How to work with TlsConnection

[d47081]

I want to interact with some server using self-signed certificate, by GioSocketClient API

Currently, I’m operating with I/O streams received from connect_to_uri_async connection (e.g. connection.input_stream())

To apply self signed certificate, seems I should wrap the connection on SocketClientEvent::TlsHandshaking event, for example:

client.connect_event({
    move |_, event, connectable, io_stream| {

// on event == SocketClientEvent::TlsHandshaking

let tls_connection = TlsClientConnection::new(
    &io_stream.unwrap(),
    Some(&connectable),
).unwrap();

tls_connection.set_certificate(
    &TlsCertificate::from_file("test.pem").unwrap()
);

at this point, I get TLS connection, with it I/O streams, but not understand which of streams use now to interact with server - Connection or TlsClientConnection one

maybe some rust or c examples, where I can grab working implementation?
thanks

[sdroege (Sebastian Dröge)]

The TLS connection is wrapped around the raw TCP (or whatever) connection. You want to use the former for handling data that’s then passed through the TLS connection.

[d47081]

So if that’s wrapper for TCP layer, I should use I/O streams from TlsClientConnection not SocketConnection one. But when trying to send some data to TlsClientConnection.output_stream().write_bytes_async(.. - get following error:

Error performing TLS handshake: An unexpected TLS packet was received

[sdroege (Sebastian Dröge)]

Can you provide a minimal, runnable example?

[d47081]

I have some draft, but code contain lot of dependencies to present or share entire the app implementation

Here is what I’m doing:

// 1. Init socket
let client = SocketClient::new();

client.set_protocol(SocketProtocol::Tcp);
client.set_tls_validation_flags(TlsCertificateFlags::INSECURE);
client.set_tls(true);

// 2. Create connection
client.connect_to_uri_async(
    url.as_str(),
    1965,
    Some(&cancellable),
    move |connect| match connect {
        Ok(connection) => {

            // 3. Wrap connection
            let tls_connection = gtk::gio::TlsClientConnection::new(
                &connection,
                None::<&SocketConnectable>,
            )
            .unwrap();

            // 4. Apply certificate
            tls_connection.set_certificate(
                &gtk::gio::TlsCertificate::from_file("test.pem")
                    .unwrap(),
            );

            // 5. Now trying to send request
           tls_connection.output_stream().write_bytes_async(
                    &Bytes::from(gformat!("{url}\r\n").as_bytes()),
                    Priority::DEFAULT,
                    Some(&cancellable),
                    move |request| match request {
                    // ..

And get this error:

Error performing TLS handshake: An unexpected TLS packet was received

Not sure I understand how to work with self-signed certificates on Glib / Gio level, before successfully connected with PHP API, where just provided certificate with validation disabled (as self-signed) but here not sure how to work, and can’t find any examples in web… Maybe link to some application sources would help… maybe I just connecting incorrect (this construction above work without TlsClientConnection)

Found also this issue, not sure that’s my luck (Fedora 41)

Doubts about this line also:

client.set_tls_validation_flags(TlsCertificateFlags::INSECURE);

this method marked as deprecated, but without this flag I have another error (as self-signed). Certificate file should be valid anyway, I’ve tested it in another app.

Just want some guide for beginner, or app example, everything found - implementation with non gio crates but I want make app gtk oriented where it is possible, without high-level wrappers, but seems my skills not enough at this point

[d47081]

After billion combinations, finally found solution in remove these lines:

// client.set_tls_validation_flags(TlsCertificateFlags::INSECURE);
// client.set_tls(true);

Seems when providing custom certificate, I can’t simply re-define default one (as supposed), so issue solved, maybe would help somebody once.

By the way, found some implementation example in C here