<tp:simple-type name="Certificate_Data" array-name="Certificate_Data_List"
type="ay">
- <tp:docstring>
- The raw data contained in a TLS certificate.
+ <tp:docstring xmlns="http://www.w3.org/1999/xhtml">
+ <p>The raw data contained in a TLS certificate.</p>
+
+ <p>For X.509 certificates (<tp:member-ref>CertificateType</tp:member-ref>
+ = "x509"), this MUST be in DER format, as defined by the
+ <a href="http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf">X.690</a>
+ ITU standard.</p>
+
+ <p>For PGP certificates (<tp:member-ref>CertificateType</tp:member-ref>
+ = "pgp"), this MUST be a binary OpenPGP key as defined by section 11.1
+ of <a href="http://www.rfc-editor.org/rfc/4880.txt">RFC 4880</a>.</p>
</tp:docstring>
</tp:simple-type>
object.
</tp:docstring>
- <tp:enumvalue suffix="None" value="0">
+ <tp:enumvalue suffix="Pending" value="0">
<tp:docstring>
- The certificate has no state associated with it.
+ The certificate is currently waiting to be accepted or rejected.
</tp:docstring>
</tp:enumvalue>
- <tp:enumvalue suffix="Verified" value="1">
+ <tp:enumvalue suffix="Accepted" value="1">
<tp:docstring>
The certificate has been verified.
</tp:docstring>
Possible reasons to reject a TLS certificate.
</tp:docstring>
- <tp:enumvalue suffix="None" value="0">
- <tp:docstring>
- No reason specified.
- </tp:docstring>
- </tp:enumvalue>
-
- <tp:enumvalue suffix="Other" value="1">
+ <tp:enumvalue suffix="Unknown" value="0">
<tp:docstring>
The certificate has been rejected for another reason
not listed in this enumeration.
</tp:docstring>
</tp:enumvalue>
- <tp:enumvalue suffix="Untrusted" value="2">
+ <tp:enumvalue suffix="Untrusted" value="1">
<tp:docstring>
The certificate is not trusted.
</tp:docstring>
</tp:enumvalue>
- <tp:enumvalue suffix="Expired" value="3">
+ <tp:enumvalue suffix="Expired" value="2">
<tp:docstring>
The certificate is expired.
</tp:docstring>
</tp:enumvalue>
- <tp:enumvalue suffix="Not_Activated" value="4">
+ <tp:enumvalue suffix="Not_Activated" value="3">
<tp:docstring>
The certificate is not active yet.
</tp:docstring>
</tp:enumvalue>
+ <tp:enumvalue suffix="Fingerprint_Mismatch" value="4">
+ <tp:docstring>
+ The certificate provided does not have the expected
+ fingerprint.
+ </tp:docstring>
+ </tp:enumvalue>
+
<tp:enumvalue suffix="Hostname_Mismatch" value="5">
<tp:docstring>
The hostname certified does not match the provided one.
</tp:docstring>
</tp:enumvalue>
- <tp:enumvalue suffix="Insecure_Algorithm" value="8">
+ <tp:enumvalue suffix="Insecure" value="8">
+ <tp:docstring>
+ The certificate uses an insecure cipher algorithm, or is
+ cryptographically weak.
+ </tp:docstring>
+ </tp:enumvalue>
+
+ <tp:enumvalue suffix="Limit_Exceeded" value="9">
<tp:docstring>
- The certificate uses an insecure cipher algorithm.
+ The length in bytes of the certificate, or the depth of the
+ certificate chain exceed the limits imposed by the crypto
+ library.
</tp:docstring>
</tp:enumvalue>
</tp:enum>
<tp:docstring>
The current state of this certificate.
State change notifications happen by means of the
- <tp:member-ref>StateChanged</tp:member-ref> signal.
+ <tp:member-ref>Accepted</tp:member-ref> and
+ <tp:member-ref>Rejected</tp:member-ref> signals.
+ </tp:docstring>
+ </property>
+
+ <property name="RejectError" type="s" access="read"
+ tp:type="DBus_Error_Name"
+ tp:name-for-bindings="Reject_Error">
+ <tp:docstring xmlns="http://www.w3.org/1999/xhtml">
+ <p>If the <tp:member-ref>State</tp:member-ref> is Rejected,
+ the reason why the certificate was rejected; this MAY correspond to
+ the <tp:member-ref>RejectReason</tp:member-ref>, or MAY be a more
+ specific D-Bus error name, perhaps implementation-specific.</p>
+ <p>If the <tp:member-ref>State</tp:member-ref> is not Rejected,
+ this property is not meaningful, and SHOULD be set to an empty
+ string.</p>
+ </tp:docstring>
+ </property>
+
+ <property name="RejectDetails" type="a{sv}" access="read"
+ tp:type="String_Variant_Map"
+ tp:name-for-bindings="Reject_Details">
+ <tp:docstring xmlns="http://www.w3.org/1999/xhtml">
+ <p>If the <tp:member-ref>State</tp:member-ref> is Rejected,
+ additional information about why the certificate was rejected.</p>
+ <p>If the <tp:member-ref>State</tp:member-ref> is not Rejected,
+ this property is not meaningful and SHOULD be set to an empty
+ map.</p>
+ <p>The additional information MAY also include
+ one or more of the following well-known keys:</p>
+ <dl>
+ <dt>user-requested (b)</dt>
+ <dd>True if the error was due to an user-requested rejection of
+ the certificate; False if there was an unrecoverable error in the
+ verification process.</dd>
+ <dt>expected-hostname (s)</dt>
+ <dd>If the rejection reason is Hostname_Mismatch, the hostname that
+ the server certificate was expected to have.</dd>
+ <dt>certificate-hostname (s)</dt>
+ <dd>If the rejection reason is Hostname_Mismatch, the hostname of
+ the certificate that was presented.
+ <tp:rationale>
+ <p>For instance, if you try to connect to gmail.com but are presented
+ with a TLS certificate issued to evil.example.org, the error details
+ for Hostname_Mismatch MAY include:</p>
+ <pre>
+ {
+ 'expected-hostname': 'gmail.com',
+ 'certificate-hostname': 'evil.example.org',
+ }
+ </pre>
+ </tp:rationale>
+ </dd>
+ <dt>debug-message (s)</dt>
+ <dd>Debugging information on the error, corresponding to the
+ message part of a D-Bus error message, which SHOULD NOT be
+ displayed to users under normal circumstances</dd>
+ </dl>
</tp:docstring>
</property>
tp:type="TLS_Certificate_Reject_Reason"
tp:name-for-bindings="Reject_Reason">
<tp:docstring>
- The reason why this certificate has been rejected.
+ If the <tp:member-ref>State</tp:member-ref> is Rejected, the
+ reason why the certificate was rejected.
+ <tp:rationale>
+ Clients that do not understand the <tp:member-ref>RejectError</tp:member-ref>,
+ which may be implementation-specific, can use this property to
+ classify rejection reasons into common categories.
+ </tp:rationale>
+ Otherwise, this property is not meaningful, and SHOULD be set to
+ Unknown.
</tp:docstring>
</property>
tp:name-for-bindings="Certificate_Type">
<tp:docstring>
The type of this TLS certificate (e.g. 'x509' or 'pgp').
+ <p>This property is immutable</p>
</tp:docstring>
</property>
<property name="CertificateChainData" type="aay" access="read"
tp:type="Certificate_Data[]" tp:name-for-bindings="Certificate_Chain_Data">
- <tp:docstring>
- The RAW PEM-encoded trust chain of this TLS certificate.
+ <tp:docstring xmlns="http://www.w3.org/1999/xhtml">
+ <p>One or more TLS certificates forming a trust chain, each encoded as
+ specified by <tp:type>Certificate_Data</tp:type>.</p>
+ <p>The first certificate in the chain MUST be the server certificate,
+ followed by the issuer's certificate, followed by the issuer's issuer
+ and so on.</p>
</tp:docstring>
</property>
- <signal name="StateChanged"
- tp:name-for-bindings="State_Changed">
+ <signal name="Accepted"
+ tp:name-for-bindings="Accepted">
<tp:docstring>
- The state of this TLS certificate has changed.
+ The <tp:member-ref>State</tp:member-ref> of this certificate has changed to Accepted.
</tp:docstring>
- <arg name="State" type="u" tp:type="TLS_Certificate_State">
+ </signal>
+
+ <signal name="Rejected"
+ tp:name-for-bindings="Rejected">
+ <tp:docstring>
+ The <tp:member-ref>State</tp:member-ref> of this certificate has changed to Rejected.
+ </tp:docstring>
+ <arg name="Reason" type="u" tp:type="TLS_Certificate_Reject_Reason">
<tp:docstring>
- The new state of the TLS certificate.
+ The new value of <tp:member-ref>RejectReason</tp:member-ref>.
</tp:docstring>
</arg>
- <arg name="Reason" type="u" tp:type="TLS_Certificate_Reject_Reason">
+ <arg name="Error" type="s" tp:type="DBus_Error_Name">
<tp:docstring>
- The reason why the state of the TLS certificate changed.
+ The new value of <tp:member-ref>RejectError</tp:member-ref>.
+ </tp:docstring>
+ </arg>
+ <arg name="Details" type="a{sv}" tp:type="String_Variant_Map">
+ <tp:docstring>
+ The new value of <tp:member-ref>RejectDetails</tp:member-ref>
</tp:docstring>
</arg>
</signal>
<method name="Accept" tp:name-for-bindings="Accept">
<tp:docstring>
Accepts this certificate, i.e. marks it as verified.
- This method doesn't do anything on local certificates.
</tp:docstring>
</method>
<method name="Reject" tp:name-for-bindings="Reject">
<tp:docstring>
- Rejects this certificate. This method doesn't do anything
- on local certificates.
+ Rejects this certificate.
</tp:docstring>
<arg direction="in" type="u" name="Reason"
tp:type="TLS_Certificate_Reject_Reason">
<tp:docstring>
- The reason why this certificate is being rejected.
+ The new value of <tp:member-ref>RejectReason</tp:member-ref>.
+ </tp:docstring>
+ </arg>
+ <arg direction="in" type="s" name="Error"
+ tp:type="DBus_Error_Name">
+ <tp:docstring>
+ The new value of <tp:member-ref>RejectError</tp:member-ref>.
+ </tp:docstring>
+ </arg>
+ <arg direction="in" type="a{sv}" name="Details"
+ tp:type="String_Variant_Map">
+ <tp:docstring>
+ The new value of <tp:member-ref>RejectDetails</tp:member-ref>.
</tp:docstring>
</arg>
</method>
<tp:requires interface="org.freedesktop.Telepathy.Channel"/>
<tp:docstring xmlns="http://www.w3.org/1999/xhtml">
- <p>
- A channel type that carries a TLS certificate between a server
- and a client connecting to it.<br/>
- Channels of this kind are never requested, are anonymous, and SHOULD be
- dispatched while the
- <tp:dbus-ref
- namespace="org.freedesktop.Telepathy">Connection</tp:dbus-ref>
- owning it is in the CONNECTING state.</p>
+ <p>A channel type that carries a TLS certificate between a server
+ and a client connecting to it.</p>
+ <p>Channels of this kind always have <tp:dbus-ref
+ namespace="org.freedesktop.Telepathy.Channel">Requested</tp:dbus-ref> = False,
+ <tp:dbus-ref namespace="org.freedesktop.Telepathy.Channel">TargetHandleType</tp:dbus-ref>
+ = None and <tp:dbus-ref namespace="org.freedesktop.Telepathy.Channel">TargetHandle</tp:dbus-ref>
+ = 0, and cannot be requested with methods such as <tp:dbus-ref
+ namespace="org.freedesktop.Telepathy.Connection.Interface.Requests">CreateChannel</tp:dbus-ref>.
+ Also, they SHOULD be dispatched while the
+ <tp:dbus-ref namespace="org.freedesktop.Telepathy">Connection</tp:dbus-ref>
+ owning them is in the CONNECTING state.</p>
<p>In this case, handlers SHOULD accept or reject the certificate, using
- the relevant methods on the provided object, or MAY just close the channel before doing so, to fall
+ the relevant methods on the provided object, or MAY just <tp:dbus-ref
+ namespace="org.freedesktop.Telepathy.Channel">Close</tp:dbus-ref> the channel before doing so, to fall
back to a non-interactive verification process done inside the CM.</p>
<p>For example, channels of this kind can pop up while a client is
connecting to an XMPP server.</p>
<property name="ServerCertificate" type="o" access="read"
tp:name-for-bindings="ServerCertificate">
<tp:docstring>
- A <tp:dbus-ref
+ <p>A <tp:dbus-ref
namespace="org.freedesktop.Telepathy.Authentication">TLSCertificate.DRAFT</tp:dbus-ref>
containing the certificate chain as sent by the server,
- and other relevant information.
+ and other relevant information.</p>
+ <p>This property is immutable.</p>
</tp:docstring>
</property>
projects / empathy.git / commitdiff