Functions
g_tls_database_verify_chain ()
GTlsCertificateFlags
g_tls_database_verify_chain (GTlsDatabase *self,
GTlsCertificate *chain,
const gchar *purpose,
GSocketConnectable *identity,
GTlsInteraction *interaction,
GTlsDatabaseVerifyFlags flags,
GCancellable *cancellable,
GError **error);
Determines the validity of a certificate chain after looking up and
adding any missing certificates to the chain.
chain
is a chain of GTlsCertificate objects each pointing to the next
certificate in the chain by its “issuer” property. The chain may initially
consist of one or more certificates. After the verification process is
complete, chain
may be modified by adding missing certificates, or removing
extra certificates. If a certificate anchor was found, then it is added to
the chain
.
purpose
describes the purpose (or usage) for which the certificate
is being used. Typically purpose
will be set to G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER
which means that the certificate is being used to authenticate a server
(and we are acting as the client).
The identity
is used to check for pinned certificates (trust exceptions)
in the database. These will override the normal verification process on a
host by host basis.
Currently there are no flags
, and G_TLS_DATABASE_VERIFY_NONE should be
used.
If chain
is found to be valid, then the return value will be 0. If
chain
is found to be invalid, then the return value will indicate
the problems found. If the function is unable to determine whether
chain
is valid or not (eg, because cancellable
is triggered
before it completes) then the return value will be
G_TLS_CERTIFICATE_GENERIC_ERROR and error
will be set
accordingly. error
is not set when chain
is successfully analyzed
but found to be invalid.
This function can block, use g_tls_database_verify_chain_async() to perform
the verification operation asynchronously.
Since: 2.30
g_tls_database_verify_chain_finish ()
GTlsCertificateFlags
g_tls_database_verify_chain_finish (GTlsDatabase *self,
GAsyncResult *result,
GError **error);
Finish an asynchronous verify chain operation. See
g_tls_database_verify_chain() for more information.
If chain
is found to be valid, then the return value will be 0. If
chain
is found to be invalid, then the return value will indicate
the problems found. If the function is unable to determine whether
chain
is valid or not (eg, because cancellable
is triggered
before it completes) then the return value will be
G_TLS_CERTIFICATE_GENERIC_ERROR and error
will be set
accordingly. error
is not set when chain
is successfully analyzed
but found to be invalid.
Since: 2.30
g_tls_database_lookup_certificates_issued_by_finish ()
GList *
g_tls_database_lookup_certificates_issued_by_finish
(GTlsDatabase *self,
GAsyncResult *result,
GError **error);
Finish an asynchronous lookup of certificates. See
g_tls_database_lookup_certificates_issued_by() for more information.
Returns
a newly allocated list of GTlsCertificate
objects. Use g_object_unref() on each certificate, and g_list_free() on the release the list.
[transfer full][element-type GTlsCertificate]
Since: 2.30
g_tls_database_create_certificate_handle ()
gchar *
g_tls_database_create_certificate_handle
(GTlsDatabase *self,
GTlsCertificate *certificate);
Create a handle string for the certificate. The database will only be able
to create a handle for certificates that originate from the database. In
cases where the database cannot create a handle for a certificate, NULL
will be returned.
This handle should be stable across various instances of the application,
and between applications. If a certificate is modified in the database,
then it is not guaranteed that this handle will continue to point to it.
Returns
a newly allocated string containing the
handle.
[nullable]
Since: 2.30
g_tls_database_lookup_certificate_for_handle_finish ()
GTlsCertificate *
g_tls_database_lookup_certificate_for_handle_finish
(GTlsDatabase *self,
GAsyncResult *result,
GError **error);
Finish an asynchronous lookup of a certificate by its handle. See
g_tls_database_lookup_certificate_for_handle() for more information.
If the handle is no longer valid, or does not point to a certificate in
this database, then NULL will be returned.
Returns
a newly allocated GTlsCertificate object.
Use g_object_unref() to release the certificate.
[transfer full]
Since: 2.30
Types and Values
GTlsDatabase
typedef struct _GTlsDatabase GTlsDatabase;
Abstract base class for the backend-specific database types.
Since: 2.30
struct GTlsDatabaseClass
struct GTlsDatabaseClass {
GObjectClass parent_class;
/* virtual methods */
GTlsCertificateFlags (*verify_chain) (GTlsDatabase *self,
GTlsCertificate *chain,
const gchar *purpose,
GSocketConnectable *identity,
GTlsInteraction *interaction,
GTlsDatabaseVerifyFlags flags,
GCancellable *cancellable,
GError **error);
void (*verify_chain_async) (GTlsDatabase *self,
GTlsCertificate *chain,
const gchar *purpose,
GSocketConnectable *identity,
GTlsInteraction *interaction,
GTlsDatabaseVerifyFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
GTlsCertificateFlags (*verify_chain_finish) (GTlsDatabase *self,
GAsyncResult *result,
GError **error);
gchar* (*create_certificate_handle) (GTlsDatabase *self,
GTlsCertificate *certificate);
GTlsCertificate* (*lookup_certificate_for_handle) (GTlsDatabase *self,
const gchar *handle,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GError **error);
void (*lookup_certificate_for_handle_async) (GTlsDatabase *self,
const gchar *handle,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
GTlsCertificate* (*lookup_certificate_for_handle_finish) (GTlsDatabase *self,
GAsyncResult *result,
GError **error);
GTlsCertificate* (*lookup_certificate_issuer) (GTlsDatabase *self,
GTlsCertificate *certificate,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GError **error);
void (*lookup_certificate_issuer_async) (GTlsDatabase *self,
GTlsCertificate *certificate,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
GTlsCertificate* (*lookup_certificate_issuer_finish) (GTlsDatabase *self,
GAsyncResult *result,
GError **error);
GList* (*lookup_certificates_issued_by) (GTlsDatabase *self,
GByteArray *issuer_raw_dn,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GError **error);
void (*lookup_certificates_issued_by_async) (GTlsDatabase *self,
GByteArray *issuer_raw_dn,
GTlsInteraction *interaction,
GTlsDatabaseLookupFlags flags,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
GList* (*lookup_certificates_issued_by_finish) (GTlsDatabase *self,
GAsyncResult *result,
GError **error);
};
The class for GTlsDatabase. Derived classes should implement the various
virtual methods. _async and _finish methods have a default
implementation that runs the corresponding sync method in a thread.
Since: 2.30
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER
#define G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER "1.3.6.1.5.5.7.3.1"
The purpose used to verify the server certificate in a TLS connection. This
is the most common purpose in use. Used by TLS clients.
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_CLIENT
#define G_TLS_DATABASE_PURPOSE_AUTHENTICATE_CLIENT "1.3.6.1.5.5.7.3.2"
The purpose used to verify the client certificate in a TLS connection.
Used by TLS servers.