Merge commit 'dev' into 'wip/cmake-merge'

Change-Id: I176c40d031be26a1dd1cf08843e448a660598783

21 files changed, 396 insertions, 247 deletions

diff --git a/src/network/kernel/kernel.pri b/src/network/kernel/kernel.pri
index 11b80d59d5..b86119b200 100644
--- a/src/network/kernel/kernel.pri
+++ b/src/network/kernel/kernel.pri
@@ -39,8 +39,11 @@ qtConfig(dnslookup) {
 
 unix {
     !integrity:qtConfig(dnslookup): SOURCES += kernel/qdnslookup_unix.cpp
+
     SOURCES += kernel/qhostinfo_unix.cpp
 
+    qtConfig(dlopen): QMAKE_USE_PRIVATE += libdl
+
     qtConfig(linux-netlink): SOURCES += kernel/qnetworkinterface_linux.cpp
     else: SOURCES += kernel/qnetworkinterface_unix.cpp
 }
@@ -68,6 +71,8 @@ mac {
     !uikit: LIBS_PRIVATE += -framework CoreServices -framework SystemConfiguration
 }
 
+qtConfig(gssapi): LIBS_PRIVATE += -lgssapi_krb5
+
 uikit:HEADERS += kernel/qnetworkinterface_uikit_p.h
 osx:SOURCES += kernel/qnetworkproxy_mac.cpp
 else:win32:!winrt: SOURCES += kernel/qnetworkproxy_win.cpp
diff --git a/src/network/kernel/qauthenticator.cpp b/src/network/kernel/qauthenticator.cpp
index 47ce9ab0c6..3ca8806c2b 100644
--- a/src/network/kernel/qauthenticator.cpp
+++ b/src/network/kernel/qauthenticator.cpp
@@ -54,20 +54,29 @@
 #include <qmutex.h>
 #include <private/qmutexpool_p.h>
 #include <rpc.h>
-#ifndef Q_OS_WINRT
+#endif
+
+#if QT_CONFIG(sspi) // SSPI
 #define SECURITY_WIN32 1
 #include <security.h>
-#endif
+#elif QT_CONFIG(gssapi) // GSSAPI
+#include <gssapi/gssapi.h>
 #endif
 
 QT_BEGIN_NAMESPACE
 
 static QByteArray qNtlmPhase1();
 static QByteArray qNtlmPhase3(QAuthenticatorPrivate *ctx, const QByteArray& phase2data);
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
-static QByteArray qNtlmPhase1_SSPI(QAuthenticatorPrivate *ctx);
-static QByteArray qNtlmPhase3_SSPI(QAuthenticatorPrivate *ctx, const QByteArray& phase2data);
-#endif
+#if QT_CONFIG(sspi) // SSPI
+static QByteArray qSspiStartup(QAuthenticatorPrivate *ctx, QAuthenticatorPrivate::Method method,
+                               const QString& host);
+static QByteArray qSspiContinue(QAuthenticatorPrivate *ctx, QAuthenticatorPrivate::Method method,
+                                const QString& host, const QByteArray& challenge = QByteArray());
+#elif QT_CONFIG(gssapi) // GSSAPI
+static QByteArray qGssapiStartup(QAuthenticatorPrivate *ctx, const QString& host);
+static QByteArray qGssapiContinue(QAuthenticatorPrivate *ctx,
+                                  const QByteArray& challenge = QByteArray());
+#endif // gssapi
 
 /*!
   \class QAuthenticator
@@ -90,6 +99,7 @@ static QByteArray qNtlmPhase3_SSPI(QAuthenticatorPrivate *ctx, const QByteArray&
     \li Basic
     \li NTLM version 2
     \li Digest-MD5
+    \li SPNEGO/Negotiate
   \endlist
 
   \target qauthenticator-options
@@ -133,6 +143,10 @@ static QByteArray qNtlmPhase3_SSPI(QAuthenticatorPrivate *ctx, const QByteArray&
 
   The Digest-MD5 authentication mechanism supports no outgoing options.
 
+  \section2 SPNEGO/Negotiate
+
+  This authentication mechanism currently supports no incoming or outgoing options.
+
   \sa QSslSocket
 */
 
@@ -187,7 +201,7 @@ QAuthenticator &QAuthenticator::operator=(const QAuthenticator &other)
         d->options = other.d->options;
     } else if (d->phase == QAuthenticatorPrivate::Start) {
         delete d;
-        d = 0;
+        d = nullptr;
     }
     return *this;
 }
@@ -339,21 +353,25 @@ bool QAuthenticator::isNull() const
     return !d;
 }
 
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
-class QNtlmWindowsHandles
+#if QT_CONFIG(sspi) // SSPI
+class QSSPIWindowsHandles
 {
 public:
     CredHandle credHandle;
     CtxtHandle ctxHandle;
 };
-#endif
+#elif QT_CONFIG(gssapi) // GSSAPI
+class QGssApiHandles
+{
+public:
+    gss_ctx_id_t gssCtx = nullptr;
+    gss_name_t targetName;
+};
+#endif // gssapi
 
 
 QAuthenticatorPrivate::QAuthenticatorPrivate()
     : method(None)
-    #if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
-    , ntlmWindowsHandles(0)
-    #endif
     , hasFailed(false)
     , phase(Start)
     , nonceCount(0)
@@ -363,13 +381,7 @@ QAuthenticatorPrivate::QAuthenticatorPrivate()
     nonceCount = 0;
 }
 
-QAuthenticatorPrivate::~QAuthenticatorPrivate()
-{
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
-    if (ntlmWindowsHandles)
-        delete ntlmWindowsHandles;
-#endif
-}
+QAuthenticatorPrivate::~QAuthenticatorPrivate() = default;
 
 void QAuthenticatorPrivate::updateCredentials()
 {
@@ -424,6 +436,9 @@ void QAuthenticatorPrivate::parseHttpResponse(const QList<QPair<QByteArray, QByt
         } else if (method < DigestMd5 && str.startsWith("digest")) {
             method = DigestMd5;
             headerVal = current.second.mid(7);
+        } else if (method < Negotiate && str.startsWith("negotiate")) {
+            method = Negotiate;
+            headerVal = current.second.mid(10);
         }
     }
 
@@ -439,6 +454,7 @@ void QAuthenticatorPrivate::parseHttpResponse(const QList<QPair<QByteArray, QByt
             phase = Done;
         break;
     case Ntlm:
+    case Negotiate:
         // work is done in calculateResponse()
         break;
     case DigestMd5: {
@@ -456,33 +472,36 @@ void QAuthenticatorPrivate::parseHttpResponse(const QList<QPair<QByteArray, QByt
     }
 }
 
-QByteArray QAuthenticatorPrivate::calculateResponse(const QByteArray &requestMethod, const QByteArray &path)
+QByteArray QAuthenticatorPrivate::calculateResponse(const QByteArray &requestMethod, const QByteArray &path, const QString& host)
 {
+#if !QT_CONFIG(sspi) && !QT_CONFIG(gssapi)
+    Q_UNUSED(host);
+#endif
     QByteArray response;
-    const char *methodString = 0;
+    const char* methodString = nullptr;
     switch(method) {
     case QAuthenticatorPrivate::None:
         methodString = "";
         phase = Done;
         break;
     case QAuthenticatorPrivate::Basic:
-        methodString = "Basic ";
+        methodString = "Basic";
         response = user.toLatin1() + ':' + password.toLatin1();
         response = response.toBase64();
         phase = Done;
         break;
     case QAuthenticatorPrivate::DigestMd5:
-        methodString = "Digest ";
+        methodString = "Digest";
         response = digestMd5Response(challenge, requestMethod, path);
         phase = Done;
         break;
     case QAuthenticatorPrivate::Ntlm:
-        methodString = "NTLM ";
+        methodString = "NTLM";
         if (challenge.isEmpty()) {
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
+#if QT_CONFIG(sspi) // SSPI
             QByteArray phase1Token;
             if (user.isEmpty()) // Only pull from system if no user was specified in authenticator
-                phase1Token = qNtlmPhase1_SSPI(this);
+                phase1Token = qSspiStartup(this, method, host);
             if (!phase1Token.isEmpty()) {
                 response = phase1Token.toBase64();
                 phase = Phase2;
@@ -496,10 +515,10 @@ QByteArray QAuthenticatorPrivate::calculateResponse(const QByteArray &requestMet
                     phase = Phase2;
             }
         } else {
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
+#if QT_CONFIG(sspi) // SSPI
             QByteArray phase3Token;
-            if (ntlmWindowsHandles)
-                phase3Token = qNtlmPhase3_SSPI(this, QByteArray::fromBase64(challenge));
+            if (sspiWindowsHandles)
+                phase3Token = qSspiContinue(this, method, host, QByteArray::fromBase64(challenge));
             if (!phase3Token.isEmpty()) {
                 response = phase3Token.toBase64();
                 phase = Done;
@@ -512,8 +531,39 @@ QByteArray QAuthenticatorPrivate::calculateResponse(const QByteArray &requestMet
         }
 
         break;
+    case QAuthenticatorPrivate::Negotiate:
+        methodString = "Negotiate";
+        if (challenge.isEmpty()) {
+            QByteArray phase1Token;
+#if QT_CONFIG(sspi) // SSPI
+            phase1Token = qSspiStartup(this, method, host);
+#elif QT_CONFIG(gssapi) // GSSAPI
+            phase1Token = qGssapiStartup(this, host);
+#endif
+
+            if (!phase1Token.isEmpty()) {
+                response = phase1Token.toBase64();
+                phase = Phase2;
+            } else {
+                phase = Done;
+            }
+        } else {
+            QByteArray phase3Token;
+#if QT_CONFIG(sspi) // SSPI
+            phase3Token = qSspiContinue(this, method, host, QByteArray::fromBase64(challenge));
+#elif QT_CONFIG(gssapi) // GSSAPI
+            phase3Token = qGssapiContinue(this, QByteArray::fromBase64(challenge));
+#endif
+            if (!phase3Token.isEmpty()) {
+                response = phase3Token.toBase64();
+                phase = Done;
+            }
+        }
+
+        break;
     }
-    return QByteArray(methodString) + response;
+
+    return QByteArray::fromRawData(methodString, qstrlen(methodString)) + ' ' + response;
 }
 
 
@@ -699,9 +749,10 @@ QByteArray QAuthenticatorPrivate::digestMd5Response(const QByteArray &challenge,
     return credentials;
 }
 
-// ---------------------------- Digest Md5 code ----------------------------------------
+// ---------------------------- End of Digest Md5 code ---------------------------------
 
 
+// ---------------------------- NTLM code ----------------------------------------------
 
 /*
  * NTLM message flags.
@@ -1419,156 +1470,237 @@ static QByteArray qNtlmPhase3(QAuthenticatorPrivate *ctx, const QByteArray& phas
     return rc;
 }
 
-#if defined(Q_OS_WIN) && !defined(Q_OS_WINRT)
+// ---------------------------- End of NTLM code ---------------------------------------
+
+#if QT_CONFIG(sspi) // SSPI
+// ---------------------------- SSPI code ----------------------------------------------
 // See http://davenport.sourceforge.net/ntlm.html
 // and libcurl http_ntlm.c
 
 // Handle of secur32.dll
-static HMODULE securityDLLHandle = NULL;
+static HMODULE securityDLLHandle = nullptr;
 // Pointer to SSPI dispatch table
-static PSecurityFunctionTable pSecurityFunctionTable = NULL;
-
+static PSecurityFunctionTable pSecurityFunctionTable = nullptr;
 
-static bool q_NTLM_SSPI_library_load()
+static bool q_SSPI_library_load()
 {
     static QBasicMutex mutex;
     QMutexLocker l(&mutex);
 
     // Initialize security interface
-    if (pSecurityFunctionTable == NULL) {
+    if (pSecurityFunctionTable == nullptr) {
         securityDLLHandle = LoadLibrary(L"secur32.dll");
-        if (securityDLLHandle != NULL) {
+        if (securityDLLHandle != nullptr) {
             INIT_SECURITY_INTERFACE pInitSecurityInterface =
                 reinterpret_cast<INIT_SECURITY_INTERFACE>(
                     reinterpret_cast<QFunctionPointer>(GetProcAddress(securityDLLHandle, "InitSecurityInterfaceW")));
-            if (pInitSecurityInterface != NULL)
+            if (pInitSecurityInterface != nullptr)
                 pSecurityFunctionTable = pInitSecurityInterface();
         }
     }
 
-    if (pSecurityFunctionTable == NULL)
+    if (pSecurityFunctionTable == nullptr)
         return false;
 
     return true;
 }
 
-// Phase 1:
-static QByteArray qNtlmPhase1_SSPI(QAuthenticatorPrivate *ctx)
+static QByteArray qSspiStartup(QAuthenticatorPrivate *ctx, QAuthenticatorPrivate::Method method,
+                               const QString& host)
 {
-    QByteArray result;
+    if (!q_SSPI_library_load())
+        return QByteArray();
+
+    TimeStamp expiry; // For Windows 9x compatibility of SSPI calls
 
-    if (!q_NTLM_SSPI_library_load())
-        return result;
+    if (!ctx->sspiWindowsHandles)
+        ctx->sspiWindowsHandles.reset(new QSSPIWindowsHandles);
+    memset(&ctx->sspiWindowsHandles->credHandle, 0, sizeof(CredHandle));
 
-    // 1. The client obtains a representation of the credential set
-    // for the user via the SSPI AcquireCredentialsHandle function.
-    if (!ctx->ntlmWindowsHandles)
-        ctx->ntlmWindowsHandles = new QNtlmWindowsHandles;
-    memset(&ctx->ntlmWindowsHandles->credHandle, 0, sizeof(CredHandle));
-    TimeStamp tsDummy;
+    // Acquire our credentials handle
     SECURITY_STATUS secStatus = pSecurityFunctionTable->AcquireCredentialsHandle(
-        NULL, (SEC_WCHAR*)L"NTLM", SECPKG_CRED_OUTBOUND, NULL, NULL,
-        NULL, NULL, &ctx->ntlmWindowsHandles->credHandle, &tsDummy);
+                nullptr,
+                (SEC_WCHAR*)(method == QAuthenticatorPrivate::Negotiate ? L"Negotiate" : L"NTLM"),
+                SECPKG_CRED_OUTBOUND, nullptr, nullptr, nullptr, nullptr,
+                &ctx->sspiWindowsHandles->credHandle, &expiry
+    );
     if (secStatus != SEC_E_OK) {
-        delete ctx->ntlmWindowsHandles;
-        ctx->ntlmWindowsHandles = 0;
-        return result;
+        ctx->sspiWindowsHandles.reset(nullptr);
+        return QByteArray();
     }
 
-    // 2. The client calls the SSPI InitializeSecurityContext function
-    // to obtain an authentication request token (in our case, a Type 1 message).
-    // The client sends this token to the server.
-    SecBufferDesc desc;
-    SecBuffer buf;
-    desc.ulVersion = SECBUFFER_VERSION;
-    desc.cBuffers  = 1;
-    desc.pBuffers  = &buf;
-    buf.cbBuffer   = 0;
-    buf.BufferType = SECBUFFER_TOKEN;
-    buf.pvBuffer   = NULL;
-    ULONG attrs;
-
-    secStatus = pSecurityFunctionTable->InitializeSecurityContext(&ctx->ntlmWindowsHandles->credHandle, NULL,
-        const_cast<SEC_WCHAR*>(L"") /* host */,
-        ISC_REQ_ALLOCATE_MEMORY,
-        0, SECURITY_NETWORK_DREP,
-        NULL, 0,
-        &ctx->ntlmWindowsHandles->ctxHandle, &desc,
-        &attrs, &tsDummy);
-    if (secStatus == SEC_I_COMPLETE_AND_CONTINUE ||
-        secStatus == SEC_I_CONTINUE_NEEDED) {
-            pSecurityFunctionTable->CompleteAuthToken(&ctx->ntlmWindowsHandles->ctxHandle, &desc);
-    } else if (secStatus != SEC_E_OK) {
-        if ((const char*)buf.pvBuffer)
-            pSecurityFunctionTable->FreeContextBuffer(buf.pvBuffer);
-        pSecurityFunctionTable->FreeCredentialsHandle(&ctx->ntlmWindowsHandles->credHandle);
-        delete ctx->ntlmWindowsHandles;
-        ctx->ntlmWindowsHandles = 0;
-        return result;
+    return qSspiContinue(ctx, method, host);
+}
+
+static QByteArray qSspiContinue(QAuthenticatorPrivate *ctx, QAuthenticatorPrivate::Method method,
+                                  const QString &host, const QByteArray &challenge)
+{
+    QByteArray result;
+    SecBuffer challengeBuf;
+    SecBuffer responseBuf;
+    SecBufferDesc challengeDesc;
+    SecBufferDesc responseDesc;
+    unsigned long attrs;
+    TimeStamp expiry; // For Windows 9x compatibility of SSPI calls
+
+    if (!challenge.isEmpty())
+    {
+        // Setup the challenge "input" security buffer
+        challengeDesc.ulVersion = SECBUFFER_VERSION;
+        challengeDesc.cBuffers  = 1;
+        challengeDesc.pBuffers  = &challengeBuf;
+        challengeBuf.BufferType = SECBUFFER_TOKEN;
+        challengeBuf.pvBuffer   = (PVOID)(challenge.data());
+        challengeBuf.cbBuffer   = challenge.length();
     }
 
-    result = QByteArray((const char*)buf.pvBuffer, buf.cbBuffer);
-    pSecurityFunctionTable->FreeContextBuffer(buf.pvBuffer);
+    // Setup the response "output" security buffer
+    responseDesc.ulVersion = SECBUFFER_VERSION;
+    responseDesc.cBuffers  = 1;
+    responseDesc.pBuffers  = &responseBuf;
+    responseBuf.BufferType = SECBUFFER_TOKEN;
+    responseBuf.pvBuffer   = nullptr;
+    responseBuf.cbBuffer   = 0;
+
+    // Calculate target (SPN for Negotiate, empty for NTLM)
+    std::wstring targetNameW = (method == QAuthenticatorPrivate::Negotiate
+                                ? QLatin1String("HTTP/") + host : QString()).toStdWString();
+
+    // Generate our challenge-response message
+    SECURITY_STATUS secStatus = pSecurityFunctionTable->InitializeSecurityContext(
+                &ctx->sspiWindowsHandles->credHandle,
+                !challenge.isEmpty() ? &ctx->sspiWindowsHandles->ctxHandle : nullptr,
+                const_cast<wchar_t*>(targetNameW.data()),
+                ISC_REQ_ALLOCATE_MEMORY,
+                0, SECURITY_NATIVE_DREP,
+                !challenge.isEmpty() ? &challengeDesc : nullptr,
+                0, &ctx->sspiWindowsHandles->ctxHandle,
+                &responseDesc, &attrs,
+                &expiry
+    );
+
+    if (secStatus == SEC_I_COMPLETE_NEEDED || secStatus == SEC_I_COMPLETE_AND_CONTINUE) {
+        secStatus = pSecurityFunctionTable->CompleteAuthToken(&ctx->sspiWindowsHandles->ctxHandle,
+                                                              &responseDesc);
+    }
+
+    if (secStatus != SEC_I_COMPLETE_AND_CONTINUE && secStatus != SEC_I_CONTINUE_NEEDED) {
+        pSecurityFunctionTable->FreeCredentialsHandle(&ctx->sspiWindowsHandles->credHandle);
+        pSecurityFunctionTable->DeleteSecurityContext(&ctx->sspiWindowsHandles->ctxHandle);
+        ctx->sspiWindowsHandles.reset(nullptr);
+    }
+
+    result = QByteArray((const char*)responseBuf.pvBuffer, responseBuf.cbBuffer);
+    pSecurityFunctionTable->FreeContextBuffer(responseBuf.pvBuffer);
+
     return result;
 }
 
-// Phase 2:
-// 3. The server receives the token from the client, and uses it as input to the
-// AcceptSecurityContext SSPI function. This creates a local security context on
-// the server to represent the client, and yields an authentication response token
-// (the Type 2 message), which is sent to the client.
+// ---------------------------- End of SSPI code ---------------------------------------
+
+#elif QT_CONFIG(gssapi) // GSSAPI
+
+// ---------------------------- GSSAPI code ----------------------------------------------
+// See postgres src/interfaces/libpq/fe-auth.c
+
+// Fetch all errors of a specific type
+static void q_GSSAPI_error_int(const char *message, OM_uint32 stat, int type)
+{
+    OM_uint32 minStat, msgCtx = 0;
+    gss_buffer_desc msg;
+
+    do {
+        gss_display_status(&minStat, stat, type, GSS_C_NO_OID, &msgCtx, &msg);
+        qDebug() << message << ": " << reinterpret_cast<const char*>(msg.value);
+        gss_release_buffer(&minStat, &msg);
+    } while (msgCtx);
+}
 
-// Phase 3:
-static QByteArray qNtlmPhase3_SSPI(QAuthenticatorPrivate *ctx, const QByteArray& phase2data)
+// GSSAPI errors contain two parts; extract both
+static void q_GSSAPI_error(const char *message, OM_uint32 majStat, OM_uint32 minStat)
 {
-    // 4. The client receives the response token from the server and calls
-    // InitializeSecurityContext again, passing the server's token as input.
-    // This provides us with another authentication request token (the Type 3 message).
-    // The return value indicates that the security context was successfully initialized;
-    // the token is sent to the server.
+    // Fetch major error codes
+    q_GSSAPI_error_int(message, majStat, GSS_C_GSS_CODE);
 
+    // Add the minor codes as well
+    q_GSSAPI_error_int(message, minStat, GSS_C_MECH_CODE);
+}
+
+// Send initial GSS authentication token
+static QByteArray qGssapiStartup(QAuthenticatorPrivate *ctx, const QString &host)
+{
+    OM_uint32 majStat, minStat;
+
+    if (!ctx->gssApiHandles)
+        ctx->gssApiHandles.reset(new QGssApiHandles);
+
+    // Convert target name to internal form
+    QByteArray serviceName = QStringLiteral("HTTPS@%1").arg(host).toLocal8Bit();
+    gss_buffer_desc nameDesc = {static_cast<std::size_t>(serviceName.size()), serviceName.data()};
+
+    majStat = gss_import_name(&minStat, &nameDesc,
+                              GSS_C_NT_HOSTBASED_SERVICE, &ctx->gssApiHandles->targetName);
+
+    if (majStat != GSS_S_COMPLETE) {
+        q_GSSAPI_error("gss_import_name error", majStat, minStat);
+        ctx->gssApiHandles.reset(nullptr);
+        return QByteArray();
+    }
+
+    // Call qGssapiContinue with GSS_C_NO_CONTEXT to get initial packet
+    ctx->gssApiHandles->gssCtx = GSS_C_NO_CONTEXT;
+    return qGssapiContinue(ctx);
+}
+
+// Continue GSS authentication with next token as needed
+static QByteArray qGssapiContinue(QAuthenticatorPrivate *ctx, const QByteArray& challenge)
+{
+    OM_uint32 majStat, minStat, ignored;
     QByteArray result;
+    gss_buffer_desc inBuf = {0, nullptr}; // GSS input token
+    gss_buffer_desc outBuf; // GSS output token
 
-    if (pSecurityFunctionTable == NULL)
-        return result;
-
-    SecBuffer type_2, type_3;
-    SecBufferDesc type_2_desc, type_3_desc;
-    ULONG attrs;
-    TimeStamp tsDummy; // For Windows 9x compatibility of SPPI calls
-
-    type_2_desc.ulVersion  = type_3_desc.ulVersion  = SECBUFFER_VERSION;
-    type_2_desc.cBuffers   = type_3_desc.cBuffers   = 1;
-    type_2_desc.pBuffers   = &type_2;
-    type_3_desc.pBuffers   = &type_3;
-
-    type_2.BufferType = SECBUFFER_TOKEN;
-    type_2.pvBuffer   = (PVOID)phase2data.data();
-    type_2.cbBuffer   = phase2data.length();
-    type_3.BufferType = SECBUFFER_TOKEN;
-    type_3.pvBuffer   = 0;
-    type_3.cbBuffer   = 0;
-
-    SECURITY_STATUS secStatus = pSecurityFunctionTable->InitializeSecurityContext(&ctx->ntlmWindowsHandles->credHandle,
-        &ctx->ntlmWindowsHandles->ctxHandle,
-        const_cast<SEC_WCHAR*>(L"") /* host */,
-        ISC_REQ_ALLOCATE_MEMORY,
-        0, SECURITY_NETWORK_DREP, &type_2_desc,
-        0, &ctx->ntlmWindowsHandles->ctxHandle, &type_3_desc,
-        &attrs, &tsDummy);
-
-    if (secStatus == SEC_E_OK && ((const char*)type_3.pvBuffer)) {
-        result = QByteArray((const char*)type_3.pvBuffer, type_3.cbBuffer);
-        pSecurityFunctionTable->FreeContextBuffer(type_3.pvBuffer);
+    if (!challenge.isEmpty()) {
+        inBuf.value = const_cast<char*>(challenge.data());
+        inBuf.length = challenge.length();
     }
 
-    pSecurityFunctionTable->FreeCredentialsHandle(&ctx->ntlmWindowsHandles->credHandle);
-    pSecurityFunctionTable->DeleteSecurityContext(&ctx->ntlmWindowsHandles->ctxHandle);
-    delete ctx->ntlmWindowsHandles;
-    ctx->ntlmWindowsHandles = 0;
+    majStat = gss_init_sec_context(&minStat,
+                                   GSS_C_NO_CREDENTIAL,
+                                   &ctx->gssApiHandles->gssCtx,
+                                   ctx->gssApiHandles->targetName,
+                                   GSS_C_NO_OID,
+                                   GSS_C_MUTUAL_FLAG,
+                                   0,
+                                   GSS_C_NO_CHANNEL_BINDINGS,
+                                   challenge.isEmpty() ? GSS_C_NO_BUFFER : &inBuf,
+                                   nullptr,
+                                   &outBuf,
+                                   nullptr,
+                                   nullptr);
+
+    if (outBuf.length != 0)
+        result = QByteArray(reinterpret_cast<const char*>(outBuf.value), outBuf.length);
+    gss_release_buffer(&ignored, &outBuf);
+
+    if (majStat != GSS_S_COMPLETE && majStat != GSS_S_CONTINUE_NEEDED) {
+        q_GSSAPI_error("gss_init_sec_context error", majStat, minStat);
+        gss_release_name(&ignored, &ctx->gssApiHandles->targetName);
+        if (ctx->gssApiHandles->gssCtx)
+            gss_delete_sec_context(&ignored, &ctx->gssApiHandles->gssCtx, GSS_C_NO_BUFFER);
+        ctx->gssApiHandles.reset(nullptr);
+    }
+
+    if (majStat == GSS_S_COMPLETE) {
+        gss_release_name(&ignored, &ctx->gssApiHandles->targetName);
+        ctx->gssApiHandles.reset(nullptr);
+    }
 
     return result;
 }
-#endif // Q_OS_WIN && !Q_OS_WINRT
+
+// ---------------------------- End of GSSAPI code ----------------------------------------------
+
+#endif // gssapi
 
 QT_END_NAMESPACE
diff --git a/src/network/kernel/qauthenticator_p.h b/src/network/kernel/qauthenticator_p.h
index 265cb7afe2..e201d22650 100644
--- a/src/network/kernel/qauthenticator_p.h
+++ b/src/network/kernel/qauthenticator_p.h
@@ -54,6 +54,7 @@
 #include <QtNetwork/private/qtnetworkglobal_p.h>
 #include <qhash.h>
 #include <qbytearray.h>
+#include <qscopedpointer.h>
 #include <qstring.h>
 #include <qauthenticator.h>
 #include <qvariant.h>
@@ -61,14 +62,16 @@
 QT_BEGIN_NAMESPACE
 
 class QHttpResponseHeader;
-#ifdef Q_OS_WIN
-class QNtlmWindowsHandles;
+#if QT_CONFIG(sspi) // SSPI
+class QSSPIWindowsHandles;
+#elif QT_CONFIG(gssapi) // GSSAPI
+class QGssApiHandles;
 #endif
 
 class Q_AUTOTEST_EXPORT QAuthenticatorPrivate
 {
 public:
-    enum Method { None, Basic, Ntlm, DigestMd5 };
+    enum Method { None, Basic, Ntlm, DigestMd5, Negotiate };
     QAuthenticatorPrivate();
     ~QAuthenticatorPrivate();
 
@@ -79,8 +82,10 @@ public:
     Method method;
     QString realm;
     QByteArray challenge;
-#ifdef Q_OS_WIN
-    QNtlmWindowsHandles *ntlmWindowsHandles;
+#if QT_CONFIG(sspi) // SSPI
+    QScopedPointer<QSSPIWindowsHandles> sspiWindowsHandles;
+#elif QT_CONFIG(gssapi) // GSSAPI
+    QScopedPointer<QGssApiHandles> gssApiHandles;
 #endif
     bool hasFailed; //credentials have been tried but rejected by server.
 
@@ -100,7 +105,7 @@ public:
     QString workstation;
     QString userDomain;
 
-    QByteArray calculateResponse(const QByteArray &method, const QByteArray &path);
+    QByteArray calculateResponse(const QByteArray &method, const QByteArray &path, const QString& host);
 
     inline static QAuthenticatorPrivate *getPrivate(QAuthenticator &auth) { return auth.d; }
     inline static const QAuthenticatorPrivate *getPrivate(const QAuthenticator &auth) { return auth.d; }
diff --git a/src/network/kernel/qdnslookup.h b/src/network/kernel/qdnslookup.h
index eebd0abe66..79a476b98f 100644
--- a/src/network/kernel/qdnslookup.h
+++ b/src/network/kernel/qdnslookup.h
@@ -65,12 +65,12 @@ public:
     QDnsDomainNameRecord();
     QDnsDomainNameRecord(const QDnsDomainNameRecord &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QDnsDomainNameRecord &operator=(QDnsDomainNameRecord &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QDnsDomainNameRecord &operator=(QDnsDomainNameRecord &&other) noexcept { swap(other); return *this; }
 #endif
     QDnsDomainNameRecord &operator=(const QDnsDomainNameRecord &other);
     ~QDnsDomainNameRecord();
 
-    void swap(QDnsDomainNameRecord &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QDnsDomainNameRecord &other) noexcept { qSwap(d, other.d); }
 
     QString name() const;
     quint32 timeToLive() const;
@@ -89,12 +89,12 @@ public:
     QDnsHostAddressRecord();
     QDnsHostAddressRecord(const QDnsHostAddressRecord &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QDnsHostAddressRecord &operator=(QDnsHostAddressRecord &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QDnsHostAddressRecord &operator=(QDnsHostAddressRecord &&other) noexcept { swap(other); return *this; }
 #endif
     QDnsHostAddressRecord &operator=(const QDnsHostAddressRecord &other);
     ~QDnsHostAddressRecord();
 
-    void swap(QDnsHostAddressRecord &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QDnsHostAddressRecord &other) noexcept { qSwap(d, other.d); }
 
     QString name() const;
     quint32 timeToLive() const;
@@ -113,12 +113,12 @@ public:
     QDnsMailExchangeRecord();
     QDnsMailExchangeRecord(const QDnsMailExchangeRecord &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QDnsMailExchangeRecord &operator=(QDnsMailExchangeRecord &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QDnsMailExchangeRecord &operator=(QDnsMailExchangeRecord &&other) noexcept { swap(other); return *this; }
 #endif
     QDnsMailExchangeRecord &operator=(const QDnsMailExchangeRecord &other);
     ~QDnsMailExchangeRecord();
 
-    void swap(QDnsMailExchangeRecord &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QDnsMailExchangeRecord &other) noexcept { qSwap(d, other.d); }
 
     QString exchange() const;
     QString name() const;
@@ -138,12 +138,12 @@ public:
     QDnsServiceRecord();
     QDnsServiceRecord(const QDnsServiceRecord &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QDnsServiceRecord &operator=(QDnsServiceRecord &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QDnsServiceRecord &operator=(QDnsServiceRecord &&other) noexcept { swap(other); return *this; }
 #endif
     QDnsServiceRecord &operator=(const QDnsServiceRecord &other);
     ~QDnsServiceRecord();
 
-    void swap(QDnsServiceRecord &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QDnsServiceRecord &other) noexcept { qSwap(d, other.d); }
 
     QString name() const;
     quint16 port() const;
@@ -165,12 +165,12 @@ public:
     QDnsTextRecord();
     QDnsTextRecord(const QDnsTextRecord &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QDnsTextRecord &operator=(QDnsTextRecord &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QDnsTextRecord &operator=(QDnsTextRecord &&other) noexcept { swap(other); return *this; }
 #endif
     QDnsTextRecord &operator=(const QDnsTextRecord &other);
     ~QDnsTextRecord();
 
-    void swap(QDnsTextRecord &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QDnsTextRecord &other) noexcept { qSwap(d, other.d); }
 
     QString name() const;
     quint32 timeToLive() const;
diff --git a/src/network/kernel/qdnslookup_p.h b/src/network/kernel/qdnslookup_p.h
index 2dc98e527a..8c3c2ed3e1 100644
--- a/src/network/kernel/qdnslookup_p.h
+++ b/src/network/kernel/qdnslookup_p.h
@@ -95,7 +95,7 @@ public:
     QDnsLookupPrivate()
         : isFinished(false)
         , type(QDnsLookup::A)
-        , runnable(0)
+        , runnable(nullptr)
     { }
 
     void _q_lookupFinished(const QDnsLookupReply &reply);
diff --git a/src/network/kernel/qdnslookup_unix.cpp b/src/network/kernel/qdnslookup_unix.cpp
index ce1ec6442a..ee7484ab35 100644
--- a/src/network/kernel/qdnslookup_unix.cpp
+++ b/src/network/kernel/qdnslookup_unix.cpp
@@ -59,6 +59,10 @@
 #  include <gnu/lib-names.h>
 #endif
 
+#if defined(Q_OS_FREEBSD) || QT_CONFIG(dlopen)
+#  include <dlfcn.h>
+#endif
+
 #include <cstring>
 
 QT_BEGIN_NAMESPACE
@@ -87,6 +91,18 @@ struct QDnsLookupStateDeleter
     }
 };
 
+static QFunctionPointer resolveSymbol(QLibrary &lib, const char *sym)
+{
+    if (lib.isLoaded())
+        return lib.resolve(sym);
+
+#if defined(RTLD_DEFAULT) && (defined(Q_OS_FREEBSD) || QT_CONFIG(dlopen))
+    return reinterpret_cast<QFunctionPointer>(dlsym(RTLD_DEFAULT, sym));
+#else
+    return nullptr;
+#endif
+}
+
 static bool resolveLibraryInternal()
 {
     QLibrary lib;
@@ -96,31 +112,30 @@ static bool resolveLibraryInternal()
 #endif
     {
         lib.setFileName(QLatin1String("resolv"));
-        if (!lib.load())
-            return false;
+        lib.load();
     }
 
-    local_dn_expand = dn_expand_proto(lib.resolve("__dn_expand"));
+    local_dn_expand = dn_expand_proto(resolveSymbol(lib, "__dn_expand"));
     if (!local_dn_expand)
-        local_dn_expand = dn_expand_proto(lib.resolve("dn_expand"));
+        local_dn_expand = dn_expand_proto(resolveSymbol(lib, "dn_expand"));
 
-    local_res_nclose = res_nclose_proto(lib.resolve("__res_nclose"));
+    local_res_nclose = res_nclose_proto(resolveSymbol(lib, "__res_nclose"));
     if (!local_res_nclose)
-        local_res_nclose = res_nclose_proto(lib.resolve("res_9_nclose"));
+        local_res_nclose = res_nclose_proto(resolveSymbol(lib, "res_9_nclose"));
     if (!local_res_nclose)
-        local_res_nclose = res_nclose_proto(lib.resolve("res_nclose"));
+        local_res_nclose = res_nclose_proto(resolveSymbol(lib, "res_nclose"));
 
-    local_res_ninit = res_ninit_proto(lib.resolve("__res_ninit"));
+    local_res_ninit = res_ninit_proto(resolveSymbol(lib, "__res_ninit"));
     if (!local_res_ninit)
-        local_res_ninit = res_ninit_proto(lib.resolve("res_9_ninit"));
+        local_res_ninit = res_ninit_proto(resolveSymbol(lib, "res_9_ninit"));
     if (!local_res_ninit)
-        local_res_ninit = res_ninit_proto(lib.resolve("res_ninit"));
+        local_res_ninit = res_ninit_proto(resolveSymbol(lib, "res_ninit"));
 
-    local_res_nquery = res_nquery_proto(lib.resolve("__res_nquery"));
+    local_res_nquery = res_nquery_proto(resolveSymbol(lib, "__res_nquery"));
     if (!local_res_nquery)
-        local_res_nquery = res_nquery_proto(lib.resolve("res_9_nquery"));
+        local_res_nquery = res_nquery_proto(resolveSymbol(lib, "res_9_nquery"));
     if (!local_res_nquery)
-        local_res_nquery = res_nquery_proto(lib.resolve("res_nquery"));
+        local_res_nquery = res_nquery_proto(resolveSymbol(lib, "res_nquery"));
 
     return true;
 }
diff --git a/src/network/kernel/qhostaddress.cpp b/src/network/kernel/qhostaddress.cpp
index 27b5f570dc..644f4336ca 100644
--- a/src/network/kernel/qhostaddress.cpp
+++ b/src/network/kernel/qhostaddress.cpp
@@ -574,7 +574,8 @@ QHostAddress &QHostAddress::operator=(SpecialAddress address)
 */
 
 /*!
-    Sets the host address to null.
+    Sets the host address to null and sets the protocol to
+    QAbstractSocket::UnknownNetworkLayerProtocol.
 
     \sa QHostAddress::Null
 */
@@ -1332,7 +1333,7 @@ QDebug operator<<(QDebug d, const QHostAddress &address)
     \relates QHostAddress
     Returns a hash of the host address \a key, using \a seed to seed the calculation.
 */
-uint qHash(const QHostAddress &key, uint seed) Q_DECL_NOTHROW
+uint qHash(const QHostAddress &key, uint seed) noexcept
 {
     return qHashBits(key.d->a6.c, 16, seed);
 }
diff --git a/src/network/kernel/qhostaddress.h b/src/network/kernel/qhostaddress.h
index 00555f3d8e..f20da3304f 100644
--- a/src/network/kernel/qhostaddress.h
+++ b/src/network/kernel/qhostaddress.h
@@ -66,7 +66,7 @@ typedef QIPv6Address Q_IPV6ADDR;
 
 class QHostAddress;
 // qHash is a friend, but we can't use default arguments for friends (§8.3.6.4)
-Q_NETWORK_EXPORT uint qHash(const QHostAddress &key, uint seed = 0) Q_DECL_NOTHROW;
+Q_NETWORK_EXPORT uint qHash(const QHostAddress &key, uint seed = 0) noexcept;
 
 class Q_NETWORK_EXPORT QHostAddress
 {
@@ -103,7 +103,7 @@ public:
     ~QHostAddress();
 
 #ifdef Q_COMPILER_RVALUE_REFS
-    QHostAddress &operator=(QHostAddress &&other) Q_DECL_NOTHROW
+    QHostAddress &operator=(QHostAddress &&other) noexcept
     { swap(other); return *this; }
 #endif
 
@@ -114,7 +114,7 @@ public:
 #endif
     QHostAddress &operator=(SpecialAddress address);
 
-    void swap(QHostAddress &other) Q_DECL_NOTHROW { d.swap(other.d); }
+    void swap(QHostAddress &other) noexcept { d.swap(other.d); }
 
     void setAddress(quint32 ip4Addr);
     void setAddress(quint8 *ip6Addr);   // ### Qt 6: remove me
@@ -157,7 +157,7 @@ public:
 
     static QPair<QHostAddress, int> parseSubnet(const QString &subnet);
 
-    friend Q_NETWORK_EXPORT uint qHash(const QHostAddress &key, uint seed) Q_DECL_NOTHROW;
+    friend Q_NETWORK_EXPORT uint qHash(const QHostAddress &key, uint seed) noexcept;
 protected:
     friend class QHostAddressPrivate;
     QExplicitlySharedDataPointer<QHostAddressPrivate> d;
diff --git a/src/network/kernel/qhostinfo.cpp b/src/network/kernel/qhostinfo.cpp
index 0973d0dd52..71d1aae35a 100644
--- a/src/network/kernel/qhostinfo.cpp
+++ b/src/network/kernel/qhostinfo.cpp
@@ -64,8 +64,8 @@ Q_GLOBAL_STATIC(QHostInfoLookupManager, theHostInfoLookupManager)
 namespace {
 struct ToBeLookedUpEquals {
     typedef bool result_type;
-    explicit ToBeLookedUpEquals(const QString &toBeLookedUp) Q_DECL_NOTHROW : m_toBeLookedUp(toBeLookedUp) {}
-    result_type operator()(QHostInfoRunnable* lookup) const Q_DECL_NOTHROW
+    explicit ToBeLookedUpEquals(const QString &toBeLookedUp) noexcept : m_toBeLookedUp(toBeLookedUp) {}
+    result_type operator()(QHostInfoRunnable* lookup) const noexcept
     {
         return m_toBeLookedUp == lookup->toBeLookedUp;
     }
@@ -300,25 +300,6 @@ int QHostInfo::lookupHost(const QString &name, QObject *receiver,
 */
 
 /*!
-    \fn template<typename PointerToMemberFunction> int QHostInfo::lookupHost(const QString &name, const QObject *receiver, PointerToMemberFunction function)
-
-    \since 5.9
-
-    \overload
-
-    Looks up the IP address(es) associated with host name \a name, and
-    returns an ID for the lookup. When the result of the lookup is
-    ready, the slot or signal \a function in \a receiver is called with
-    a QHostInfo argument. The QHostInfo object can then be inspected
-    to get the results of the lookup.
-
-    \note There is no guarantee on the order the signals will be emitted
-    if you start multiple requests with lookupHost().
-
-    \sa abortHostLookup(), addresses(), error(), fromName()
-*/
-
-/*!
     \fn template<typename Functor> int QHostInfo::lookupHost(const QString &name, Functor functor)
 
     \since 5.9
@@ -354,6 +335,16 @@ int QHostInfo::lookupHost(const QString &name, QObject *receiver,
     thread of \a context. The context's thread must have a running Qt
     event loop.
 
+    Here is an alternative signature for the function:
+    \code
+    lookupHost(const QString &name, const QObject *receiver, PointerToMemberFunction function)
+    \endcode
+
+    In this case, when the result of the lookup is ready, the slot or
+    signal \c{function} in \c{receiver} is called with a QHostInfo
+    argument. The QHostInfo object can then be inspected to get the
+    results of the lookup.
+
     \note There is no guarantee on the order the signals will be emitted
     if you start multiple requests with lookupHost().
 
diff --git a/src/network/kernel/qhostinfo.h b/src/network/kernel/qhostinfo.h
index 75917a02a3..dc31cc08e4 100644
--- a/src/network/kernel/qhostinfo.h
+++ b/src/network/kernel/qhostinfo.h
@@ -63,10 +63,10 @@ public:
     explicit QHostInfo(int lookupId = -1);
     QHostInfo(const QHostInfo &d);
     QHostInfo &operator=(const QHostInfo &d);
-    QHostInfo &operator=(QHostInfo &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QHostInfo &operator=(QHostInfo &&other) noexcept { swap(other); return *this; }
     ~QHostInfo();
 
-    void swap(QHostInfo &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QHostInfo &other) noexcept { qSwap(d, other.d); }
 
     QString hostName() const;
     void setHostName(const QString &name);
@@ -91,13 +91,10 @@ public:
     static QString localDomainName();
 
 #ifdef Q_CLANG_QDOC
-    template<typename PointerToMemberFunction>
-    static int QHostInfo::lookupHost(const QString &name, const QObject *receiver,
-                              PointerToMemberFunction function);
     template<typename Functor>
-    static int QHostInfo::lookupHost(const QString &name, Functor functor);
+    static int lookupHost(const QString &name, Functor functor);
     template<typename Functor>
-    static int QHostInfo::lookupHost(const QString &name, const QObject *context, Functor functor);
+    static int lookupHost(const QString &name, const QObject *context, Functor functor);
 #else
     // lookupHost to a QObject slot
     template <typename Func>
diff --git a/src/network/kernel/qhostinfo_p.h b/src/network/kernel/qhostinfo_p.h
index 8cce302166..da02163ddf 100644
--- a/src/network/kernel/qhostinfo_p.h
+++ b/src/network/kernel/qhostinfo_p.h
@@ -101,7 +101,7 @@ public Q_SLOTS:
     {
         if (slotObj) {
             QHostInfo copy = info;
-            void *args[2] = { 0, reinterpret_cast<void *>(&copy) };
+            void *args[2] = { nullptr, reinterpret_cast<void *>(&copy) };
             slotObj->call(const_cast<QObject*>(receiver.data()), args);
             slotObj->destroyIfLastRef();
         } else {
diff --git a/src/network/kernel/qhostinfo_unix.cpp b/src/network/kernel/qhostinfo_unix.cpp
index d22608e22f..e4810d68ee 100644
--- a/src/network/kernel/qhostinfo_unix.cpp
+++ b/src/network/kernel/qhostinfo_unix.cpp
@@ -66,6 +66,10 @@
 #  include <gnu/lib-names.h>
 #endif
 
+#if defined(Q_OS_FREEBSD) || QT_CONFIG(dlopen)
+#  include <dlfcn.h>
+#endif
+
 QT_BEGIN_NAMESPACE
 
 // Almost always the same. If not, specify in qplatformdefs.h.
@@ -115,6 +119,18 @@ struct LibResolv
 };
 }
 
+static QFunctionPointer resolveSymbol(QLibrary &lib, const char *sym)
+{
+    if (lib.isLoaded())
+        return lib.resolve(sym);
+
+#if defined(RTLD_DEFAULT) && (defined(Q_OS_FREEBSD) || QT_CONFIG(dlopen))
+    return reinterpret_cast<QFunctionPointer>(dlsym(RTLD_DEFAULT, sym));
+#else
+    return nullptr;
+#endif
+}
+
 LibResolv::LibResolv()
 {
     QLibrary lib;
@@ -124,31 +140,30 @@ LibResolv::LibResolv()
 #endif
     {
         lib.setFileName(QLatin1String("resolv"));
-        if (!lib.load())
-            return;
+        lib.load();
     }
 
     // res_ninit is required for localDomainName()
-    local_res_ninit = res_ninit_proto(lib.resolve("__res_ninit"));
+    local_res_ninit = res_ninit_proto(resolveSymbol(lib, "__res_ninit"));
     if (!local_res_ninit)
-        local_res_ninit = res_ninit_proto(lib.resolve("res_ninit"));
+        local_res_ninit = res_ninit_proto(resolveSymbol(lib, "res_ninit"));
     if (local_res_ninit) {
         // we must now find res_nclose
-        local_res_nclose = res_nclose_proto(lib.resolve("res_nclose"));
+        local_res_nclose = res_nclose_proto(resolveSymbol(lib, "res_nclose"));
         if (!local_res_nclose)
-            local_res_nclose = res_nclose_proto(lib.resolve("__res_nclose"));
+            local_res_nclose = res_nclose_proto(resolveSymbol(lib, "__res_nclose"));
         if (!local_res_nclose)
             local_res_ninit = nullptr;
     }
 
     if (ReinitNecessary || !local_res_ninit) {
-        local_res_init = res_init_proto(lib.resolve("__res_init"));
+        local_res_init = res_init_proto(resolveSymbol(lib, "__res_init"));
         if (!local_res_init)
-            local_res_init = res_init_proto(lib.resolve("res_init"));
+            local_res_init = res_init_proto(resolveSymbol(lib, "res_init"));
 
         if (local_res_init && !local_res_ninit) {
             // if we can't get a thread-safe context, we have to use the global _res state
-            local_res = res_state_ptr(lib.resolve("_res"));
+            local_res = res_state_ptr(resolveSymbol(lib, "_res"));
         }
     }
 }
diff --git a/src/network/kernel/qnetworkdatagram.cpp b/src/network/kernel/qnetworkdatagram.cpp
index 50421fa7f5..c8c87d4549 100644
--- a/src/network/kernel/qnetworkdatagram.cpp
+++ b/src/network/kernel/qnetworkdatagram.cpp
@@ -450,16 +450,7 @@ void QNetworkDatagram::setData(const QByteArray &data)
     way of responding to a datagram back to the original sender.
 
     Example:
-    \code
-        void Server::readPendingDatagrams()
-        {
-            while (udpSocket->hasPendingDatagrams()) {
-                QNetworkDatagram datagram = udpSocket->receiveDatagram();
-                QByteArray replyData = processThePayload(datagram.data());
-                udpSocket->writeDatagram(datagram.makeReply(replyData));
-            }
-        }
-    \endcode
+    \snippet code/src_network_kernel_qnetworkdatagram.cpp 0
 
     This function is especially convenient since it will automatically copy
     parameters from this datagram to the new datagram as appropriate:
@@ -491,9 +482,7 @@ void QNetworkDatagram::setData(const QByteArray &data)
     overloads, so it is a good idea to make sure this object is rvalue, if
     possible, before calling makeReply, so as to make better use of move
     semantics. To achieve that, the example above would use:
-    \code
-            udpSocket->writeDatagram(std::move(datagram).makeReply(replyData));
-    \endcode
+    \snippet code/src_network_kernel_qnetworkdatagram.cpp 1
  */
 
 
diff --git a/src/network/kernel/qnetworkdatagram.h b/src/network/kernel/qnetworkdatagram.h
index 1acb44a1e0..70958fea42 100644
--- a/src/network/kernel/qnetworkdatagram.h
+++ b/src/network/kernel/qnetworkdatagram.h
@@ -61,13 +61,13 @@ public:
     ~QNetworkDatagram()
     { if (d) destroy(d); }
 
-    QNetworkDatagram(QNetworkDatagram &&other) Q_DECL_NOTHROW
+    QNetworkDatagram(QNetworkDatagram &&other) noexcept
         : d(other.d)
     { other.d = nullptr; }
-    QNetworkDatagram &operator=(QNetworkDatagram &&other) Q_DECL_NOTHROW
+    QNetworkDatagram &operator=(QNetworkDatagram &&other) noexcept
     { swap(other); return *this; }
 
-    void swap(QNetworkDatagram &other) Q_DECL_NOTHROW
+    void swap(QNetworkDatagram &other) noexcept
     { qSwap(d, other.d); }
 
     void clear();
diff --git a/src/network/kernel/qnetworkinterface.cpp b/src/network/kernel/qnetworkinterface.cpp
index 75a26848a6..d43dba3e0c 100644
--- a/src/network/kernel/qnetworkinterface.cpp
+++ b/src/network/kernel/qnetworkinterface.cpp
@@ -798,9 +798,7 @@ QList<QNetworkAddressEntry> QNetworkInterface::addressEntries() const
     no interface with that name. This function should produce the same result
     as the following code, but will probably execute faster.
 
-    \code
-        QNetworkInterface::interfaceFromName(name).index()
-    \endcode
+    \snippet code/src_network_kernel_qnetworkinterface.cpp 0
 
     \sa interfaceFromName(), interfaceNameFromIndex(), QNetworkDatagram::interfaceIndex()
 */
@@ -858,9 +856,7 @@ QNetworkInterface QNetworkInterface::interfaceFromIndex(int index)
     produce the same result as the following code, but will probably execute
     faster.
 
-    \code
-        QNetworkInterface::interfaceFromIndex(index).name()
-    \endcode
+    \snippet code/src_network_kernel_qnetworkinterface.cpp 1
 
     \sa interfaceFromIndex(), interfaceIndexFromName(), QNetworkDatagram::interfaceIndex()
 */
diff --git a/src/network/kernel/qnetworkinterface.h b/src/network/kernel/qnetworkinterface.h
index 148fd5e10d..1d3286118e 100644
--- a/src/network/kernel/qnetworkinterface.h
+++ b/src/network/kernel/qnetworkinterface.h
@@ -65,12 +65,12 @@ public:
     QNetworkAddressEntry();
     QNetworkAddressEntry(const QNetworkAddressEntry &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QNetworkAddressEntry &operator=(QNetworkAddressEntry &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QNetworkAddressEntry &operator=(QNetworkAddressEntry &&other) noexcept { swap(other); return *this; }
 #endif
     QNetworkAddressEntry &operator=(const QNetworkAddressEntry &other);
     ~QNetworkAddressEntry();
 
-    void swap(QNetworkAddressEntry &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QNetworkAddressEntry &other) noexcept { qSwap(d, other.d); }
 
     bool operator==(const QNetworkAddressEntry &other) const;
     inline bool operator!=(const QNetworkAddressEntry &other) const
@@ -143,12 +143,12 @@ public:
     QNetworkInterface();
     QNetworkInterface(const QNetworkInterface &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QNetworkInterface &operator=(QNetworkInterface &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QNetworkInterface &operator=(QNetworkInterface &&other) noexcept { swap(other); return *this; }
 #endif
     QNetworkInterface &operator=(const QNetworkInterface &other);
     ~QNetworkInterface();
 
-    void swap(QNetworkInterface &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QNetworkInterface &other) noexcept { qSwap(d, other.d); }
 
     bool isValid() const;
 
diff --git a/src/network/kernel/qnetworkinterface_p.h b/src/network/kernel/qnetworkinterface_p.h
index 87a46b75fa..44e27a7e34 100644
--- a/src/network/kernel/qnetworkinterface_p.h
+++ b/src/network/kernel/qnetworkinterface_p.h
@@ -82,7 +82,7 @@ public:
 class QNetworkInterfacePrivate: public QSharedData
 {
 public:
-    QNetworkInterfacePrivate() : index(0), flags(0)
+    QNetworkInterfacePrivate() : index(0), flags(nullptr)
     { }
     ~QNetworkInterfacePrivate()
     { }
diff --git a/src/network/kernel/qnetworkinterface_unix.cpp b/src/network/kernel/qnetworkinterface_unix.cpp
index d69fc47667..c28c5ea9e6 100644
--- a/src/network/kernel/qnetworkinterface_unix.cpp
+++ b/src/network/kernel/qnetworkinterface_unix.cpp
@@ -38,6 +38,7 @@
 **
 ****************************************************************************/
 
+#include "qbytearray.h"
 #include "qset.h"
 #include "qnetworkinterface.h"
 #include "qnetworkinterface_p.h"
@@ -463,8 +464,10 @@ static QNetworkInterface::InterfaceType probeIfType(int socket, int iftype, stru
         case IFM_ETHER:
             return QNetworkInterface::Ethernet;
 
+#ifdef IFM_FDDI
         case IFM_FDDI:
             return QNetworkInterface::Fddi;
+#endif
 
         case IFM_IEEE80211:
             return QNetworkInterface::Ieee80211;
@@ -500,7 +503,7 @@ static QList<QNetworkInterfacePrivate *> createInterfaces(ifaddrs *rawList)
             iface->flags = convertFlags(ptr->ifa_flags);
             iface->hardwareAddress = iface->makeHwAddress(sdl->sdl_alen, (uchar*)LLADDR(sdl));
 
-            strlcpy(mediareq.ifm_name, ptr->ifa_name, sizeof(mediareq.ifm_name));
+            qstrncpy(mediareq.ifm_name, ptr->ifa_name, sizeof(mediareq.ifm_name));
             iface->type = probeIfType(openSocket(socket), sdl->sdl_type, &mediareq);
             iface->mtu = getMtu(socket, &req);
         }
@@ -524,7 +527,7 @@ static void getAddressExtraInfo(QNetworkAddressEntry *entry, struct sockaddr *sa
         return;
     }
 
-    strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+    qstrncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
 
     // get flags
     ifr.ifr_addr = *reinterpret_cast<struct sockaddr_in6 *>(sa);
diff --git a/src/network/kernel/qnetworkinterface_unix_p.h b/src/network/kernel/qnetworkinterface_unix_p.h
index c085194e3c..553af5a303 100644
--- a/src/network/kernel/qnetworkinterface_unix_p.h
+++ b/src/network/kernel/qnetworkinterface_unix_p.h
@@ -80,7 +80,7 @@ QT_BEGIN_NAMESPACE
 
 static QNetworkInterface::InterfaceFlags convertFlags(uint rawFlags)
 {
-    QNetworkInterface::InterfaceFlags flags = 0;
+    QNetworkInterface::InterfaceFlags flags = nullptr;
     flags |= (rawFlags & IFF_UP) ? QNetworkInterface::IsUp : QNetworkInterface::InterfaceFlag(0);
     flags |= (rawFlags & IFF_RUNNING) ? QNetworkInterface::IsRunning : QNetworkInterface::InterfaceFlag(0);
     flags |= (rawFlags & IFF_BROADCAST) ? QNetworkInterface::CanBroadcast : QNetworkInterface::InterfaceFlag(0);
diff --git a/src/network/kernel/qnetworkproxy.h b/src/network/kernel/qnetworkproxy.h
index 7e3e6906a8..0b1bc02695 100644
--- a/src/network/kernel/qnetworkproxy.h
+++ b/src/network/kernel/qnetworkproxy.h
@@ -90,12 +90,12 @@ public:
 #endif
     QNetworkProxyQuery(const QNetworkProxyQuery &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QNetworkProxyQuery &operator=(QNetworkProxyQuery &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QNetworkProxyQuery &operator=(QNetworkProxyQuery &&other) noexcept { swap(other); return *this; }
 #endif
     QNetworkProxyQuery &operator=(const QNetworkProxyQuery &other);
     ~QNetworkProxyQuery();
 
-    void swap(QNetworkProxyQuery &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QNetworkProxyQuery &other) noexcept { qSwap(d, other.d); }
 
     bool operator==(const QNetworkProxyQuery &other) const;
     inline bool operator!=(const QNetworkProxyQuery &other) const
@@ -162,12 +162,12 @@ public:
                   const QString &user = QString(), const QString &password = QString());
     QNetworkProxy(const QNetworkProxy &other);
 #ifdef Q_COMPILER_RVALUE_REFS
-    QNetworkProxy &operator=(QNetworkProxy &&other) Q_DECL_NOTHROW { swap(other); return *this; }
+    QNetworkProxy &operator=(QNetworkProxy &&other) noexcept { swap(other); return *this; }
 #endif
     QNetworkProxy &operator=(const QNetworkProxy &other);
     ~QNetworkProxy();
 
-    void swap(QNetworkProxy &other) Q_DECL_NOTHROW { qSwap(d, other.d); }
+    void swap(QNetworkProxy &other) noexcept { qSwap(d, other.d); }
 
     bool operator==(const QNetworkProxy &other) const;
     inline bool operator!=(const QNetworkProxy &other) const
diff --git a/src/network/kernel/qnetworkproxy_win.cpp b/src/network/kernel/qnetworkproxy_win.cpp
index db51732bd3..56397814b0 100644
--- a/src/network/kernel/qnetworkproxy_win.cpp
+++ b/src/network/kernel/qnetworkproxy_win.cpp
@@ -370,7 +370,7 @@ static QList<QNetworkProxy> parseServerList(const QNetworkProxyQuery &query, con
 #if !defined(Q_OS_WINRT)
 namespace {
 class QRegistryWatcher {
-    Q_DISABLE_COPY(QRegistryWatcher)
+    Q_DISABLE_COPY_MOVE(QRegistryWatcher)
 public:
     QRegistryWatcher() = default;
 
@@ -425,7 +425,7 @@ private:
 
 class QWindowsSystemProxy
 {
-    Q_DISABLE_COPY(QWindowsSystemProxy)
+    Q_DISABLE_COPY_MOVE(QWindowsSystemProxy)
 public:
     QWindowsSystemProxy();
     ~QWindowsSystemProxy();