diff options
| author | Timur Pocheptsov <timur.pocheptsov@qt.io> | 2018-08-09 14:03:17 +0200 |
|---|---|---|
| committer | Timur Pocheptsov <timur.pocheptsov@qt.io> | 2018-08-10 03:55:28 +0000 |
| commit | ab731692e2ae38c85bbb14239fe15a22a9261c7e (patch) | |
| tree | 0f12428eee27c9b95ab98f8627187006a885e0ab /src/network/ssl/qdtls_p.h | |
| parent | 26a6afd472b4cf0c3781b2998bad237b5badd828 (diff) | |
QDtls: delay protocol version verification
A weird behavior of the DTLS server example, when linked with 1.0.2,
exposed that client code, requesting an invalid protocol (for example, SSLv3)
can end-up with connection encrypted with DTLS 1.2 (which is not that bad,
but totally surprising). When we check the protocol version early in
setDtlsConfiguration() and find a wrong version, we leave our previous
configuration intact and we will use it later during the handshake.
This is wrong. So now we let our user set whatever wrong configuration they
have and later fail in TLS initialization, saying -
'Unsupported protocol, DTLS was expected'.
Auto-test was reduced - the follow-up patch will introduce a new
'invalidConfiguration' auto-test.
Change-Id: I9be054c6112eea11b7801a1595aaf1d34329e1d2
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Diffstat (limited to 'src/network/ssl/qdtls_p.h')
| -rw-r--r-- | src/network/ssl/qdtls_p.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/network/ssl/qdtls_p.h b/src/network/ssl/qdtls_p.h index ca4af0d129..bdc001502b 100644 --- a/src/network/ssl/qdtls_p.h +++ b/src/network/ssl/qdtls_p.h @@ -96,6 +96,8 @@ public: bool setCookieGeneratorParameters(QCryptographicHash::Algorithm alg, const QByteArray &secret); + static bool isDtlsProtocol(QSsl::SslProtocol protocol); + QHostAddress remoteAddress; quint16 remotePort = 0; quint16 mtuHint = 0; |