diff options
Diffstat (limited to 'extensions')
| -rw-r--r-- | extensions/Authentication_TLS_Certificate.xml | 177 |
1 files changed, 85 insertions, 92 deletions
diff --git a/extensions/Authentication_TLS_Certificate.xml b/extensions/Authentication_TLS_Certificate.xml index 709ea282c..aafc00414 100644 --- a/extensions/Authentication_TLS_Certificate.xml +++ b/extensions/Authentication_TLS_Certificate.xml @@ -41,6 +41,77 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. </tp:docstring> </tp:simple-type> + <tp:struct name="TLS_Certificate_Rejection" array-name="TLS_Certificate_Rejection_List"> + <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> + <p>Struct representing one reason why a TLS certificate was rejected.</p> + <p>Since there can be multiple things wrong with a TLS certificate, + arrays of this type are used to represent lists of reasons for + rejection. In that case, the most important reason SHOULD be placed + first in the list.</p> + </tp:docstring> + + <tp:member name="Reason" type="u" + tp:type="TLS_Certificate_Reject_Reason"> + <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> + <p>The value of the TLS_Certificate_Reject_Reason enumeration for + this certificate rejection. + <tp:rationale> + Clients that do not understand the <code>Error</code> member, + which may be implementation-specific, can use this property to + classify rejection reasons into common categories. + </tp:rationale> + </p> + </tp:docstring> + </tp:member> + + <tp:member name="Error" type="s" + tp:type="DBus_Error_Name"> + <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> + <p>The DBus error name for this certificate rejection.</p> + <p>This MAY correspond to the value of the <code>Reason</code> member, + or MAY be a more specific D-Bus error name, perhaps implementation-specific.</p> + </tp:docstring> + </tp:member> + + <tp:member name="Details" type="a{sv}" + tp:type="String_Variant_Map"> + <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> + <p>Additional information about why the certificate was rejected. + This MAY also include one or more of the following well-known keys:</p> + <p> + <dl> + <dt>user-requested (b)</dt> + <dd>True if the error was due to an user-requested rejection of + the certificate; False if there was an unrecoverable error in the + verification process.</dd> + <dt>expected-hostname (s)</dt> + <dd>If the rejection reason is Hostname_Mismatch, the hostname that + the server certificate was expected to have.</dd> + <dt>certificate-hostname (s)</dt> + <dd>If the rejection reason is Hostname_Mismatch, the hostname of + the certificate that was presented. + <tp:rationale> + <p>For instance, if you try to connect to gmail.com but are presented + with a TLS certificate issued to evil.example.org, the error details + for Hostname_Mismatch MAY include:</p> + <pre> + { + 'expected-hostname': 'gmail.com', + 'certificate-hostname': 'evil.example.org', + } + </pre> + </tp:rationale> + </dd> + <dt>debug-message (s)</dt> + <dd>Debugging information on the error, corresponding to the + message part of a D-Bus error message, which SHOULD NOT be + displayed to users under normal circumstances</dd> + </dl> + </p> + </tp:docstring> + </tp:member> + </tp:struct> + <tp:enum type="u" name="TLS_Certificate_State"> <tp:docstring> The possible states for a <tp:dbus-ref @@ -149,75 +220,19 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. </tp:docstring> </property> - <property name="RejectError" type="s" access="read" - tp:type="DBus_Error_Name" - tp:name-for-bindings="Reject_Error"> + <property name="Rejections" type="a(usa{sv})" access="read" + tp:type="TLS_Certificate_Rejection[]" tp:name-for-bindings="Rejections"> <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> <p>If the <tp:member-ref>State</tp:member-ref> is Rejected, - the reason why the certificate was rejected; this MAY correspond to - the <tp:member-ref>RejectReason</tp:member-ref>, or MAY be a more - specific D-Bus error name, perhaps implementation-specific.</p> + an array of <tp:type>TLS_Certificate_Rejection</tp:type> + structures containing the reason why the certificate is rejected.</p> <p>If the <tp:member-ref>State</tp:member-ref> is not Rejected, this property is not meaningful, and SHOULD be set to an empty - string.</p> - </tp:docstring> - </property> - - <property name="RejectDetails" type="a{sv}" access="read" - tp:type="String_Variant_Map" - tp:name-for-bindings="Reject_Details"> - <tp:docstring xmlns="http://www.w3.org/1999/xhtml"> - <p>If the <tp:member-ref>State</tp:member-ref> is Rejected, - additional information about why the certificate was rejected.</p> - <p>If the <tp:member-ref>State</tp:member-ref> is not Rejected, - this property is not meaningful and SHOULD be set to an empty - map.</p> - <p>The additional information MAY also include - one or more of the following well-known keys:</p> - <dl> - <dt>user-requested (b)</dt> - <dd>True if the error was due to an user-requested rejection of - the certificate; False if there was an unrecoverable error in the - verification process.</dd> - <dt>expected-hostname (s)</dt> - <dd>If the rejection reason is Hostname_Mismatch, the hostname that - the server certificate was expected to have.</dd> - <dt>certificate-hostname (s)</dt> - <dd>If the rejection reason is Hostname_Mismatch, the hostname of - the certificate that was presented. - <tp:rationale> - <p>For instance, if you try to connect to gmail.com but are presented - with a TLS certificate issued to evil.example.org, the error details - for Hostname_Mismatch MAY include:</p> - <pre> - { - 'expected-hostname': 'gmail.com', - 'certificate-hostname': 'evil.example.org', - } - </pre> - </tp:rationale> - </dd> - <dt>debug-message (s)</dt> - <dd>Debugging information on the error, corresponding to the - message part of a D-Bus error message, which SHOULD NOT be - displayed to users under normal circumstances</dd> - </dl> - </tp:docstring> - </property> - - <property name="RejectReason" type="u" access="read" - tp:type="TLS_Certificate_Reject_Reason" - tp:name-for-bindings="Reject_Reason"> - <tp:docstring> - If the <tp:member-ref>State</tp:member-ref> is Rejected, the - reason why the certificate was rejected. - <tp:rationale> - Clients that do not understand the <tp:member-ref>RejectError</tp:member-ref>, - which may be implementation-specific, can use this property to - classify rejection reasons into common categories. - </tp:rationale> - Otherwise, this property is not meaningful, and SHOULD be set to - Unknown. + array.</p> + <p>The first rejection in the list MAY be assumed to be + the most important; if the array contains more than one + element, the CM MAY either use the values after the first, + or ignore them.</p> </tp:docstring> </property> @@ -252,19 +267,9 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. <tp:docstring> The <tp:member-ref>State</tp:member-ref> of this certificate has changed to Rejected. </tp:docstring> - <arg name="Reason" type="u" tp:type="TLS_Certificate_Reject_Reason"> - <tp:docstring> - The new value of <tp:member-ref>RejectReason</tp:member-ref>. - </tp:docstring> - </arg> - <arg name="Error" type="s" tp:type="DBus_Error_Name"> - <tp:docstring> - The new value of <tp:member-ref>RejectError</tp:member-ref>. - </tp:docstring> - </arg> - <arg name="Details" type="a{sv}" tp:type="String_Variant_Map"> + <arg name="Rejections" type="a(usa{sv})" tp:type="TLS_Certificate_Rejection[]"> <tp:docstring> - The new value of <tp:member-ref>RejectDetails</tp:member-ref> + The new value of the <tp:member-ref>Rejections</tp:member-ref> property. </tp:docstring> </arg> </signal> @@ -279,22 +284,10 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. <tp:docstring> Rejects this certificate. </tp:docstring> - <arg direction="in" type="u" name="Reason" - tp:type="TLS_Certificate_Reject_Reason"> - <tp:docstring> - The new value of <tp:member-ref>RejectReason</tp:member-ref>. - </tp:docstring> - </arg> - <arg direction="in" type="s" name="Error" - tp:type="DBus_Error_Name"> - <tp:docstring> - The new value of <tp:member-ref>RejectError</tp:member-ref>. - </tp:docstring> - </arg> - <arg direction="in" type="a{sv}" name="Details" - tp:type="String_Variant_Map"> + <arg direction="in" type="a(usa{sv})" name="Rejections" + tp:type="TLS_Certificate_Rejection[]"> <tp:docstring> - The new value of <tp:member-ref>RejectDetails</tp:member-ref>. + The new value of the <tp:member-ref>Rejections</tp:member-ref> property. </tp:docstring> </arg> </method> |