@gtkx/ffi 0.1.45 → 0.1.46

package/dist/generated/gio/tls-connection.d.ts

@@ -11,28 +11,262 @@ import { IOStream } from "./iostream.js";
 export declare class TlsConnection extends IOStream {
     constructor(...args: unknown[]);
     protected createPtr(_args: unknown[]): unknown;
+    /**
+     * Used by #GTlsConnection implementations to emit the
+     * #GTlsConnection::accept-certificate signal.
+     * @param peerCert - the peer's #GTlsCertificate
+     * @param errors - the problems with @peer_cert
+     */
     emitAcceptCertificate(peerCert: TlsCertificate, errors: TlsCertificateFlags): boolean;
+    /**
+     * Gets @conn's certificate, as set by
+     * g_tls_connection_set_certificate().
+     */
     getCertificate(): TlsCertificate | null;
+    /**
+     * Query the TLS backend for TLS channel binding data of `type` for @conn.
+     *
+     * This call retrieves TLS channel binding data as specified in RFC
+     * [5056](https://tools.ietf.org/html/rfc5056), RFC
+     * [5929](https://tools.ietf.org/html/rfc5929), and related RFCs.  The
+     * binding data is returned in @data.  The `data` is resized by the callee
+     * using #GByteArray buffer management and will be freed when the `data` is destroyed by g_byte_array_unref(). If `data` is %NULL, it will only
+     * check whether TLS backend is able to fetch the data (e.g. whether `type` is supported by the TLS backend). It does not guarantee that the data
+     * will be available though.  That could happen if TLS connection does not
+     * support `type` or the binding data is not available yet due to additional
+     * negotiation or input required.
+     * @param type - #GTlsChannelBindingType type of data to fetch
+     * @param data - #GByteArray is
+     */
     getChannelBindingData(type: TlsChannelBindingType, data?: Ref<GLib.ByteArray> | null): boolean;
+    /**
+     * Returns the name of the current TLS ciphersuite, or %NULL if the
+     * connection has not handshaked or has been closed. Beware that the TLS
+     * backend may use any of multiple different naming conventions, because
+     * OpenSSL and GnuTLS have their own ciphersuite naming conventions that
+     * are different from each other and different from the standard, IANA-
+     * registered ciphersuite names. The ciphersuite name is intended to be
+     * displayed to the user for informative purposes only, and parsing it
+     * is not recommended.
+     */
     getCiphersuiteName(): string | null;
+    /**
+     * Gets the certificate database that `conn` uses to verify
+     * peer certificates. See g_tls_connection_set_database().
+     */
     getDatabase(): TlsDatabase | null;
+    /**
+     * Get the object that will be used to interact with the user. It will be used
+     * for things like prompting the user for passwords. If %NULL is returned, then
+     * no user interaction will occur for this connection.
+     */
     getInteraction(): TlsInteraction | null;
+    /**
+     * Gets the name of the application-layer protocol negotiated during
+     * the handshake.
+     *
+     * If the peer did not use the ALPN extension, or did not advertise a
+     * protocol that matched one of @conn's protocols, or the TLS backend
+     * does not support ALPN, then this will be %NULL. See
+     * g_tls_connection_set_advertised_protocols().
+     */
     getNegotiatedProtocol(): string | null;
+    /**
+     * Gets @conn's peer's certificate after the handshake has completed
+     * or failed. (It is not set during the emission of
+     * #GTlsConnection::accept-certificate.)
+     */
     getPeerCertificate(): TlsCertificate | null;
+    /**
+     * Gets the errors associated with validating @conn's peer's
+     * certificate, after the handshake has completed or failed. (It is
+     * not set during the emission of #GTlsConnection::accept-certificate.)
+     *
+     * See #GTlsConnection:peer-certificate-errors for more information.
+     */
     getPeerCertificateErrors(): TlsCertificateFlags;
+    /**
+     * Returns the current TLS protocol version, which may be
+     * %G_TLS_PROTOCOL_VERSION_UNKNOWN if the connection has not handshaked, or
+     * has been closed, or if the TLS backend has implemented a protocol version
+     * that is not a recognized #GTlsProtocolVersion.
+     */
     getProtocolVersion(): TlsProtocolVersion;
+    /**
+     * Gets `conn` rehandshaking mode. See
+     * g_tls_connection_set_rehandshake_mode() for details.
+     */
     getRehandshakeMode(): TlsRehandshakeMode;
+    /**
+     * Tests whether or not `conn` expects a proper TLS close notification
+     * when the connection is closed. See
+     * g_tls_connection_set_require_close_notify() for details.
+     */
     getRequireCloseNotify(): boolean;
+    /**
+     * Gets whether `conn` uses the system certificate database to verify
+     * peer certificates. See g_tls_connection_set_use_system_certdb().
+     */
     getUseSystemCertdb(): boolean;
+    /**
+     * Attempts a TLS handshake on @conn.
+     *
+     * On the client side, it is never necessary to call this method;
+     * although the connection needs to perform a handshake after
+     * connecting (or after sending a "STARTTLS"-type command),
+     * #GTlsConnection will handle this for you automatically when you try
+     * to send or receive data on the connection. You can call
+     * g_tls_connection_handshake() manually if you want to know whether
+     * the initial handshake succeeded or failed (as opposed to just
+     * immediately trying to use `conn` to read or write, in which case,
+     * if it fails, it may not be possible to tell if it failed before or
+     * after completing the handshake), but beware that servers may reject
+     * client authentication after the handshake has completed, so a
+     * successful handshake does not indicate the connection will be usable.
+     *
+     * Likewise, on the server side, although a handshake is necessary at
+     * the beginning of the communication, you do not need to call this
+     * function explicitly unless you want clearer error reporting.
+     *
+     * Previously, calling g_tls_connection_handshake() after the initial
+     * handshake would trigger a rehandshake; however, this usage was
+     * deprecated in GLib 2.60 because rehandshaking was removed from the
+     * TLS protocol in TLS 1.3. Since GLib 2.64, calling this function after
+     * the initial handshake will no longer do anything.
+     *
+     * When using a #GTlsConnection created by #GSocketClient, the
+     * #GSocketClient performs the initial handshake, so calling this
+     * function manually is not recommended.
+     *
+     * #GTlsConnection::accept_certificate may be emitted during the
+     * handshake.
+     * @param cancellable - a #GCancellable, or %NULL
+     */
     handshake(cancellable?: Cancellable | null): boolean;
+    /**
+     * Asynchronously performs a TLS handshake on @conn. See
+     * g_tls_connection_handshake() for more information.
+     * @param ioPriority - the I/O priority of the request
+     * @param cancellable - a #GCancellable, or %NULL
+     * @param callback - callback to call when the handshake is complete
+     * @param userData - the data to pass to the callback function
+     */
     handshakeAsync(ioPriority: number, cancellable?: Cancellable | null, callback?: (...args: unknown[]) => unknown | null, userData?: number | null): void;
+    /**
+     * Finish an asynchronous TLS handshake operation. See
+     * g_tls_connection_handshake() for more information.
+     * @param result - a #GAsyncResult.
+     */
     handshakeFinish(result: AsyncResult): boolean;
+    /**
+     * Sets the list of application-layer protocols to advertise that the
+     * caller is willing to speak on this connection. The
+     * Application-Layer Protocol Negotiation (ALPN) extension will be
+     * used to negotiate a compatible protocol with the peer; use
+     * g_tls_connection_get_negotiated_protocol() to find the negotiated
+     * protocol after the handshake.  Specifying %NULL for the the value
+     * of `protocols` will disable ALPN negotiation.
+     *
+     * See [IANA TLS ALPN Protocol IDs](https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids)
+     * for a list of registered protocol IDs.
+     * @param protocols - a %NULL-terminated
+     */
     setAdvertisedProtocols(protocols?: string[] | null): void;
+    /**
+     * This sets the certificate that `conn` will present to its peer
+     * during the TLS handshake. For a #GTlsServerConnection, it is
+     * mandatory to set this, and that will normally be done at construct
+     * time.
+     *
+     * For a #GTlsClientConnection, this is optional. If a handshake fails
+     * with %G_TLS_ERROR_CERTIFICATE_REQUIRED, that means that the server
+     * requires a certificate, and if you try connecting again, you should
+     * call this method first. You can call
+     * g_tls_client_connection_get_accepted_cas() on the failed connection
+     * to get a list of Certificate Authorities that the server will
+     * accept certificates from.
+     *
+     * (It is also possible that a server will allow the connection with
+     * or without a certificate; in that case, if you don't provide a
+     * certificate, you can tell that the server requested one by the fact
+     * that g_tls_client_connection_get_accepted_cas() will return
+     * non-%NULL.)
+     * @param certificate - the certificate to use for @conn
+     */
     setCertificate(certificate: TlsCertificate): void;
+    /**
+     * Sets the certificate database that is used to verify peer certificates.
+     * This is set to the default database by default. See
+     * g_tls_backend_get_default_database(). If set to %NULL, then
+     * peer certificate validation will always set the
+     * %G_TLS_CERTIFICATE_UNKNOWN_CA error (meaning
+     * #GTlsConnection::accept-certificate will always be emitted on
+     * client-side connections, unless that bit is not set in
+     * #GTlsClientConnection:validation-flags).
+     *
+     * There are nonintuitive security implications when using a non-default
+     * database. See #GTlsConnection:database for details.
+     * @param database - a #GTlsDatabase
+     */
     setDatabase(database?: TlsDatabase | null): void;
+    /**
+     * Set the object that will be used to interact with the user. It will be used
+     * for things like prompting the user for passwords.
+     *
+     * The `interaction` argument will normally be a derived subclass of
+     * #GTlsInteraction. %NULL can also be provided if no user interaction
+     * should occur for this connection.
+     * @param interaction - an interaction object, or %NULL
+     */
     setInteraction(interaction?: TlsInteraction | null): void;
+    /**
+     * Since GLib 2.64, changing the rehandshake mode is no longer supported
+     * and will have no effect. With TLS 1.3, rehandshaking has been removed from
+     * the TLS protocol, replaced by separate post-handshake authentication and
+     * rekey operations.
+     * @param mode - the rehandshaking mode
+     */
     setRehandshakeMode(mode: TlsRehandshakeMode): void;
+    /**
+     * Sets whether or not `conn` expects a proper TLS close notification
+     * before the connection is closed. If this is %TRUE (the default),
+     * then `conn` will expect to receive a TLS close notification from its
+     * peer before the connection is closed, and will return a
+     * %G_TLS_ERROR_EOF error if the connection is closed without proper
+     * notification (since this may indicate a network error, or
+     * man-in-the-middle attack).
+     *
+     * In some protocols, the application will know whether or not the
+     * connection was closed cleanly based on application-level data
+     * (because the application-level data includes a length field, or is
+     * somehow self-delimiting); in this case, the close notify is
+     * redundant and sometimes omitted. (TLS 1.1 explicitly allows this;
+     * in TLS 1.0 it is technically an error, but often done anyway.) You
+     * can use g_tls_connection_set_require_close_notify() to tell `conn` to allow an "unannounced" connection close, in which case the close
+     * will show up as a 0-length read, as in a non-TLS
+     * #GSocketConnection, and it is up to the application to check that
+     * the data has been fully received.
+     *
+     * Note that this only affects the behavior when the peer closes the
+     * connection; when the application calls g_io_stream_close() itself
+     * on @conn, this will send a close notification regardless of the
+     * setting of this property. If you explicitly want to do an unclean
+     * close, you can close @conn's #GTlsConnection:base-io-stream rather
+     * than closing `conn` itself, but note that this may only be done when no other
+     * operations are pending on `conn` or the base I/O stream.
+     * @param requireCloseNotify - whether or not to require close notification
+     */
     setRequireCloseNotify(requireCloseNotify: boolean): void;
+    /**
+     * Sets whether `conn` uses the system certificate database to verify
+     * peer certificates. This is %TRUE by default. If set to %FALSE, then
+     * peer certificate validation will always set the
+     * %G_TLS_CERTIFICATE_UNKNOWN_CA error (meaning
+     * #GTlsConnection::accept-certificate will always be emitted on
+     * client-side connections, unless that bit is not set in
+     * #GTlsClientConnection:validation-flags).
+     * @param useSystemCertdb - whether to use the system certificate database
+     */
     setUseSystemCertdb(useSystemCertdb: boolean): void;
     connect(signal: "accept-certificate", handler: (self: TlsConnection, peerCert: TlsCertificate, errors: TlsCertificateFlags) => boolean, after?: boolean): number;
     connect(signal: "notify", handler: (self: TlsConnection, pspec: GObject.ParamSpec) => void, after?: boolean): number;

package/dist/generated/gio/tls-connection.js

@@ -4,6 +4,15 @@ import { TlsDatabase } from "./tls-database.js";
 import { TlsInteraction } from "./tls-interaction.js";
 import { TlsCertificate } from "./tls-certificate.js";
 import { IOStream } from "./iostream.js";
+/**
+ * `GTlsConnection` is the base TLS connection class type, which wraps
+ * a [class@Gio.IOStream] and provides TLS encryption on top of it. Its
+ * subclasses, [iface@Gio.TlsClientConnection] and
+ * [iface@Gio.TlsServerConnection], implement client-side and server-side TLS,
+ * respectively.
+ *
+ * For DTLS (Datagram TLS) support, see [iface@Gio.DtlsConnection].
+ */
 const SIGNAL_META = {
     "accept-certificate": {
         params: [
@@ -31,6 +40,12 @@ export class TlsConnection extends IOStream {
             { type: { type: "gobject" }, value: null },
         ], { type: "gobject", borrowed: true });
     }
+    /**
+     * Used by #GTlsConnection implementations to emit the
+     * #GTlsConnection::accept-certificate signal.
+     * @param peerCert - the peer's #GTlsCertificate
+     * @param errors - the problems with @peer_cert
+     */
     emitAcceptCertificate(peerCert, errors) {
         return call("libgio-2.0.so.0", "g_tls_connection_emit_accept_certificate", [
             {
@@ -47,6 +62,10 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "boolean" });
     }
+    /**
+     * Gets @conn's certificate, as set by
+     * g_tls_connection_set_certificate().
+     */
     getCertificate() {
         const ptr = call("libgio-2.0.so.0", "g_tls_connection_get_certificate", [
             {
@@ -58,6 +77,21 @@ export class TlsConnection extends IOStream {
             return null;
         return getObject(ptr, TlsCertificate);
     }
+    /**
+     * Query the TLS backend for TLS channel binding data of `type` for @conn.
+     *
+     * This call retrieves TLS channel binding data as specified in RFC
+     * [5056](https://tools.ietf.org/html/rfc5056), RFC
+     * [5929](https://tools.ietf.org/html/rfc5929), and related RFCs.  The
+     * binding data is returned in @data.  The `data` is resized by the callee
+     * using #GByteArray buffer management and will be freed when the `data` is destroyed by g_byte_array_unref(). If `data` is %NULL, it will only
+     * check whether TLS backend is able to fetch the data (e.g. whether `type` is supported by the TLS backend). It does not guarantee that the data
+     * will be available though.  That could happen if TLS connection does not
+     * support `type` or the binding data is not available yet due to additional
+     * negotiation or input required.
+     * @param type - #GTlsChannelBindingType type of data to fetch
+     * @param data - #GByteArray is
+     */
     getChannelBindingData(type, data) {
         const error = { value: null };
         const result = call("libgio-2.0.so.0", "g_tls_connection_get_channel_binding_data", [
@@ -98,6 +132,16 @@ export class TlsConnection extends IOStream {
         }
         return result;
     }
+    /**
+     * Returns the name of the current TLS ciphersuite, or %NULL if the
+     * connection has not handshaked or has been closed. Beware that the TLS
+     * backend may use any of multiple different naming conventions, because
+     * OpenSSL and GnuTLS have their own ciphersuite naming conventions that
+     * are different from each other and different from the standard, IANA-
+     * registered ciphersuite names. The ciphersuite name is intended to be
+     * displayed to the user for informative purposes only, and parsing it
+     * is not recommended.
+     */
     getCiphersuiteName() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_ciphersuite_name", [
             {
@@ -106,6 +150,10 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "string" });
     }
+    /**
+     * Gets the certificate database that `conn` uses to verify
+     * peer certificates. See g_tls_connection_set_database().
+     */
     getDatabase() {
         const ptr = call("libgio-2.0.so.0", "g_tls_connection_get_database", [
             {
@@ -117,6 +165,11 @@ export class TlsConnection extends IOStream {
             return null;
         return getObject(ptr, TlsDatabase);
     }
+    /**
+     * Get the object that will be used to interact with the user. It will be used
+     * for things like prompting the user for passwords. If %NULL is returned, then
+     * no user interaction will occur for this connection.
+     */
     getInteraction() {
         const ptr = call("libgio-2.0.so.0", "g_tls_connection_get_interaction", [
             {
@@ -128,6 +181,15 @@ export class TlsConnection extends IOStream {
             return null;
         return getObject(ptr, TlsInteraction);
     }
+    /**
+     * Gets the name of the application-layer protocol negotiated during
+     * the handshake.
+     *
+     * If the peer did not use the ALPN extension, or did not advertise a
+     * protocol that matched one of @conn's protocols, or the TLS backend
+     * does not support ALPN, then this will be %NULL. See
+     * g_tls_connection_set_advertised_protocols().
+     */
     getNegotiatedProtocol() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_negotiated_protocol", [
             {
@@ -136,6 +198,11 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "string", borrowed: true });
     }
+    /**
+     * Gets @conn's peer's certificate after the handshake has completed
+     * or failed. (It is not set during the emission of
+     * #GTlsConnection::accept-certificate.)
+     */
     getPeerCertificate() {
         const ptr = call("libgio-2.0.so.0", "g_tls_connection_get_peer_certificate", [
             {
@@ -147,6 +214,13 @@ export class TlsConnection extends IOStream {
             return null;
         return getObject(ptr, TlsCertificate);
     }
+    /**
+     * Gets the errors associated with validating @conn's peer's
+     * certificate, after the handshake has completed or failed. (It is
+     * not set during the emission of #GTlsConnection::accept-certificate.)
+     *
+     * See #GTlsConnection:peer-certificate-errors for more information.
+     */
     getPeerCertificateErrors() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_peer_certificate_errors", [
             {
@@ -155,6 +229,12 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "int", size: 32, unsigned: false });
     }
+    /**
+     * Returns the current TLS protocol version, which may be
+     * %G_TLS_PROTOCOL_VERSION_UNKNOWN if the connection has not handshaked, or
+     * has been closed, or if the TLS backend has implemented a protocol version
+     * that is not a recognized #GTlsProtocolVersion.
+     */
     getProtocolVersion() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_protocol_version", [
             {
@@ -163,6 +243,10 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "int", size: 32, unsigned: false });
     }
+    /**
+     * Gets `conn` rehandshaking mode. See
+     * g_tls_connection_set_rehandshake_mode() for details.
+     */
     getRehandshakeMode() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_rehandshake_mode", [
             {
@@ -171,6 +255,11 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "int", size: 32, unsigned: false });
     }
+    /**
+     * Tests whether or not `conn` expects a proper TLS close notification
+     * when the connection is closed. See
+     * g_tls_connection_set_require_close_notify() for details.
+     */
     getRequireCloseNotify() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_require_close_notify", [
             {
@@ -179,6 +268,10 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "boolean" });
     }
+    /**
+     * Gets whether `conn` uses the system certificate database to verify
+     * peer certificates. See g_tls_connection_set_use_system_certdb().
+     */
     getUseSystemCertdb() {
         return call("libgio-2.0.so.0", "g_tls_connection_get_use_system_certdb", [
             {
@@ -187,6 +280,40 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "boolean" });
     }
+    /**
+     * Attempts a TLS handshake on @conn.
+     *
+     * On the client side, it is never necessary to call this method;
+     * although the connection needs to perform a handshake after
+     * connecting (or after sending a "STARTTLS"-type command),
+     * #GTlsConnection will handle this for you automatically when you try
+     * to send or receive data on the connection. You can call
+     * g_tls_connection_handshake() manually if you want to know whether
+     * the initial handshake succeeded or failed (as opposed to just
+     * immediately trying to use `conn` to read or write, in which case,
+     * if it fails, it may not be possible to tell if it failed before or
+     * after completing the handshake), but beware that servers may reject
+     * client authentication after the handshake has completed, so a
+     * successful handshake does not indicate the connection will be usable.
+     *
+     * Likewise, on the server side, although a handshake is necessary at
+     * the beginning of the communication, you do not need to call this
+     * function explicitly unless you want clearer error reporting.
+     *
+     * Previously, calling g_tls_connection_handshake() after the initial
+     * handshake would trigger a rehandshake; however, this usage was
+     * deprecated in GLib 2.60 because rehandshaking was removed from the
+     * TLS protocol in TLS 1.3. Since GLib 2.64, calling this function after
+     * the initial handshake will no longer do anything.
+     *
+     * When using a #GTlsConnection created by #GSocketClient, the
+     * #GSocketClient performs the initial handshake, so calling this
+     * function manually is not recommended.
+     *
+     * #GTlsConnection::accept_certificate may be emitted during the
+     * handshake.
+     * @param cancellable - a #GCancellable, or %NULL
+     */
     handshake(cancellable) {
         const error = { value: null };
         const result = call("libgio-2.0.so.0", "g_tls_connection_handshake", [
@@ -216,6 +343,14 @@ export class TlsConnection extends IOStream {
         }
         return result;
     }
+    /**
+     * Asynchronously performs a TLS handshake on @conn. See
+     * g_tls_connection_handshake() for more information.
+     * @param ioPriority - the I/O priority of the request
+     * @param cancellable - a #GCancellable, or %NULL
+     * @param callback - callback to call when the handshake is complete
+     * @param userData - the data to pass to the callback function
+     */
     handshakeAsync(ioPriority, cancellable, callback, userData) {
         call("libgio-2.0.so.0", "g_tls_connection_handshake_async", [
             {
@@ -243,6 +378,11 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Finish an asynchronous TLS handshake operation. See
+     * g_tls_connection_handshake() for more information.
+     * @param result - a #GAsyncResult.
+     */
     handshakeFinish(result) {
         const error = { value: null };
         const _result = call("libgio-2.0.so.0", "g_tls_connection_handshake_finish", [
@@ -271,6 +411,19 @@ export class TlsConnection extends IOStream {
         }
         return _result;
     }
+    /**
+     * Sets the list of application-layer protocols to advertise that the
+     * caller is willing to speak on this connection. The
+     * Application-Layer Protocol Negotiation (ALPN) extension will be
+     * used to negotiate a compatible protocol with the peer; use
+     * g_tls_connection_get_negotiated_protocol() to find the negotiated
+     * protocol after the handshake.  Specifying %NULL for the the value
+     * of `protocols` will disable ALPN negotiation.
+     *
+     * See [IANA TLS ALPN Protocol IDs](https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids)
+     * for a list of registered protocol IDs.
+     * @param protocols - a %NULL-terminated
+     */
     setAdvertisedProtocols(protocols) {
         call("libgio-2.0.so.0", "g_tls_connection_set_advertised_protocols", [
             {
@@ -284,6 +437,27 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * This sets the certificate that `conn` will present to its peer
+     * during the TLS handshake. For a #GTlsServerConnection, it is
+     * mandatory to set this, and that will normally be done at construct
+     * time.
+     *
+     * For a #GTlsClientConnection, this is optional. If a handshake fails
+     * with %G_TLS_ERROR_CERTIFICATE_REQUIRED, that means that the server
+     * requires a certificate, and if you try connecting again, you should
+     * call this method first. You can call
+     * g_tls_client_connection_get_accepted_cas() on the failed connection
+     * to get a list of Certificate Authorities that the server will
+     * accept certificates from.
+     *
+     * (It is also possible that a server will allow the connection with
+     * or without a certificate; in that case, if you don't provide a
+     * certificate, you can tell that the server requested one by the fact
+     * that g_tls_client_connection_get_accepted_cas() will return
+     * non-%NULL.)
+     * @param certificate - the certificate to use for @conn
+     */
     setCertificate(certificate) {
         call("libgio-2.0.so.0", "g_tls_connection_set_certificate", [
             {
@@ -296,6 +470,20 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Sets the certificate database that is used to verify peer certificates.
+     * This is set to the default database by default. See
+     * g_tls_backend_get_default_database(). If set to %NULL, then
+     * peer certificate validation will always set the
+     * %G_TLS_CERTIFICATE_UNKNOWN_CA error (meaning
+     * #GTlsConnection::accept-certificate will always be emitted on
+     * client-side connections, unless that bit is not set in
+     * #GTlsClientConnection:validation-flags).
+     *
+     * There are nonintuitive security implications when using a non-default
+     * database. See #GTlsConnection:database for details.
+     * @param database - a #GTlsDatabase
+     */
     setDatabase(database) {
         call("libgio-2.0.so.0", "g_tls_connection_set_database", [
             {
@@ -309,6 +497,15 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Set the object that will be used to interact with the user. It will be used
+     * for things like prompting the user for passwords.
+     *
+     * The `interaction` argument will normally be a derived subclass of
+     * #GTlsInteraction. %NULL can also be provided if no user interaction
+     * should occur for this connection.
+     * @param interaction - an interaction object, or %NULL
+     */
     setInteraction(interaction) {
         call("libgio-2.0.so.0", "g_tls_connection_set_interaction", [
             {
@@ -322,6 +519,13 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Since GLib 2.64, changing the rehandshake mode is no longer supported
+     * and will have no effect. With TLS 1.3, rehandshaking has been removed from
+     * the TLS protocol, replaced by separate post-handshake authentication and
+     * rekey operations.
+     * @param mode - the rehandshaking mode
+     */
     setRehandshakeMode(mode) {
         call("libgio-2.0.so.0", "g_tls_connection_set_rehandshake_mode", [
             {
@@ -334,6 +538,35 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Sets whether or not `conn` expects a proper TLS close notification
+     * before the connection is closed. If this is %TRUE (the default),
+     * then `conn` will expect to receive a TLS close notification from its
+     * peer before the connection is closed, and will return a
+     * %G_TLS_ERROR_EOF error if the connection is closed without proper
+     * notification (since this may indicate a network error, or
+     * man-in-the-middle attack).
+     *
+     * In some protocols, the application will know whether or not the
+     * connection was closed cleanly based on application-level data
+     * (because the application-level data includes a length field, or is
+     * somehow self-delimiting); in this case, the close notify is
+     * redundant and sometimes omitted. (TLS 1.1 explicitly allows this;
+     * in TLS 1.0 it is technically an error, but often done anyway.) You
+     * can use g_tls_connection_set_require_close_notify() to tell `conn` to allow an "unannounced" connection close, in which case the close
+     * will show up as a 0-length read, as in a non-TLS
+     * #GSocketConnection, and it is up to the application to check that
+     * the data has been fully received.
+     *
+     * Note that this only affects the behavior when the peer closes the
+     * connection; when the application calls g_io_stream_close() itself
+     * on @conn, this will send a close notification regardless of the
+     * setting of this property. If you explicitly want to do an unclean
+     * close, you can close @conn's #GTlsConnection:base-io-stream rather
+     * than closing `conn` itself, but note that this may only be done when no other
+     * operations are pending on `conn` or the base I/O stream.
+     * @param requireCloseNotify - whether or not to require close notification
+     */
     setRequireCloseNotify(requireCloseNotify) {
         call("libgio-2.0.so.0", "g_tls_connection_set_require_close_notify", [
             {
@@ -346,6 +579,16 @@ export class TlsConnection extends IOStream {
             },
         ], { type: "undefined" });
     }
+    /**
+     * Sets whether `conn` uses the system certificate database to verify
+     * peer certificates. This is %TRUE by default. If set to %FALSE, then
+     * peer certificate validation will always set the
+     * %G_TLS_CERTIFICATE_UNKNOWN_CA error (meaning
+     * #GTlsConnection::accept-certificate will always be emitted on
+     * client-side connections, unless that bit is not set in
+     * #GTlsClientConnection:validation-flags).
+     * @param useSystemCertdb - whether to use the system certificate database
+     */
     setUseSystemCertdb(useSystemCertdb) {
         call("libgio-2.0.so.0", "g_tls_connection_set_use_system_certdb", [
             {