *
+ * Gets @conn's validation flags
+ *
+ * Returns: the validation flags
+ *
+ * Since: 2.48
+ */
+GTlsCertificateFlags
+g_dtls_client_connection_get_validation_flags (GDtlsClientConnection *conn)
+{
+ GTlsCertificateFlags flags = 0;
+
+ g_return_val_if_fail (G_IS_DTLS_CLIENT_CONNECTION (conn), 0);
+
+ g_object_get (G_OBJECT (conn), "validation-flags", &flags, NULL);
+ return flags;
+}
+
+/**
+ * g_dtls_client_connection_set_validation_flags:
+ * @conn: the #GDtlsClientConnection
+ * @flags: the #GTlsCertificateFlags to use
+ *
+ * Sets @conn's validation flags, to override the default set of
+ * checks performed when validating a server certificate. By default,
+ * %G_TLS_CERTIFICATE_VALIDATE_ALL is used.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_client_connection_set_validation_flags (GDtlsClientConnection *conn,
+ GTlsCertificateFlags flags)
+{
+ g_return_if_fail (G_IS_DTLS_CLIENT_CONNECTION (conn));
+
+ g_object_set (G_OBJECT (conn), "validation-flags", flags, NULL);
+}
+
+/**
+ * g_dtls_client_connection_get_server_identity:
+ * @conn: the #GDtlsClientConnection
+ *
+ * Gets @conn's expected server identity
+ *
+ * Returns: (transfer none): a #GSocketConnectable describing the
+ * expected server identity, or %NULL if the expected identity is not
+ * known.
+ *
+ * Since: 2.48
+ */
+GSocketConnectable *
+g_dtls_client_connection_get_server_identity (GDtlsClientConnection *conn)
+{
+ GSocketConnectable *identity = NULL;
+
+ g_return_val_if_fail (G_IS_DTLS_CLIENT_CONNECTION (conn), 0);
+
+ g_object_get (G_OBJECT (conn), "server-identity", &identity, NULL);
+ if (identity)
+ g_object_unref (identity);
+ return identity;
+}
+
+/**
+ * g_dtls_client_connection_set_server_identity:
+ * @conn: the #GDtlsClientConnection
+ * @identity: a #GSocketConnectable describing the expected server identity
+ *
+ * Sets @conn's expected server identity, which is used both to tell
+ * servers on virtual hosts which certificate to present, and also
+ * to let @conn know what name to look for in the certificate when
+ * performing %G_TLS_CERTIFICATE_BAD_IDENTITY validation, if enabled.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_client_connection_set_server_identity (GDtlsClientConnection *conn,
+ GSocketConnectable *identity)
+{
+ g_return_if_fail (G_IS_DTLS_CLIENT_CONNECTION (conn));
+
+ g_object_set (G_OBJECT (conn), "server-identity", identity, NULL);
+}
+
+/**
+ * g_dtls_client_connection_get_accepted_cas:
+ * @conn: the #GDtlsClientConnection
+ *
+ * Gets the list of distinguished names of the Certificate Authorities
+ * that the server will accept certificates from. This will be set
+ * during the TLS handshake if the server requests a certificate.
+ * Otherwise, it will be %NULL.
+ *
+ * Each item in the list is a #GByteArray which contains the complete
+ * subject DN of the certificate authority.
+ *
+ * Returns: (element-type GByteArray) (transfer full): the list of
+ * CA DNs. You should unref each element with g_byte_array_unref() and then
+ * the free the list with g_list_free().
+ *
+ * Since: 2.48
+ */
+GList *
+g_dtls_client_connection_get_accepted_cas (GDtlsClientConnection *conn)
+{
+ GList *accepted_cas = NULL;
+
+ g_return_val_if_fail (G_IS_DTLS_CLIENT_CONNECTION (conn), NULL);
+
+ g_object_get (G_OBJECT (conn), "accepted-cas", &accepted_cas, NULL);
+ return accepted_cas;
+}
diff --git a/gio/gdtlsclientconnection.h b/gio/gdtlsclientconnection.h
new file mode 100644
index 0000000..3296b59
--- /dev/null
+++ b/gio/gdtlsclientconnection.h
@@ -0,0 +1,75 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc.
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __G_DTLS_CLIENT_CONNECTION_H__
+#define __G_DTLS_CLIENT_CONNECTION_H__
+
+#if !defined (__GIO_GIO_H_INSIDE__) && !defined (GIO_COMPILATION)
+#error "Only <gio/gio.h> can be included directly."
+#endif
+
+#include <gio/gdtlsconnection.h>
+
+G_BEGIN_DECLS
+
+#define G_TYPE_DTLS_CLIENT_CONNECTION (g_dtls_client_connection_get_type ())
+#define G_DTLS_CLIENT_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_CAST ((inst),
G_TYPE_DTLS_CLIENT_CONNECTION, GDtlsClientConnection))
+#define G_IS_DTLS_CLIENT_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_TYPE ((inst),
G_TYPE_DTLS_CLIENT_CONNECTION))
+#define G_DTLS_CLIENT_CONNECTION_GET_INTERFACE(inst) (G_TYPE_INSTANCE_GET_INTERFACE ((inst),
G_TYPE_DTLS_CLIENT_CONNECTION, GDtlsClientConnectionInterface))
+
+typedef struct _GDtlsClientConnectionInterface GDtlsClientConnectionInterface;
+
+/**
+ * GDtlsClientConnectionInterface:
+ * @g_iface: The parent interface.
+ *
+ * vtable for a #GDtlsClientConnection implementation.
+ *
+ * Since: 2.48
+ */
+struct _GDtlsClientConnectionInterface
+{
+ GTypeInterface g_iface;
+};
+
+GLIB_AVAILABLE_IN_2_48
+GType g_dtls_client_connection_get_type (void) G_GNUC_CONST;
+
+GLIB_AVAILABLE_IN_2_48
+GDatagramBased *g_dtls_client_connection_new (GDatagramBased *base_socket,
+ GSocketConnectable *server_identity,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+GTlsCertificateFlags g_dtls_client_connection_get_validation_flags (GDtlsClientConnection *conn);
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_client_connection_set_validation_flags (GDtlsClientConnection *conn,
+ GTlsCertificateFlags flags);
+GLIB_AVAILABLE_IN_2_48
+GSocketConnectable *g_dtls_client_connection_get_server_identity (GDtlsClientConnection *conn);
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_client_connection_set_server_identity (GDtlsClientConnection *conn,
+ GSocketConnectable *identity);
+GLIB_AVAILABLE_IN_2_48
+GList * g_dtls_client_connection_get_accepted_cas (GDtlsClientConnection *conn);
+
+
+G_END_DECLS
+
+#endif /* __G_DTLS_CLIENT_CONNECTION_H__ */
diff --git a/gio/gdtlsconnection.c b/gio/gdtlsconnection.c
new file mode 100644
index 0000000..08fa84f
--- /dev/null
+++ b/gio/gdtlsconnection.c
@@ -0,0 +1,975 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+#include "glib.h"
+
+#include "gdtlsconnection.h"
+#include "gcancellable.h"
+#include "gioenumtypes.h"
+#include "gsocket.h"
+#include "gtlsbackend.h"
+#include "gtlscertificate.h"
+#include "gdtlsclientconnection.h"
+#include "gtlsdatabase.h"
+#include "gtlsinteraction.h"
+#include "glibintl.h"
+
+/**
+ * SECTION:gdtlsconnection
+ * @short_description: DTLS connection type
+ * @include: gio/gio.h
+ *
+ * #GDtlsConnection is the base DTLS connection class type, which wraps
+ * a #GDatagramBased and provides DTLS encryption on top of it. Its
+ * subclasses, #GDtlsClientConnection and #GDtlsServerConnection,
+ * implement client-side and server-side DTLS, respectively.
+ *
+ * For TLS support, see #GTlsConnection.
+ *
+ * As DTLS is datagram based, #GDtlsConnection implements #GDatagramBased,
+ * presenting a datagram-socket-like API for the encrypted connection. This
+ * operates over a base datagram connection, which is also a #GDatagramBased
+ * (#GDtlsConnection:base-socket).
+ *
+ * To close a DTLS connection, use g_dtls_connection_close().
+ *
+ * Neither #GDtlsServerConnection or #GDtlsClientConnection set the peer address
+ * on their base #GDatagramBased if it is a #GSocket — it is up to the caller to
+ * do that if they wish. If they do not, and g_socket_close() is called on the
+ * base socket, the #GDtlsConnection will not raise a %G_IO_ERROR_NOT_CONNECTED
+ * error on further I/O.
+ *
+ * Since: 2.48
+ */
+
+/**
+ * GDtlsConnection:
+ *
+ * Abstract base class for the backend-specific #GDtlsClientConnection
+ * and #GDtlsServerConnection types.
+ *
+ * Since: 2.48
+ */
+
+G_DEFINE_INTERFACE (GDtlsConnection, g_dtls_connection, G_TYPE_DATAGRAM_BASED);
+
+enum {
+ ACCEPT_CERTIFICATE,
+ LAST_SIGNAL
+};
+
+static guint signals[LAST_SIGNAL] = { 0 };
+
+enum {
+ PROP_BASE_SOCKET = 1,
+ PROP_REQUIRE_CLOSE_NOTIFY,
+ PROP_REHANDSHAKE_MODE,
+ PROP_DATABASE,
+ PROP_INTERACTION,
+ PROP_CERTIFICATE,
+ PROP_PEER_CERTIFICATE,
+ PROP_PEER_CERTIFICATE_ERRORS,
+};
+
+static void
+g_dtls_connection_default_init (GDtlsConnectionInterface *iface)
+{
+ /**
+ * GDtlsConnection:base-socket:
+ *
+ * The #GDatagramBased that the connection wraps. Note that this may be any
+ * implementation of #GDatagramBased, not just a #GSocket.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("base-socket",
+ P_("Base Socket"),
+ P_("The GDatagramBased that the connection
wraps"),
+ G_TYPE_DATAGRAM_BASED,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT_ONLY |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:database:
+ *
+ * The certificate database to use when verifying this TLS connection.
+ * If no certificate database is set, then the default database will be
+ * used. See g_dtls_backend_get_default_database().
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("database",
+ P_("Database"),
+ P_("Certificate database to use for looking up
or verifying certificates"),
+ G_TYPE_TLS_DATABASE,
+ G_PARAM_READWRITE |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:interaction:
+ *
+ * A #GTlsInteraction object to be used when the connection or certificate
+ * database need to interact with the user. This will be used to prompt the
+ * user for passwords where necessary.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("interaction",
+ P_("Interaction"),
+ P_("Optional object for user interaction"),
+ G_TYPE_TLS_INTERACTION,
+ G_PARAM_READWRITE |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:require-close-notify:
+ *
+ * Whether or not proper TLS close notification is required.
+ * See g_dtls_connection_set_require_close_notify().
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_boolean ("require-close-notify",
+ P_("Require close notify"),
+ P_("Whether to require proper TLS close
notification"),
+ TRUE,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:rehandshake-mode:
+ *
+ * The rehandshaking mode. See
+ * g_dtls_connection_set_rehandshake_mode().
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_enum ("rehandshake-mode",
+ P_("Rehandshake mode"),
+ P_("When to allow rehandshaking"),
+ G_TYPE_TLS_REHANDSHAKE_MODE,
+ G_TLS_REHANDSHAKE_NEVER,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:certificate:
+ *
+ * The connection's certificate; see
+ * g_dtls_connection_set_certificate().
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("certificate",
+ P_("Certificate"),
+ P_("The connection's certificate"),
+ G_TYPE_TLS_CERTIFICATE,
+ G_PARAM_READWRITE |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:peer-certificate:
+ *
+ * The connection's peer's certificate, after the TLS handshake has
+ * completed and the certificate has been accepted. Note in
+ * particular that this is not yet set during the emission of
+ * #GDtlsConnection::accept-certificate.
+ *
+ * (You can watch for a #GObject::notify signal on this property to
+ * detect when a handshake has occurred.)
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_object ("peer-certificate",
+ P_("Peer Certificate"),
+ P_("The connection's peer's certificate"),
+ G_TYPE_TLS_CERTIFICATE,
+ G_PARAM_READABLE |
+ G_PARAM_STATIC_STRINGS));
+ /**
+ * GDtlsConnection:peer-certificate-errors:
+ *
+ * The errors noticed-and-ignored while verifying
+ * #GDtlsConnection:peer-certificate. Normally this should be 0, but
+ * it may not be if #GDtlsClientConnection:validation-flags is not
+ * %G_TLS_CERTIFICATE_VALIDATE_ALL, or if
+ * #GDtlsConnection::accept-certificate overrode the default
+ * behavior.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_flags ("peer-certificate-errors",
+ P_("Peer Certificate Errors"),
+ P_("Errors found with the peer's certificate"),
+ G_TYPE_TLS_CERTIFICATE_FLAGS,
+ 0,
+ G_PARAM_READABLE |
+ G_PARAM_STATIC_STRINGS));
+
+ /**
+ * GDtlsConnection::accept-certificate:
+ * @conn: a #GDtlsConnection
+ * @peer_cert: the peer's #GTlsCertificate
+ * @errors: the problems with @peer_cert.
+ *
+ * Emitted during the TLS handshake after the peer certificate has
+ * been received. You can examine @peer_cert's certification path by
+ * calling g_tls_certificate_get_issuer() on it.
+ *
+ * For a client-side connection, @peer_cert is the server's
+ * certificate, and the signal will only be emitted if the
+ * certificate was not acceptable according to @conn's
+ * #GDtlsClientConnection:validation_flags. If you would like the
+ * certificate to be accepted despite @errors, return %TRUE from the
+ * signal handler. Otherwise, if no handler accepts the certificate,
+ * the handshake will fail with %G_TLS_ERROR_BAD_CERTIFICATE.
+ *
+ * For a server-side connection, @peer_cert is the certificate
+ * presented by the client, if this was requested via the server's
+ * #GDtlsServerConnection:authentication_mode. On the server side,
+ * the signal is always emitted when the client presents a
+ * certificate, and the certificate will only be accepted if a
+ * handler returns %TRUE.
+ *
+ * Note that if this signal is emitted as part of asynchronous I/O
+ * in the main thread, then you should not attempt to interact with
+ * the user before returning from the signal handler. If you want to
+ * let the user decide whether or not to accept the certificate, you
+ * would have to return %FALSE from the signal handler on the first
+ * attempt, and then after the connection attempt returns a
+ * %G_TLS_ERROR_HANDSHAKE, you can interact with the user, and if
+ * the user decides to accept the certificate, remember that fact,
+ * create a new connection, and return %TRUE from the signal handler
+ * the next time.
+ *
+ * If you are doing I/O in another thread, you do not
+ * need to worry about this, and can simply block in the signal
+ * handler until the UI thread returns an answer.
+ *
+ * Returns: %TRUE to accept @peer_cert (which will also
+ * immediately end the signal emission). %FALSE to allow the signal
+ * emission to continue, which will cause the handshake to fail if
+ * no one else overrides it.
+ *
+ * Since: 2.48
+ */
+ signals[ACCEPT_CERTIFICATE] =
+ g_signal_new (I_("accept-certificate"),
+ G_TYPE_DTLS_CONNECTION,
+ G_SIGNAL_RUN_LAST,
+ G_STRUCT_OFFSET (GDtlsConnectionInterface, accept_certificate),
+ g_signal_accumulator_true_handled, NULL,
+ NULL,
+ G_TYPE_BOOLEAN, 2,
+ G_TYPE_TLS_CERTIFICATE,
+ G_TYPE_TLS_CERTIFICATE_FLAGS);
+}
+
+/**
+ * g_dtls_connection_set_database:
+ * @conn: a #GDtlsConnection
+ * @database: a #GTlsDatabase
+ *
+ * Sets the certificate database that is used to verify peer certificates.
+ * This is set to the default database by default. See
+ * g_dtls_backend_get_default_database(). If set to %NULL, then
+ * peer certificate validation will always set the
+ * %G_TLS_CERTIFICATE_UNKNOWN_CA error (meaning
+ * #GDtlsConnection::accept-certificate will always be emitted on
+ * client-side connections, unless that bit is not set in
+ * #GDtlsClientConnection:validation-flags).
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_set_database (GDtlsConnection *conn,
+ GTlsDatabase *database)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+ g_return_if_fail (database == NULL || G_IS_TLS_DATABASE (database));
+
+ g_object_set (G_OBJECT (conn),
+ "database", database,
+ NULL);
+}
+
+/**
+ * g_dtls_connection_get_database:
+ * @conn: a #GDtlsConnection
+ *
+ * Gets the certificate database that @conn uses to verify
+ * peer certificates. See g_dtls_connection_set_database().
+ *
+ * Returns: (transfer none): the certificate database that @conn uses or %NULL
+ *
+ * Since: 2.48
+ */
+GTlsDatabase*
+g_dtls_connection_get_database (GDtlsConnection *conn)
+{
+ GTlsDatabase *database = NULL;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), NULL);
+
+ g_object_get (G_OBJECT (conn),
+ "database", &database,
+ NULL);
+ if (database)
+ g_object_unref (database);
+ return database;
+}
+
+/**
+ * g_dtls_connection_set_certificate:
+ * @conn: a #GDtlsConnection
+ * @certificate: the certificate to use for @conn
+ *
+ * This sets the certificate that @conn will present to its peer
+ * during the TLS handshake. For a #GDtlsServerConnection, it is
+ * mandatory to set this, and that will normally be done at construct
+ * time.
+ *
+ * For a #GDtlsClientConnection, this is optional. If a handshake fails
+ * with %G_TLS_ERROR_CERTIFICATE_REQUIRED, that means that the server
+ * requires a certificate, and if you try connecting again, you should
+ * call this method first. You can call
+ * g_dtls_client_connection_get_accepted_cas() on the failed connection
+ * to get a list of Certificate Authorities that the server will
+ * accept certificates from.
+ *
+ * (It is also possible that a server will allow the connection with
+ * or without a certificate; in that case, if you don't provide a
+ * certificate, you can tell that the server requested one by the fact
+ * that g_dtls_client_connection_get_accepted_cas() will return
+ * non-%NULL.)
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_set_certificate (GDtlsConnection *conn,
+ GTlsCertificate *certificate)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+ g_return_if_fail (G_IS_TLS_CERTIFICATE (certificate));
+
+ g_object_set (G_OBJECT (conn), "certificate", certificate, NULL);
+}
+
+/**
+ * g_dtls_connection_get_certificate:
+ * @conn: a #GDtlsConnection
+ *
+ * Gets @conn's certificate, as set by
+ * g_dtls_connection_set_certificate().
+ *
+ * Returns: (transfer none): @conn's certificate, or %NULL
+ *
+ * Since: 2.48
+ */
+GTlsCertificate *
+g_dtls_connection_get_certificate (GDtlsConnection *conn)
+{
+ GTlsCertificate *certificate;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), NULL);
+
+ g_object_get (G_OBJECT (conn), "certificate", &certificate, NULL);
+ if (certificate)
+ g_object_unref (certificate);
+
+ return certificate;
+}
+
+/**
+ * g_dtls_connection_set_interaction:
+ * @conn: a connection
+ * @interaction: (allow-none): an interaction object, or %NULL
+ *
+ * Set the object that will be used to interact with the user. It will be used
+ * for things like prompting the user for passwords.
+ *
+ * The @interaction argument will normally be a derived subclass of
+ * #GTlsInteraction. %NULL can also be provided if no user interaction
+ * should occur for this connection.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_set_interaction (GDtlsConnection *conn,
+ GTlsInteraction *interaction)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+ g_return_if_fail (interaction == NULL || G_IS_TLS_INTERACTION (interaction));
+
+ g_object_set (G_OBJECT (conn), "interaction", interaction, NULL);
+}
+
+/**
+ * g_dtls_connection_get_interaction:
+ * @conn: a connection
+ *
+ * Get the object that will be used to interact with the user. It will be used
+ * for things like prompting the user for passwords. If %NULL is returned, then
+ * no user interaction will occur for this connection.
+ *
+ * Returns: (transfer none): The interaction object.
+ *
+ * Since: 2.48
+ */
+GTlsInteraction *
+g_dtls_connection_get_interaction (GDtlsConnection *conn)
+{
+ GTlsInteraction *interaction = NULL;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), NULL);
+
+ g_object_get (G_OBJECT (conn), "interaction", &interaction, NULL);
+ if (interaction)
+ g_object_unref (interaction);
+
+ return interaction;
+}
+
+/**
+ * g_dtls_connection_get_peer_certificate:
+ * @conn: a #GDtlsConnection
+ *
+ * Gets @conn's peer's certificate after the handshake has completed.
+ * (It is not set during the emission of
+ * #GDtlsConnection::accept-certificate.)
+ *
+ * Returns: (transfer none): @conn's peer's certificate, or %NULL
+ *
+ * Since: 2.48
+ */
+GTlsCertificate *
+g_dtls_connection_get_peer_certificate (GDtlsConnection *conn)
+{
+ GTlsCertificate *peer_certificate;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), NULL);
+
+ g_object_get (G_OBJECT (conn), "peer-certificate", &peer_certificate, NULL);
+ if (peer_certificate)
+ g_object_unref (peer_certificate);
+
+ return peer_certificate;
+}
+
+/**
+ * g_dtls_connection_get_peer_certificate_errors:
+ * @conn: a #GDtlsConnection
+ *
+ * Gets the errors associated with validating @conn's peer's
+ * certificate, after the handshake has completed. (It is not set
+ * during the emission of #GDtlsConnection::accept-certificate.)
+ *
+ * Returns: @conn's peer's certificate errors
+ *
+ * Since: 2.48
+ */
+GTlsCertificateFlags
+g_dtls_connection_get_peer_certificate_errors (GDtlsConnection *conn)
+{
+ GTlsCertificateFlags errors;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), 0);
+
+ g_object_get (G_OBJECT (conn), "peer-certificate-errors", &errors, NULL);
+ return errors;
+}
+
+/**
+ * g_dtls_connection_set_require_close_notify:
+ * @conn: a #GDtlsConnection
+ * @require_close_notify: whether or not to require close notification
+ *
+ * Sets whether or not @conn expects a proper TLS close notification
+ * before the connection is closed. If this is %TRUE (the default),
+ * then @conn will expect to receive a TLS close notification from its
+ * peer before the connection is closed, and will return a
+ * %G_TLS_ERROR_EOF error if the connection is closed without proper
+ * notification (since this may indicate a network error, or
+ * man-in-the-middle attack).
+ *
+ * In some protocols, the application will know whether or not the
+ * connection was closed cleanly based on application-level data
+ * (because the application-level data includes a length field, or is
+ * somehow self-delimiting); in this case, the close notify is
+ * redundant and may be omitted. You
+ * can use g_dtls_connection_set_require_close_notify() to tell @conn
+ * to allow an "unannounced" connection close, in which case the close
+ * will show up as a 0-length read, as in a non-TLS
+ * #GDatagramBased, and it is up to the application to check that
+ * the data has been fully received.
+ *
+ * Note that this only affects the behavior when the peer closes the
+ * connection; when the application calls g_dtls_connection_close_async() on
+ * @conn itself, this will send a close notification regardless of the
+ * setting of this property. If you explicitly want to do an unclean
+ * close, you can close @conn's #GDtlsConnection:base-socket rather
+ * than closing @conn itself.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_set_require_close_notify (GDtlsConnection *conn,
+ gboolean require_close_notify)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+
+ g_object_set (G_OBJECT (conn),
+ "require-close-notify", require_close_notify,
+ NULL);
+}
+
+/**
+ * g_dtls_connection_get_require_close_notify:
+ * @conn: a #GDtlsConnection
+ *
+ * Tests whether or not @conn expects a proper TLS close notification
+ * when the connection is closed. See
+ * g_dtls_connection_set_require_close_notify() for details.
+ *
+ * Returns: %TRUE if @conn requires a proper TLS close notification.
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_get_require_close_notify (GDtlsConnection *conn)
+{
+ gboolean require_close_notify;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), TRUE);
+
+ g_object_get (G_OBJECT (conn),
+ "require-close-notify", &require_close_notify,
+ NULL);
+ return require_close_notify;
+}
+
+/**
+ * g_dtls_connection_set_rehandshake_mode:
+ * @conn: a #GDtlsConnection
+ * @mode: the rehandshaking mode
+ *
+ * Sets how @conn behaves with respect to rehandshaking requests.
+ *
+ * %G_TLS_REHANDSHAKE_NEVER means that it will never agree to
+ * rehandshake after the initial handshake is complete. (For a client,
+ * this means it will refuse rehandshake requests from the server, and
+ * for a server, this means it will close the connection with an error
+ * if the client attempts to rehandshake.)
+ *
+ * %G_TLS_REHANDSHAKE_SAFELY means that the connection will allow a
+ * rehandshake only if the other end of the connection supports the
+ * TLS `renegotiation_info` extension. This is the default behavior,
+ * but means that rehandshaking will not work against older
+ * implementations that do not support that extension.
+ *
+ * %G_TLS_REHANDSHAKE_UNSAFELY means that the connection will allow
+ * rehandshaking even without the `renegotiation_info` extension. On
+ * the server side in particular, this is not recommended, since it
+ * leaves the server open to certain attacks. However, this mode is
+ * necessary if you need to allow renegotiation with older client
+ * software.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_set_rehandshake_mode (GDtlsConnection *conn,
+ GTlsRehandshakeMode mode)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+
+ g_object_set (G_OBJECT (conn),
+ "rehandshake-mode", mode,
+ NULL);
+}
+
+/**
+ * g_dtls_connection_get_rehandshake_mode:
+ * @conn: a #GDtlsConnection
+ *
+ * Gets @conn rehandshaking mode. See
+ * g_dtls_connection_set_rehandshake_mode() for details.
+ *
+ * Returns: @conn's rehandshaking mode
+ *
+ * Since: 2.48
+ */
+GTlsRehandshakeMode
+g_dtls_connection_get_rehandshake_mode (GDtlsConnection *conn)
+{
+ GTlsRehandshakeMode mode;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), G_TLS_REHANDSHAKE_NEVER);
+
+ g_object_get (G_OBJECT (conn),
+ "rehandshake-mode", &mode,
+ NULL);
+ return mode;
+}
+
+/**
+ * g_dtls_connection_handshake:
+ * @conn: a #GDtlsConnection
+ * @cancellable: (allow-none): a #GCancellable, or %NULL
+ * @error: a #GError, or %NULL
+ *
+ * Attempts a TLS handshake on @conn.
+ *
+ * On the client side, it is never necessary to call this method;
+ * although the connection needs to perform a handshake after
+ * connecting (or after sending a "STARTTLS"-type command) and may
+ * need to rehandshake later if the server requests it,
+ * #GDtlsConnection will handle this for you automatically when you try
+ * to send or receive data on the connection. However, you can call
+ * g_dtls_connection_handshake() manually if you want to know for sure
+ * whether the initial handshake succeeded or failed (as opposed to
+ * just immediately trying to write to @conn, in which
+ * case if it fails, it may not be possible to tell if it failed
+ * before or after completing the handshake).
+ *
+ * Likewise, on the server side, although a handshake is necessary at
+ * the beginning of the communication, you do not need to call this
+ * function explicitly unless you want clearer error reporting.
+ * However, you may call g_dtls_connection_handshake() later on to
+ * renegotiate parameters (encryption methods, etc) with the client.
+ *
+ * #GDtlsConnection::accept_certificate may be emitted during the
+ * handshake.
+ *
+ * Returns: success or failure
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_handshake (GDtlsConnection *conn,
+ GCancellable *cancellable,
+ GError **error)
+{
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+
+ return G_DTLS_CONNECTION_GET_INTERFACE (conn)->handshake (conn, cancellable,
+ error);
+}
+
+/**
+ * g_dtls_connection_handshake_async:
+ * @conn: a #GDtlsConnection
+ * @io_priority: the [I/O priority][io-priority] of the request
+ * @cancellable: (allow-none): a #GCancellable, or %NULL
+ * @callback: callback to call when the handshake is complete
+ * @user_data: the data to pass to the callback function
+ *
+ * Asynchronously performs a TLS handshake on @conn. See
+ * g_dtls_connection_handshake() for more information.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_handshake_async (GDtlsConnection *conn,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+
+ G_DTLS_CONNECTION_GET_INTERFACE (conn)->handshake_async (conn, io_priority,
+ cancellable,
+ callback, user_data);
+}
+
+/**
+ * g_dtls_connection_handshake_finish:
+ * @conn: a #GDtlsConnection
+ * @result: a #GAsyncResult.
+ * @error: a #GError pointer, or %NULL
+ *
+ * Finish an asynchronous TLS handshake operation. See
+ * g_dtls_connection_handshake() for more information.
+ *
+ * Returns: %TRUE on success, %FALSE on failure, in which
+ * case @error will be set.
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_handshake_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error)
+{
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+
+ return G_DTLS_CONNECTION_GET_INTERFACE (conn)->handshake_finish (conn,
+ result,
+ error);
+}
+
+/**
+ * g_dtls_connection_shutdown:
+ * @conn: a #GDtlsConnection
+ * @shutdown_read: %TRUE to stop reception of incoming datagrams
+ * @shutdown_write: %TRUE to stop sending outgoing datagrams
+ * @cancellable: (nullable): a #GCancellable, or %NULL
+ * @error: a #GError, or %NULL
+ *
+ * Shut down part or all of a DTLS connection.
+ *
+ * If @shutdown_read is %TRUE then the receiving side of the connection is shut
+ * down, and further reading is disallowed. Subsequent calls to
+ * g_datagram_based_receive_messages() will return %G_IO_ERROR_CLOSED.
+ *
+ * If @shutdown_write is %TRUE then the sending side of the connection is shut
+ * down, and further writing is disallowed. Subsequent calls to
+ * g_datagram_based_send_messages() will return %G_IO_ERROR_CLOSED.
+ *
+ * It is allowed for both @shutdown_read and @shutdown_write to be TRUE — this
+ * is equivalent to calling g_dtls_connection_close().
+ *
+ * If @cancellable is cancelled, the #GDtlsConnection may be left
+ * partially-closed and any pending untransmitted data may be lost. Call
+ * g_dtls_connection_shutdown() again to complete closing the #GDtlsConnection.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_shutdown (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ GCancellable *cancellable,
+ GError **error)
+{
+ GDtlsConnectionInterface *iface;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+ g_return_val_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable),
+ FALSE);
+ g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+
+ if (!shutdown_read && !shutdown_write)
+ return TRUE;
+
+ iface = G_DTLS_CONNECTION_GET_INTERFACE (conn);
+ g_assert (iface->shutdown != NULL);
+
+ return iface->shutdown (conn, shutdown_read, shutdown_write,
+ cancellable, error);
+}
+
+/**
+ * g_dtls_connection_shutdown_async:
+ * @conn: a #GDtlsConnection
+ * @shutdown_read: %TRUE to stop reception of incoming datagrams
+ * @shutdown_write: %TRUE to stop sending outgoing datagrams
+ * @io_priority: the [I/O priority][io-priority] of the request
+ * @cancellable: (nullable): a #GCancellable, or %NULL
+ * @callback: callback to call when the shutdown operation is complete
+ * @user_data: the data to pass to the callback function
+ *
+ * Asynchronously shut down part or all of the DTLS connection. See
+ * g_dtls_connection_shutdown() for more information.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_shutdown_async (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data)
+{
+ GDtlsConnectionInterface *iface;
+
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+ g_return_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable));
+
+ iface = G_DTLS_CONNECTION_GET_INTERFACE (conn);
+ g_assert (iface->shutdown_async != NULL);
+
+ iface->shutdown_async (conn, TRUE, TRUE, io_priority, cancellable,
+ callback, user_data);
+}
+
+/**
+ * g_dtls_connection_shutdown_finish:
+ * @conn: a #GDtlsConnection
+ * @result: a #GAsyncResult
+ * @error: a #GError pointer, or %NULL
+ *
+ * Finish an asynchronous TLS shutdown operation. See
+ * g_dtls_connection_shutdown() for more information.
+ *
+ * Returns: %TRUE on success, %FALSE on failure, in which
+ * case @error will be set
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_shutdown_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error)
+{
+ GDtlsConnectionInterface *iface;
+
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+ g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+
+ iface = G_DTLS_CONNECTION_GET_INTERFACE (conn);
+ g_assert (iface->shutdown_finish != NULL);
+
+ return iface->shutdown_finish (conn, result, error);
+}
+
+/**
+ * g_dtls_connection_close:
+ * @conn: a #GDtlsConnection
+ * @cancellable: (nullable): a #GCancellable, or %NULL
+ * @error: a #GError, or %NULL
+ *
+ * Close the DTLS connection. This is equivalent to calling
+ * g_dtls_connection_shutdown() to shut down both sides of the connection.
+ *
+ * Closing a #GDtlsConnection waits for all buffered but untransmitted data to
+ * be sent before it completes. It then sends a `close_notify` DTLS alert to the
+ * peer and may wait for a `close_notify` to be received from the peer. It does
+ * not close the underlying #GDtlsConnection:base-socket; that must be closed
+ * separately.
+ *
+ * Once @conn is closed, all other operations will return %G_IO_ERROR_CLOSED.
+ * Closing a #GDtlsConnection multiple times will not return an error.
+ *
+ * #GDtlsConnections will be automatically closed when the last reference is
+ * dropped, but you might want to call this function to make sure resources are
+ * released as early as possible.
+ *
+ * If @cancellable is cancelled, the #GDtlsConnection may be left
+ * partially-closed and any pending untransmitted data may be lost. Call
+ * g_dtls_connection_close() again to complete closing the #GDtlsConnection.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_close (GDtlsConnection *conn,
+ GCancellable *cancellable,
+ GError **error)
+{
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+ g_return_val_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable),
+ FALSE);
+ g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+
+ return G_DTLS_CONNECTION_GET_INTERFACE (conn)->shutdown (conn, TRUE, TRUE,
+ cancellable, error);
+}
+
+/**
+ * g_dtls_connection_close_async:
+ * @conn: a #GDtlsConnection
+ * @io_priority: the [I/O priority][io-priority] of the request
+ * @cancellable: (nullable): a #GCancellable, or %NULL
+ * @callback: callback to call when the close operation is complete
+ * @user_data: the data to pass to the callback function
+ *
+ * Asynchronously close the DTLS connection. See g_dtls_connection_close() for
+ * more information.
+ *
+ * Since: 2.48
+ */
+void
+g_dtls_connection_close_async (GDtlsConnection *conn,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data)
+{
+ g_return_if_fail (G_IS_DTLS_CONNECTION (conn));
+ g_return_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable));
+
+ G_DTLS_CONNECTION_GET_INTERFACE (conn)->shutdown_async (conn, TRUE, TRUE,
+ io_priority,
+ cancellable,
+ callback, user_data);
+}
+
+/**
+ * g_dtls_connection_close_finish:
+ * @conn: a #GDtlsConnection
+ * @result: a #GAsyncResult
+ * @error: a #GError pointer, or %NULL
+ *
+ * Finish an asynchronous TLS close operation. See g_dtls_connection_close()
+ * for more information.
+ *
+ * Returns: %TRUE on success, %FALSE on failure, in which
+ * case @error will be set
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_close_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error)
+{
+ g_return_val_if_fail (G_IS_DTLS_CONNECTION (conn), FALSE);
+ g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+
+ return G_DTLS_CONNECTION_GET_INTERFACE (conn)->shutdown_finish (conn, result,
+ error);
+}
+
+/**
+ * g_dtls_connection_emit_accept_certificate:
+ * @conn: a #GDtlsConnection
+ * @peer_cert: the peer's #GTlsCertificate
+ * @errors: the problems with @peer_cert
+ *
+ * Used by #GDtlsConnection implementations to emit the
+ * #GDtlsConnection::accept-certificate signal.
+ *
+ * Returns: %TRUE if one of the signal handlers has returned
+ * %TRUE to accept @peer_cert
+ *
+ * Since: 2.48
+ */
+gboolean
+g_dtls_connection_emit_accept_certificate (GDtlsConnection *conn,
+ GTlsCertificate *peer_cert,
+ GTlsCertificateFlags errors)
+{
+ gboolean accept = FALSE;
+
+ g_signal_emit (conn, signals[ACCEPT_CERTIFICATE], 0,
+ peer_cert, errors, &accept);
+ return accept;
+}
diff --git a/gio/gdtlsconnection.h b/gio/gdtlsconnection.h
new file mode 100644
index 0000000..835015c
--- /dev/null
+++ b/gio/gdtlsconnection.h
@@ -0,0 +1,191 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc.
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __G_DTLS_CONNECTION_H__
+#define __G_DTLS_CONNECTION_H__
+
+#if !defined (__GIO_GIO_H_INSIDE__) && !defined (GIO_COMPILATION)
+#error "Only <gio/gio.h> can be included directly."
+#endif
+
+#include <gio/gdatagrambased.h>
+
+G_BEGIN_DECLS
+
+#define G_TYPE_DTLS_CONNECTION (g_dtls_connection_get_type ())
+#define G_DTLS_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_CAST ((inst), G_TYPE_DTLS_CONNECTION,
GDtlsConnection))
+#define G_IS_DTLS_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_TYPE ((inst), G_TYPE_DTLS_CONNECTION))
+#define G_DTLS_CONNECTION_GET_INTERFACE(inst) (G_TYPE_INSTANCE_GET_INTERFACE ((inst),
G_TYPE_DTLS_CONNECTION, GDtlsConnectionInterface))
+
+typedef struct _GDtlsConnectionInterface GDtlsConnectionInterface;
+
+/**
+ * GDtlsConnectionInterface:
+ * @g_iface: The parent interface.
+ * @accept_certificate: Check whether to accept a certificate.
+ * @handshake: Perform a handshake operation.
+ * @handshake_async: Start an asynchronous handshake operation.
+ * @handshake_finish: Finish an asynchronous handshake operation.
+ * @shutdown: Shut down one or both directions of the connection.
+ * @shutdown_async: Start an asynchronous shutdown operation.
+ * @shutdown_finish: Finish an asynchronous shutdown operation.
+ *
+ * Virtual method table for a #GDtlsConnection implementation.
+ *
+ * Since: 2.48
+ */
+struct _GDtlsConnectionInterface
+{
+ GTypeInterface g_iface;
+
+ /* signals */
+ gboolean (*accept_certificate) (GDtlsConnection *connection,
+ GTlsCertificate *peer_cert,
+ GTlsCertificateFlags errors);
+
+ /* methods */
+ gboolean (*handshake) (GDtlsConnection *conn,
+ GCancellable *cancellable,
+ GError **error);
+
+ void (*handshake_async) (GDtlsConnection *conn,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data);
+ gboolean (*handshake_finish) (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error);
+
+ gboolean (*shutdown) (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ GCancellable *cancellable,
+ GError **error);
+
+ void (*shutdown_async) (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data);
+ gboolean (*shutdown_finish) (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error);
+};
+
+GLIB_AVAILABLE_IN_2_48
+GType g_dtls_connection_get_type (void) G_GNUC_CONST;
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_set_database (GDtlsConnection *conn,
+ GTlsDatabase *database);
+GLIB_AVAILABLE_IN_2_48
+GTlsDatabase *g_dtls_connection_get_database (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_set_certificate (GDtlsConnection *conn,
+ GTlsCertificate *certificate);
+GLIB_AVAILABLE_IN_2_48
+GTlsCertificate *g_dtls_connection_get_certificate (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_set_interaction (GDtlsConnection *conn,
+ GTlsInteraction *interaction);
+GLIB_AVAILABLE_IN_2_48
+GTlsInteraction *g_dtls_connection_get_interaction (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+GTlsCertificate *g_dtls_connection_get_peer_certificate (GDtlsConnection *conn);
+GLIB_AVAILABLE_IN_2_48
+GTlsCertificateFlags g_dtls_connection_get_peer_certificate_errors (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_set_require_close_notify (GDtlsConnection *conn,
+ gboolean
require_close_notify);
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_get_require_close_notify (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_set_rehandshake_mode (GDtlsConnection *conn,
+ GTlsRehandshakeMode mode);
+GLIB_AVAILABLE_IN_2_48
+GTlsRehandshakeMode g_dtls_connection_get_rehandshake_mode (GDtlsConnection *conn);
+
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_handshake (GDtlsConnection *conn,
+ GCancellable *cancellable,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_handshake_async (GDtlsConnection *conn,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data);
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_handshake_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_shutdown (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ GCancellable *cancellable,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_shutdown_async (GDtlsConnection *conn,
+ gboolean shutdown_read,
+ gboolean shutdown_write,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data);
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_shutdown_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_close (GDtlsConnection *conn,
+ GCancellable *cancellable,
+ GError **error);
+
+GLIB_AVAILABLE_IN_2_48
+void g_dtls_connection_close_async (GDtlsConnection *conn,
+ int io_priority,
+ GCancellable *cancellable,
+ GAsyncReadyCallback callback,
+ gpointer user_data);
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_close_finish (GDtlsConnection *conn,
+ GAsyncResult *result,
+ GError **error);
+
+/*< protected >*/
+GLIB_AVAILABLE_IN_2_48
+gboolean g_dtls_connection_emit_accept_certificate (GDtlsConnection *conn,
+ GTlsCertificate *peer_cert,
+ GTlsCertificateFlags errors);
+G_END_DECLS
+
+#endif /* __G_DTLS_CONNECTION_H__ */
diff --git a/gio/gdtlsserverconnection.c b/gio/gdtlsserverconnection.c
new file mode 100644
index 0000000..dd736f8
--- /dev/null
+++ b/gio/gdtlsserverconnection.c
@@ -0,0 +1,95 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+#include "glib.h"
+
+#include "gdtlsserverconnection.h"
+#include "ginitable.h"
+#include "gioenumtypes.h"
+#include "gsocket.h"
+#include "gtlsbackend.h"
+#include "gtlscertificate.h"
+#include "glibintl.h"
+
+/**
+ * SECTION:gdtlsserverconnection
+ * @short_description: DTLS server-side connection
+ * @include: gio/gio.h
+ *
+ * #GDtlsServerConnection is the server-side subclass of #GDtlsConnection,
+ * representing a server-side DTLS connection.
+ *
+ * Since: 2.48
+ */
+
+G_DEFINE_INTERFACE (GDtlsServerConnection, g_dtls_server_connection,
+ G_TYPE_DTLS_CONNECTION)
+
+static void
+g_dtls_server_connection_default_init (GDtlsServerConnectionInterface *iface)
+{
+ /**
+ * GDtlsServerConnection:authentication-mode:
+ *
+ * The #GTlsAuthenticationMode for the server. This can be changed
+ * before calling g_dtls_connection_handshake() if you want to
+ * rehandshake with a different mode from the initial handshake.
+ *
+ * Since: 2.48
+ */
+ g_object_interface_install_property (iface,
+ g_param_spec_enum ("authentication-mode",
+ P_("Authentication Mode"),
+ P_("The client authentication mode"),
+ G_TYPE_TLS_AUTHENTICATION_MODE,
+ G_TLS_AUTHENTICATION_NONE,
+ G_PARAM_READWRITE |
+ G_PARAM_STATIC_STRINGS));
+}
+
+/**
+ * g_dtls_server_connection_new:
+ * @base_socket: the #GDatagramBased to wrap
+ * @certificate: (allow-none): the default server certificate, or %NULL
+ * @error: #GError for error reporting, or %NULL to ignore
+ *
+ * Creates a new #GDtlsServerConnection wrapping @base_socket.
+ *
+ * Returns: (transfer full) (type GDtlsServerConnection): the new
+ * #GDtlsServerConnection, or %NULL on error
+ *
+ * Since: 2.48
+ */
+GDatagramBased *
+g_dtls_server_connection_new (GDatagramBased *base_socket,
+ GTlsCertificate *certificate,
+ GError **error)
+{
+ GObject *conn;
+ GTlsBackend *backend;
+
+ backend = g_tls_backend_get_default ();
+ conn = g_initable_new (g_tls_backend_get_dtls_server_connection_type (backend),
+ NULL, error,
+ "base-socket", base_socket,
+ "certificate", certificate,
+ NULL);
+ return G_DATAGRAM_BASED (conn);
+}
diff --git a/gio/gdtlsserverconnection.h b/gio/gdtlsserverconnection.h
new file mode 100644
index 0000000..3082d26
--- /dev/null
+++ b/gio/gdtlsserverconnection.h
@@ -0,0 +1,69 @@
+/* GIO - GLib Input, Output and Streaming Library
+ *
+ * Copyright © 2010 Red Hat, Inc.
+ * Copyright © 2015 Collabora, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __G_DTLS_SERVER_CONNECTION_H__
+#define __G_DTLS_SERVER_CONNECTION_H__
+
+#if !defined (__GIO_GIO_H_INSIDE__) && !defined (GIO_COMPILATION)
+#error "Only <gio/gio.h> can be included directly."
+#endif
+
+#include <gio/gdtlsconnection.h>
+
+G_BEGIN_DECLS
+
+#define G_TYPE_DTLS_SERVER_CONNECTION (g_dtls_server_connection_get_type ())
+#define G_DTLS_SERVER_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_CAST ((inst),
G_TYPE_DTLS_SERVER_CONNECTION, GDtlsServerConnection))
+#define G_IS_DTLS_SERVER_CONNECTION(inst) (G_TYPE_CHECK_INSTANCE_TYPE ((inst),
G_TYPE_DTLS_SERVER_CONNECTION))
+#define G_DTLS_SERVER_CONNECTION_GET_INTERFACE(inst) (G_TYPE_INSTANCE_GET_INTERFACE ((inst),
G_TYPE_DTLS_SERVER_CONNECTION, GDtlsServerConnectionInterface))
+
+/**
+ * GDtlsServerConnection:
+ *
+ * DTLS server-side connection. This is the server-side implementation
+ * of a #GDtlsConnection.
+ *
+ * Since: 2.48
+ */
+typedef struct _GDtlsServerConnectionInterface GDtlsServerConnectionInterface;
+
+/**
+ * GDtlsServerConnectionInterface:
+ * @g_iface: The parent interface.
+ *
+ * vtable for a #GDtlsServerConnection implementation.
+ *
+ * Since: 2.48
+ */
+struct _GDtlsServerConnectionInterface
+{
+ GTypeInterface g_iface;
+};
+
+GLIB_AVAILABLE_IN_2_48
+GType g_dtls_server_connection_get_type (void) G_GNUC_CONST;
+
+GLIB_AVAILABLE_IN_2_48
+GDatagramBased *g_dtls_server_connection_new (GDatagramBased *base_socket,
+ GTlsCertificate *certificate,
+ GError **error);
+
+G_END_DECLS
+
+#endif /* __G_DTLS_SERVER_CONNECTION_H__ */
diff --git a/gio/gdummytlsbackend.c b/gio/gdummytlsbackend.c
index b47f71e..016dd21 100644
--- a/gio/gdummytlsbackend.c
+++ b/gio/gdummytlsbackend.c
@@ -1,6 +1,7 @@
/* GIO - GLib Input, Output and Streaming Library
*
* Copyright (C) 2010 Red Hat, Inc.
+ * Copyright © 2015 Collabora, Ltd.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -25,6 +26,9 @@
#include "gasyncresult.h"
#include "gcancellable.h"
#include "ginitable.h"
+#include "gdtlsclientconnection.h"
+#include "gdtlsconnection.h"
+#include "gdtlsserverconnection.h"
#include "gtlsbackend.h"
#include "gtlscertificate.h"
#include "gtlsclientconnection.h"
@@ -39,6 +43,7 @@
static GType _g_dummy_tls_certificate_get_type (void);
static GType _g_dummy_tls_connection_get_type (void);
+static GType _g_dummy_dtls_connection_get_type (void);
static GType _g_dummy_tls_database_get_type (void);
struct _GDummyTlsBackend {
@@ -103,6 +108,8 @@ g_dummy_tls_backend_iface_init (GTlsBackendInterface *iface)
iface->get_certificate_type = _g_dummy_tls_certificate_get_type;
iface->get_client_connection_type = _g_dummy_tls_connection_get_type;
iface->get_server_connection_type = _g_dummy_tls_connection_get_type;
+ iface->get_dtls_client_connection_type = _g_dummy_dtls_connection_get_type;
+ iface->get_dtls_server_connection_type = _g_dummy_dtls_connection_get_type;
iface->get_file_database_type = _g_dummy_tls_database_get_type;
iface->get_default_database = g_dummy_tls_backend_get_default_database;
}
@@ -317,6 +324,108 @@ g_dummy_tls_connection_initable_iface_init (GInitableIface *iface)
iface->init = g_dummy_tls_connection_initable_init;
}
+/* Dummy DTLS connection type; since GDtlsClientConnection and
+ * GDtlsServerConnection are just interfaces, we can implement them
+ * both on a single object.
+ */
+
+typedef struct _GDummyDtlsConnection GDummyDtlsConnection;
+typedef struct _GDummyDtlsConnectionClass GDummyDtlsConnectionClass;
+
+struct _GDummyDtlsConnection {
+ GObject parent_instance;
+};
+
+struct _GDummyDtlsConnectionClass {
+ GObjectClass parent_class;
+};
+
+enum
+{
+ PROP_DTLS_CONN_BASE_SOCKET = 1,
+ PROP_DTLS_CONN_REQUIRE_CLOSE_NOTIFY,
+ PROP_DTLS_CONN_REHANDSHAKE_MODE,
+ PROP_DTLS_CONN_CERTIFICATE,
+ PROP_DTLS_CONN_DATABASE,
+ PROP_DTLS_CONN_INTERACTION,
+ PROP_DTLS_CONN_PEER_CERTIFICATE,
+ PROP_DTLS_CONN_PEER_CERTIFICATE_ERRORS,
+ PROP_DTLS_CONN_VALIDATION_FLAGS,
+ PROP_DTLS_CONN_SERVER_IDENTITY,
+ PROP_DTLS_CONN_ENABLE_NEGOTIATION,
+ PROP_DTLS_CONN_ACCEPTED_CAS,
+ PROP_DTLS_CONN_AUTHENTICATION_MODE,
+};
+
+static void g_dummy_dtls_connection_initable_iface_init (GInitableIface *iface);
+
+#define g_dummy_dtls_connection_get_type _g_dummy_dtls_connection_get_type
+G_DEFINE_TYPE_WITH_CODE (GDummyDtlsConnection, g_dummy_dtls_connection, G_TYPE_OBJECT,
+ G_IMPLEMENT_INTERFACE (G_TYPE_DTLS_CONNECTION, NULL);
+ G_IMPLEMENT_INTERFACE (G_TYPE_DTLS_CLIENT_CONNECTION, NULL);
+ G_IMPLEMENT_INTERFACE (G_TYPE_DTLS_SERVER_CONNECTION, NULL);
+ G_IMPLEMENT_INTERFACE (G_TYPE_INITABLE,
+ g_dummy_dtls_connection_initable_iface_init);)
+
+static void
+g_dummy_dtls_connection_get_property (GObject *object,
+ guint prop_id,
+ GValue *value,
+ GParamSpec *pspec)
+{
+}
+
+static void
+g_dummy_dtls_connection_set_property (GObject *object,
+ guint prop_id,
+ const GValue *value,
+ GParamSpec *pspec)
+{
+}
+
+static void
+g_dummy_dtls_connection_class_init (GDummyDtlsConnectionClass *connection_class)
+{
+ GObjectClass *gobject_class = G_OBJECT_CLASS (connection_class);
+
+ gobject_class->get_property = g_dummy_dtls_connection_get_property;
+ gobject_class->set_property = g_dummy_dtls_connection_set_property;
+
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_BASE_SOCKET, "base-socket");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_REQUIRE_CLOSE_NOTIFY,
"require-close-notify");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_REHANDSHAKE_MODE, "rehandshake-mode");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_CERTIFICATE, "certificate");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_DATABASE, "database");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_INTERACTION, "interaction");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_PEER_CERTIFICATE, "peer-certificate");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_PEER_CERTIFICATE_ERRORS,
"peer-certificate-errors");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_VALIDATION_FLAGS, "validation-flags");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_SERVER_IDENTITY, "server-identity");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_ACCEPTED_CAS, "accepted-cas");
+ g_object_class_override_property (gobject_class, PROP_DTLS_CONN_AUTHENTICATION_MODE,
"authentication-mode");
+}
+
+static void
+g_dummy_dtls_connection_init (GDummyDtlsConnection *connection)
+{
+}
+
+static gboolean
+g_dummy_dtls_connection_initable_init (GInitable *initable,
+ GCancellable *cancellable,
+ GError **error)
+{
+ g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_UNAVAILABLE,
+ _("DTLS support is not available"));
+ return FALSE;
+}
+
+static void
+g_dummy_dtls_connection_initable_iface_init (GInitableIface *iface)
+{
+ iface->init = g_dummy_dtls_connection_initable_init;
+}
+
/* Dummy database type.
*/
diff --git a/gio/gio.h b/gio/gio.h
index c5cab9e..5c8b384 100644
--- a/gio/gio.h
+++ b/gio/gio.h
@@ -60,6 +60,9 @@
#include <gio/gdbusserver.h>
#include <gio/gdbusutils.h>
#include <gio/gdrive.h>
+#include <gio/gdtlsclientconnection.h>
+#include <gio/gdtlsconnection.h>
+#include <gio/gdtlsserverconnection.h>
#include <gio/gemblemedicon.h>
#include <gio/gfileattribute.h>
#include <gio/gfileenumerator.h>
diff --git a/gio/giotypes.h b/gio/giotypes.h
index ae7f246..d98ec4a 100644
--- a/gio/giotypes.h
+++ b/gio/giotypes.h
@@ -223,6 +223,9 @@ typedef struct _GTcpWrapperConnection GTcpWrapperConnectio
* Since: 2.22
**/
typedef struct _GThreadedSocketService GThreadedSocketService;
+typedef struct _GDtlsConnection GDtlsConnection;
+typedef struct _GDtlsClientConnection GDtlsClientConnection; /* Dummy typedef */
+typedef struct _GDtlsServerConnection GDtlsServerConnection; /* Dummy typedef */
typedef struct _GThemedIcon GThemedIcon;
typedef struct _GTlsCertificate GTlsCertificate;
typedef struct _GTlsClientConnection GTlsClientConnection; /* Dummy typedef */
diff --git a/gio/gtlsbackend.c b/gio/gtlsbackend.c
index a2073ee..a0a4b46 100644
--- a/gio/gtlsbackend.c
+++ b/gio/gtlsbackend.c
@@ -1,6 +1,7 @@
/* GIO - GLib Input, Output and Streaming Library
*
* Copyright © 2010 Red Hat, Inc
+ * Copyright © 2015 Collabora, Ltd.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -34,7 +35,12 @@
* Security, previously known as SSL, Secure Sockets Layer) support for
* gio-based network streams.
*
- * In the simplest case, for a client connection, you can just set the
+ * #GDtlsConnection and related classes provide DTLS (Datagram TLS) support for
+ * GIO-based network sockets, using the #GDatagramBased interface. The TLS and
+ * DTLS APIs are almost identical, except TLS is stream-based and DTLS is
+ * datagram-based. They share certificate and backend infrastructure.
+ *
+ * In the simplest case, for a client TLS connection, you can just set the
* #GSocketClient:tls flag on a #GSocketClient, and then any
* connections created by that client will have TLS negotiated
* automatically, using appropriate default settings, and rejecting
@@ -61,7 +67,7 @@
* @short_description: TLS backend implementation
* @include: gio/gio.h
*
- * TLS (Transport Layer Security, aka SSL) backend
+ * TLS (Transport Layer Security, aka SSL) and DTLS backend.
*
* Since: 2.28
*/
@@ -69,7 +75,7 @@
/**
* GTlsBackend:
*
- * TLS (Transport Layer Security, aka SSL) backend. This is an
+ * TLS (Transport Layer Security, aka SSL) and DTLS backend. This is an
* internal type used to coordinate the different classes implemented
* by a TLS backend.
*
@@ -122,6 +128,28 @@ g_tls_backend_supports_tls (GTlsBackend *backend)
}
/**
+ * g_tls_backend_supports_dtls:
+ * @backend: the #GTlsBackend
+ *
+ * Checks if DTLS is supported. DTLS support may not be available even if TLS
+ * support is available, and vice-versa.
+ *
+ * Returns: whether DTLS is supported
+ *
+ * Since: 2.48
+ */
+gboolean
+g_tls_backend_supports_dtls (GTlsBackend *backend)
+{
+ if (G_TLS_BACKEND_GET_INTERFACE (backend)->supports_dtls)
+ return G_TLS_BACKEND_GET_INTERFACE (backend)->supports_dtls (backend);
+ else if (G_IS_DUMMY_TLS_BACKEND (backend))
+ return FALSE;
+ else
+ return TRUE;
+}
+
+/**
* g_tls_backend_get_default_database:
* @backend: the #GTlsBackend
*
@@ -196,6 +224,40 @@ g_tls_backend_get_server_connection_type (GTlsBackend *backend)
}
/**
+ * g_tls_backend_get_dtls_client_connection_type:
+ * @backend: the #GTlsBackend
+ *
+ * Gets the #GType of @backend’s #GDtlsClientConnection implementation.
+ *
+ * Returns: the #GType of @backend’s #GDtlsClientConnection
+ * implementation.
+ *
+ * Since: 2.48
+ */
+GType
+g_tls_backend_get_dtls_client_connection_type (GTlsBackend *backend)
+{
+ return G_TLS_BACKEND_GET_INTERFACE (backend)->get_dtls_client_connection_type ();
+}
+
+/**
+ * g_tls_backend_get_dtls_server_connection_type:
+ * @backend: the #GTlsBackend
+ *
+ * Gets the #GType of @backend’s #GDtlsServerConnection implementation.
+ *
+ * Returns: the #GType of @backend’s #GDtlsServerConnection
+ * implementation.
+ *
+ * Since: 2.48
+ */
+GType
+g_tls_backend_get_dtls_server_connection_type (GTlsBackend *backend)
+{
+ return G_TLS_BACKEND_GET_INTERFACE (backend)->get_dtls_server_connection_type ();
+}
+
+/**
* g_tls_backend_get_file_database_type:
* @backend: the #GTlsBackend
*
diff --git a/gio/gtlsbackend.h b/gio/gtlsbackend.h
index 440d02d..e6fc9f3 100644
--- a/gio/gtlsbackend.h
+++ b/gio/gtlsbackend.h
@@ -1,6 +1,7 @@
/* GIO - GLib Input, Output and Streaming Library
*
* Copyright (C) 2010 Red Hat, Inc.
+ * Copyright © 2015 Collabora, Ltd.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -47,11 +48,14 @@ typedef struct _GTlsBackendInterface GTlsBackendInterface;
* GTlsBackendInterface:
* @g_iface: The parent interface.
* @supports_tls: returns whether the backend supports TLS.
+ * @supports_dtls: returns whether the backend supports DTLS
* @get_default_database: returns a default #GTlsDatabase instance.
* @get_certificate_type: returns the #GTlsCertificate implementation type
* @get_client_connection_type: returns the #GTlsClientConnection implementation type
* @get_server_connection_type: returns the #GTlsServerConnection implementation type
* @get_file_database_type: returns the #GTlsFileDatabase implementation type.
+ * @get_dtls_client_connection_type: returns the #GDtlsClientConnection implementation type
+ * @get_dtls_server_connection_type: returns the #GDtlsServerConnection implementation type
*
* Provides an interface for describing TLS-related types.
*
@@ -68,6 +72,9 @@ struct _GTlsBackendInterface
GType ( *get_server_connection_type) (void);
GType ( *get_file_database_type) (void);
GTlsDatabase * ( *get_default_database) (GTlsBackend *backend);
+ gboolean ( *supports_dtls) (GTlsBackend *backend);
+ GType ( *get_dtls_client_connection_type) (void);
+ GType ( *get_dtls_server_connection_type) (void);
};
GLIB_AVAILABLE_IN_ALL
@@ -81,6 +88,8 @@ GTlsDatabase * g_tls_backend_get_default_database (GTlsBackend *backend);
GLIB_AVAILABLE_IN_ALL
gboolean g_tls_backend_supports_tls (GTlsBackend *backend);
+GLIB_AVAILABLE_IN_2_48
+gboolean g_tls_backend_supports_dtls (GTlsBackend *backend);
GLIB_AVAILABLE_IN_ALL
GType g_tls_backend_get_certificate_type (GTlsBackend *backend);
@@ -91,6 +100,11 @@ GType g_tls_backend_get_server_connection_type (GTlsBackend *backend);
GLIB_AVAILABLE_IN_ALL
GType g_tls_backend_get_file_database_type (GTlsBackend *backend);
+GLIB_AVAILABLE_IN_2_48
+GType g_tls_backend_get_dtls_client_connection_type (GTlsBackend *backend);
+GLIB_AVAILABLE_IN_2_48
+GType g_tls_backend_get_dtls_server_connection_type (GTlsBackend *backend);
+
G_END_DECLS
#endif /* __G_TLS_BACKEND_H__ */
diff --git a/gio/gtlsconnection.c b/gio/gtlsconnection.c
index f4a8225..c0c98f7 100644
--- a/gio/gtlsconnection.c
+++ b/gio/gtlsconnection.c
@@ -40,6 +40,8 @@
* subclasses, #GTlsClientConnection and #GTlsServerConnection,
* implement client-side and server-side TLS, respectively.
*
+ * For DTLS (Datagram TLS) support, see #GDtlsConnection.
+ *
* Since: 2.28
*/
diff --git a/po/POTFILES.in b/po/POTFILES.in
index dfa46ec..e20cf09 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -41,6 +41,9 @@ gio/gdbusserver.c
gio/gdbus-tool.c
gio/gdesktopappinfo.c
gio/gdrive.c
+gio/gdtlsclientconnection.c
+gio/gdtlsconnection.c
+gio/gdtlsserverconnection.c
gio/gdummyfile.c
gio/gdummytlsbackend.c
gio/gemblem.c
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]
