[glib] Add g_tls_certificate_verify()

[Dan Winship <danw src gnome org>]

commit 73d6bd8a45429f03706ac96e5d6e045ecee18500
Author: Dan Winship <danw gnome org>
Date:   Tue Nov 30 19:57:16 2010 -0500

    Add g_tls_certificate_verify()
    
    Add a method to verify a certificate against a CA; this can be used
    for apps that need to test against non-default CAs.
    
    Also make the GTlsCertificate::issuer property virtual

 docs/reference/gio/gio-sections.txt |    1 +
 gio/gio.symbols                     |    1 +
 gio/gtlscertificate.c               |   92 ++++++++++++++++++-----------------
 gio/gtlscertificate.h               |   32 ++++++++-----
 4 files changed, 69 insertions(+), 57 deletions(-)
---
diff --git a/docs/reference/gio/gio-sections.txt b/docs/reference/gio/gio-sections.txt
index b49d501..3a78935 100644
--- a/docs/reference/gio/gio-sections.txt
+++ b/docs/reference/gio/gio-sections.txt
@@ -3038,6 +3038,7 @@ g_tls_certificate_new_from_file
 g_tls_certificate_new_from_files
 g_tls_certificate_list_new_from_file
 g_tls_certificate_get_issuer
+g_tls_certificate_verify
 <SUBSECTION Standard>
 GTlsCertificateClass
 GTlsCertificatePrivate
diff --git a/gio/gio.symbols b/gio/gio.symbols
index c713d13..b7077ee 100644
--- a/gio/gio.symbols
+++ b/gio/gio.symbols
@@ -2031,6 +2031,7 @@ g_tls_certificate_list_new_from_file
 g_tls_certificate_new_from_file
 g_tls_certificate_new_from_files
 g_tls_certificate_new_from_pem
+g_tls_certificate_verify
 #endif
 #endif
 
diff --git a/gio/gtlscertificate.c b/gio/gtlscertificate.c
index be1f9af..8e0067c 100644
--- a/gio/gtlscertificate.c
+++ b/gio/gtlscertificate.c
@@ -53,11 +53,6 @@
 
 G_DEFINE_ABSTRACT_TYPE (GTlsCertificate, g_tls_certificate, G_TYPE_OBJECT);
 
-struct _GTlsCertificatePrivate
-{
-  GTlsCertificate *issuer;
-};
-
 enum
 {
   PROP_0,
@@ -72,9 +67,6 @@ enum
 static void
 g_tls_certificate_init (GTlsCertificate *cert)
 {
-  cert->priv = G_TYPE_INSTANCE_GET_PRIVATE (cert,
-					    G_TYPE_TLS_CERTIFICATE,
-					    GTlsCertificatePrivate);
 }
 
 static void
@@ -83,17 +75,7 @@ g_tls_certificate_get_property (GObject    *object,
 				GValue     *value,
 				GParamSpec *pspec)
 {
-  GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
-
-  switch (prop_id)
-    {
-    case PROP_ISSUER:
-      g_value_set_object (value, cert->priv->issuer);
-      break;
-
-    default:
-      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-    }
+  G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 }
 
 static void
@@ -102,28 +84,7 @@ g_tls_certificate_set_property (GObject      *object,
 				const GValue *value,
 				GParamSpec   *pspec)
 {
-  GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
-
-  switch (prop_id)
-    {
-    case PROP_ISSUER:
-      cert->priv->issuer = g_value_dup_object (value);
-      break;
-
-    default:
-      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-    }
-}
-
-static void
-g_tls_certificate_finalize (GObject *object)
-{
-  GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
-
-  if (cert->priv->issuer)
-    g_object_unref (cert->priv->issuer);
-
-  G_OBJECT_CLASS (g_tls_certificate_parent_class)->finalize (object);
+  G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 }
 
 static void
@@ -131,11 +92,8 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
 {
   GObjectClass *gobject_class = G_OBJECT_CLASS (class);
 
-  g_type_class_add_private (class, sizeof (GTlsCertificatePrivate));
-
   gobject_class->set_property = g_tls_certificate_set_property;
   gobject_class->get_property = g_tls_certificate_get_property;
-  gobject_class->finalize = g_tls_certificate_finalize;
 
   /**
    * GTlsCertificate:certificate:
@@ -482,5 +440,49 @@ g_tls_certificate_list_new_from_file (const gchar  *file,
 GTlsCertificate *
 g_tls_certificate_get_issuer (GTlsCertificate  *cert)
 {
-  return cert->priv->issuer;
+  GTlsCertificate *issuer;
+
+  g_object_get (G_OBJECT (cert), "issuer", &issuer, NULL);
+  if (issuer)
+    g_object_unref (issuer);
+
+  return issuer;
+}
+
+/**
+ * g_tls_certificate_verify:
+ * @cert: a #GTlsCertificate
+ * @identity: (allow-none): the expected peer identity
+ * @trusted_ca: (allow-none): the certificate of a trusted authority
+ *
+ * This verifies @cert and returns a set of #GTlsCertificateFlags
+ * indicating any problems found with it. This can be used to verify a
+ * certificate outside the context of making a connection, or to
+ * check a certificate against a CA that is not part of the system
+ * CA database.
+ *
+ * If @identity is not %NULL, @cert's name(s) will be compared against
+ * it, and %G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return
+ * value if it does not match. If @identity is %NULL, that bit will
+ * never be set in the return value.
+ *
+ * If @trusted_ca is not %NULL, then @cert (or one of the certificates
+ * in its chain) must be signed by it, or else
+ * %G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If
+ * @trusted_ca is %NULL, that bit will never be set in the return
+ * value.
+ *
+ * (All other #GTlsCertificateFlags values will always be set or unset
+ * as appropriate.)
+ *
+ * Return value: the appropriate #GTlsCertificateFlags
+ *
+ * Since: 2.28
+ */
+GTlsCertificateFlags
+g_tls_certificate_verify (GTlsCertificate     *cert,
+			  GSocketConnectable  *identity,
+			  GTlsCertificate     *trusted_ca)
+{
+  return G_TLS_CERTIFICATE_GET_CLASS (cert)->verify (cert, identity, trusted_ca);
 }
diff --git a/gio/gtlscertificate.h b/gio/gtlscertificate.h
index f8a7fd1..40cabf9 100644
--- a/gio/gtlscertificate.h
+++ b/gio/gtlscertificate.h
@@ -49,26 +49,34 @@ struct _GTlsCertificateClass
 {
   GObjectClass parent_class;
 
+  GTlsCertificateFlags  (* verify) (GTlsCertificate     *cert,
+				    GSocketConnectable  *identity,
+				    GTlsCertificate     *trusted_ca);
+
   /*< private >*/
   /* Padding for future expansion */
   gpointer padding[8];
 };
 
-GType            g_tls_certificate_get_type           (void) G_GNUC_CONST;
+GType                 g_tls_certificate_get_type           (void) G_GNUC_CONST;
+
+GTlsCertificate      *g_tls_certificate_new_from_pem       (const gchar         *data,
+							    gssize               length,
+							    GError             **error);
 
-GTlsCertificate *g_tls_certificate_new_from_pem       (const gchar      *data,
-						       gssize            length,
-						       GError          **error);
+GTlsCertificate      *g_tls_certificate_new_from_file      (const gchar         *file,
+							    GError             **error);
+GTlsCertificate      *g_tls_certificate_new_from_files     (const gchar         *cert_file,
+							    const gchar         *key_file,
+							    GError             **error);
+GList                *g_tls_certificate_list_new_from_file (const gchar         *file,
+							    GError             **error);
 
-GTlsCertificate *g_tls_certificate_new_from_file      (const gchar      *file,
-						       GError          **error);
-GTlsCertificate *g_tls_certificate_new_from_files     (const gchar      *cert_file,
-						       const gchar      *key_file,
-						       GError          **error);
-GList           *g_tls_certificate_list_new_from_file (const gchar      *file,
-						       GError          **error);
+GTlsCertificate      *g_tls_certificate_get_issuer         (GTlsCertificate     *cert);
 
-GTlsCertificate *g_tls_certificate_get_issuer         (GTlsCertificate  *cert);
+GTlsCertificateFlags  g_tls_certificate_verify             (GTlsCertificate     *cert,
+							    GSocketConnectable  *identity,
+							    GTlsCertificate     *trusted_ca);
 
 G_END_DECLS