Copyright | Will Thompson and Iñaki García Etxebarria |
---|---|
License | LGPL-2.1 |
Maintainer | Iñaki García Etxebarria |
Safe Haskell | Safe-Inferred |
Language | Haskell2010 |
GTlsClientConnection
is the client-side subclass of
TlsConnection
, representing a client-side TLS connection.
Since: 2.28
Synopsis
- newtype TlsClientConnection = TlsClientConnection (ManagedPtr TlsClientConnection)
- class (GObject o, IsDescendantOf TlsClientConnection o) => IsTlsClientConnection o
- toTlsClientConnection :: (MonadIO m, IsTlsClientConnection o) => o -> m TlsClientConnection
- tlsClientConnectionCopySessionState :: (HasCallStack, MonadIO m, IsTlsClientConnection a, IsTlsClientConnection b) => a -> b -> m ()
- tlsClientConnectionGetAcceptedCas :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> m [ByteString]
- tlsClientConnectionGetServerIdentity :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> m (Maybe SocketConnectable)
- tlsClientConnectionGetUseSsl3 :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> m Bool
- tlsClientConnectionGetValidationFlags :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> m [TlsCertificateFlags]
- tlsClientConnectionNew :: (HasCallStack, MonadIO m, IsIOStream a, IsSocketConnectable b) => a -> Maybe b -> m TlsClientConnection
- tlsClientConnectionSetServerIdentity :: (HasCallStack, MonadIO m, IsTlsClientConnection a, IsSocketConnectable b) => a -> b -> m ()
- tlsClientConnectionSetUseSsl3 :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> Bool -> m ()
- tlsClientConnectionSetValidationFlags :: (HasCallStack, MonadIO m, IsTlsClientConnection a) => a -> [TlsCertificateFlags] -> m ()
- getTlsClientConnectionAcceptedCas :: (MonadIO m, IsTlsClientConnection o) => o -> m [Ptr ()]
- constructTlsClientConnectionServerIdentity :: (IsTlsClientConnection o, MonadIO m, IsSocketConnectable a) => a -> m (GValueConstruct o)
- getTlsClientConnectionServerIdentity :: (MonadIO m, IsTlsClientConnection o) => o -> m (Maybe SocketConnectable)
- setTlsClientConnectionServerIdentity :: (MonadIO m, IsTlsClientConnection o, IsSocketConnectable a) => o -> a -> m ()
- constructTlsClientConnectionUseSsl3 :: (IsTlsClientConnection o, MonadIO m) => Bool -> m (GValueConstruct o)
- getTlsClientConnectionUseSsl3 :: (MonadIO m, IsTlsClientConnection o) => o -> m Bool
- setTlsClientConnectionUseSsl3 :: (MonadIO m, IsTlsClientConnection o) => o -> Bool -> m ()
- constructTlsClientConnectionValidationFlags :: (IsTlsClientConnection o, MonadIO m) => [TlsCertificateFlags] -> m (GValueConstruct o)
- getTlsClientConnectionValidationFlags :: (MonadIO m, IsTlsClientConnection o) => o -> m [TlsCertificateFlags]
- setTlsClientConnectionValidationFlags :: (MonadIO m, IsTlsClientConnection o) => o -> [TlsCertificateFlags] -> m ()
Exported types
newtype TlsClientConnection Source #
Memory-managed wrapper type.
TlsClientConnection (ManagedPtr TlsClientConnection) |
Instances
class (GObject o, IsDescendantOf TlsClientConnection o) => IsTlsClientConnection o Source #
Type class for types which can be safely cast to TlsClientConnection
, for instance with toTlsClientConnection
.
Instances
(GObject o, IsDescendantOf TlsClientConnection o) => IsTlsClientConnection o Source # | |
Defined in GI.Gio.Interfaces.TlsClientConnection |
toTlsClientConnection :: (MonadIO m, IsTlsClientConnection o) => o -> m TlsClientConnection Source #
Cast to TlsClientConnection
, for types for which this is known to be safe. For general casts, use castTo
.
Methods
Click to display all available methods, including inherited ones
Methods
bindProperty, bindPropertyFull, clearPending, close, closeAsync, closeFinish, copySessionState, emitAcceptCertificate, forceFloating, freezeNotify, getv, handshake, handshakeAsync, handshakeFinish, hasPending, isClosed, isFloating, notify, notifyByPspec, ref, refSink, runDispose, spliceAsync, stealData, stealQdata, thawNotify, unref, watchClosure.
Getters
getAcceptedCas, getCertificate, getChannelBindingData, getCiphersuiteName, getData, getDatabase, getInputStream, getInteraction, getNegotiatedProtocol, getOutputStream, getPeerCertificate, getPeerCertificateErrors, getProperty, getProtocolVersion, getQdata, getRehandshakeMode, getRequireCloseNotify, getServerIdentity, getUseSsl3, getUseSystemCertdb, getValidationFlags.
Setters
setAdvertisedProtocols, setCertificate, setData, setDataFull, setDatabase, setInteraction, setPending, setProperty, setRehandshakeMode, setRequireCloseNotify, setServerIdentity, setUseSsl3, setUseSystemCertdb, setValidationFlags.
copySessionState
tlsClientConnectionCopySessionState Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a, IsTlsClientConnection b) | |
=> a |
|
-> b |
|
-> m () |
Possibly copies session state from one connection to another, for use
in TLS session resumption. This is not normally needed, but may be
used when the same session needs to be used between different
endpoints, as is required by some protocols, such as FTP over TLS.
source
should have already completed a handshake and, since TLS 1.3,
it should have been used to read data at least once. conn
should not
have completed a handshake.
It is not possible to know whether a call to this function will
actually do anything. Because session resumption is normally used
only for performance benefit, the TLS backend might not implement
this function. Even if implemented, it may not actually succeed in
allowing conn
to resume source
's TLS session, because the server
may not have sent a session resumption token to source
, or it may
refuse to accept the token from conn
. There is no way to know
whether a call to this function is actually successful.
Using this function is not required to benefit from session
resumption. If the TLS backend supports session resumption, the
session will be resumed automatically if it is possible to do so
without weakening the privacy guarantees normally provided by TLS,
without need to call this function. For example, with TLS 1.3,
a session ticket will be automatically copied from any
TlsClientConnection
that has previously received session tickets
from the server, provided a ticket is available that has not
previously been used for session resumption, since session ticket
reuse would be a privacy weakness. Using this function causes the
ticket to be copied without regard for privacy considerations.
Since: 2.46
getAcceptedCas
tlsClientConnectionGetAcceptedCas Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> m [ByteString] | Returns: the list of
CA DNs. You should unref each element with |
Gets the list of distinguished names of the Certificate Authorities
that the server will accept certificates from. This will be set
during the TLS handshake if the server requests a certificate.
Otherwise, it will be Nothing
.
Each item in the list is a ByteArray
which contains the complete
subject DN of the certificate authority.
Since: 2.28
getServerIdentity
tlsClientConnectionGetServerIdentity Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> m (Maybe SocketConnectable) | Returns: a |
Gets conn
's expected server identity
Since: 2.28
getUseSsl3
tlsClientConnectionGetUseSsl3 Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> m Bool | Returns: |
Deprecated: (Since version 2.56)SSL 3.0 is insecure.
SSL 3.0 is no longer supported. See
tlsClientConnectionSetUseSsl3
for details.
Since: 2.28
getValidationFlags
tlsClientConnectionGetValidationFlags Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> m [TlsCertificateFlags] | Returns: the validation flags |
Deprecated: (Since version 2.72)Do not attempt to ignore validation errors.
Gets conn
's validation flags
This function does not work as originally designed and is impossible
to use correctly. See TlsClientConnection
:validation-flags
for more
information.
Since: 2.28
new
tlsClientConnectionNew Source #
:: (HasCallStack, MonadIO m, IsIOStream a, IsSocketConnectable b) | |
=> a |
|
-> Maybe b |
|
-> m TlsClientConnection | Returns: the new
|
Creates a new TlsClientConnection
wrapping baseIoStream
(which
must have pollable input and output streams) which is assumed to
communicate with the server identified by serverIdentity
.
See the documentation for TlsConnection:baseIoStream for restrictions
on when application code can run operations on the baseIoStream
after
this function has returned.
Since: 2.28
setServerIdentity
tlsClientConnectionSetServerIdentity Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a, IsSocketConnectable b) | |
=> a |
|
-> b |
|
-> m () |
Sets conn
's expected server identity, which is used both to tell
servers on virtual hosts which certificate to present, and also
to let conn
know what name to look for in the certificate when
performing TlsCertificateFlagsBadIdentity
validation, if enabled.
Since: 2.28
setUseSsl3
tlsClientConnectionSetUseSsl3 Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> Bool |
|
-> m () |
Deprecated: (Since version 2.56)SSL 3.0 is insecure.
Since GLib 2.42.1, SSL 3.0 is no longer supported.
From GLib 2.42.1 through GLib 2.62, this function could be used to force use of TLS 1.0, the lowest-supported TLS protocol version at the time. In the past, this was needed to connect to broken TLS servers that exhibited protocol version intolerance. Such servers are no longer common, and using TLS 1.0 is no longer considered acceptable.
Since GLib 2.64, this function does nothing.
Since: 2.28
setValidationFlags
tlsClientConnectionSetValidationFlags Source #
:: (HasCallStack, MonadIO m, IsTlsClientConnection a) | |
=> a |
|
-> [TlsCertificateFlags] |
|
-> m () |
Deprecated: (Since version 2.72)Do not attempt to ignore validation errors.
Sets conn
's validation flags, to override the default set of
checks performed when validating a server certificate. By default,
TlsCertificateFlagsValidateAll
is used.
This function does not work as originally designed and is impossible
to use correctly. See TlsClientConnection
:validation-flags
for more
information.
Since: 2.28
Properties
acceptedCas
A list of the distinguished names of the Certificate Authorities that the server will accept client certificates signed by. If the server requests a client certificate during the handshake, then this property will be set after the handshake completes.
Each item in the list is a ByteArray
which contains the complete
subject DN of the certificate authority.
Since: 2.28
getTlsClientConnectionAcceptedCas :: (MonadIO m, IsTlsClientConnection o) => o -> m [Ptr ()] Source #
Get the value of the “accepted-cas
” property.
When overloading is enabled, this is equivalent to
get
tlsClientConnection #acceptedCas
serverIdentity
A SocketConnectable
describing the identity of the server that
is expected on the other end of the connection.
If the TlsCertificateFlagsBadIdentity
flag is set in
TlsClientConnection
:validation-flags
, this object will be used
to determine the expected identify of the remote end of the
connection; if TlsClientConnection
:server-identity
is not set,
or does not match the identity presented by the server, then the
TlsCertificateFlagsBadIdentity
validation will fail.
In addition to its use in verifying the server certificate, this is also used to give a hint to the server about what certificate we expect, which is useful for servers that serve virtual hosts.
Since: 2.28
constructTlsClientConnectionServerIdentity :: (IsTlsClientConnection o, MonadIO m, IsSocketConnectable a) => a -> m (GValueConstruct o) Source #
Construct a GValueConstruct
with valid value for the “server-identity
” property. This is rarely needed directly, but it is used by new
.
getTlsClientConnectionServerIdentity :: (MonadIO m, IsTlsClientConnection o) => o -> m (Maybe SocketConnectable) Source #
Get the value of the “server-identity
” property.
When overloading is enabled, this is equivalent to
get
tlsClientConnection #serverIdentity
setTlsClientConnectionServerIdentity :: (MonadIO m, IsTlsClientConnection o, IsSocketConnectable a) => o -> a -> m () Source #
Set the value of the “server-identity
” property.
When overloading is enabled, this is equivalent to
set
tlsClientConnection [ #serverIdentity:=
value ]
useSsl3
SSL 3.0 is no longer supported. See
tlsClientConnectionSetUseSsl3
for details.
Since: 2.28
constructTlsClientConnectionUseSsl3 :: (IsTlsClientConnection o, MonadIO m) => Bool -> m (GValueConstruct o) Source #
Construct a GValueConstruct
with valid value for the “use-ssl3
” property. This is rarely needed directly, but it is used by new
.
getTlsClientConnectionUseSsl3 :: (MonadIO m, IsTlsClientConnection o) => o -> m Bool Source #
Get the value of the “use-ssl3
” property.
When overloading is enabled, this is equivalent to
get
tlsClientConnection #useSsl3
setTlsClientConnectionUseSsl3 :: (MonadIO m, IsTlsClientConnection o) => o -> Bool -> m () Source #
Set the value of the “use-ssl3
” property.
When overloading is enabled, this is equivalent to
set
tlsClientConnection [ #useSsl3:=
value ]
validationFlags
What steps to perform when validating a certificate received from a server. Server certificates that fail to validate in any of the ways indicated here will be rejected unless the application overrides the default via TlsConnection::acceptCertificate.
GLib guarantees that if certificate verification fails, at least one
flag will be set, but it does not guarantee that all possible flags
will be set. Accordingly, you may not safely decide to ignore any
particular type of error. For example, it would be incorrect to mask
TlsCertificateFlagsExpired
if you want to allow expired certificates,
because this could potentially be the only error flag set even if
other problems exist with the certificate. Therefore, there is no
safe way to use this property. This is not a horrible problem,
though, because you should not be attempting to ignore validation
errors anyway. If you really must ignore TLS certificate errors,
connect to TlsConnection::acceptCertificate.
Since: 2.28
constructTlsClientConnectionValidationFlags :: (IsTlsClientConnection o, MonadIO m) => [TlsCertificateFlags] -> m (GValueConstruct o) Source #
Construct a GValueConstruct
with valid value for the “validation-flags
” property. This is rarely needed directly, but it is used by new
.
getTlsClientConnectionValidationFlags :: (MonadIO m, IsTlsClientConnection o) => o -> m [TlsCertificateFlags] Source #
Get the value of the “validation-flags
” property.
When overloading is enabled, this is equivalent to
get
tlsClientConnection #validationFlags
setTlsClientConnectionValidationFlags :: (MonadIO m, IsTlsClientConnection o) => o -> [TlsCertificateFlags] -> m () Source #
Set the value of the “validation-flags
” property.
When overloading is enabled, this is equivalent to
set
tlsClientConnection [ #validationFlags:=
value ]