1 files changed, 28 insertions, 24 deletions

diff --git a/src/network/ssl/qsslsocket_mac.cpp b/src/network/ssl/qsslsocket_mac.cpp
index aa4fb4fe8e..487e975db6 100644
--- a/src/network/ssl/qsslsocket_mac.cpp
+++ b/src/network/ssl/qsslsocket_mac.cpp
@@ -89,7 +89,7 @@ struct EphemeralSecKeychain
     ~EphemeralSecKeychain();
 
     SecKeychainRef keychain = nullptr;
-    Q_DISABLE_COPY(EphemeralSecKeychain)
+    Q_DISABLE_COPY_MOVE(EphemeralSecKeychain)
 };
 
 EphemeralSecKeychain::EphemeralSecKeychain()
@@ -506,6 +506,8 @@ QSsl::SslProtocol QSslSocketBackendPrivate::sessionProtocol() const
         return QSsl::TlsV1_1;
     case kTLSProtocol12:
         return QSsl::TlsV1_2;
+    case kTLSProtocol13:
+        return QSsl::TlsV1_3;
     default:
         return QSsl::UnknownProtocol;
     }
@@ -1107,16 +1109,27 @@ bool QSslSocketBackendPrivate::setSessionProtocol()
         return false;
     }
 
+    // SslV3 is unsupported.
+    if (configuration.protocol == QSsl::SslV3) {
+        qCDebug(lcSsl) << "protocol QSsl::SslV3 is disabled";
+        return false;
+    }
+
+    // SecureTransport has kTLSProtocol13 constant and also, kTLSProtocolMaxSupported.
+    // Calling SSLSetProtocolVersionMax/Min with any of these two constants results
+    // in errInvalidParam and a failure to set the protocol version. This means
+    // no TLS 1.3 on macOS and iOS.
+    switch (configuration.protocol) {
+    case QSsl::TlsV1_3:
+    case QSsl::TlsV1_3OrLater:
+        qCWarning(lcSsl) << plainSocket << "SecureTransport does not support TLS 1.3";
+        return false;
+    default:;
+    }
+
     OSStatus err = errSecSuccess;
 
-    if (configuration.protocol == QSsl::SslV3) {
-    #ifdef QSSLSOCKET_DEBUG
-        qCDebug(lcSsl) << plainSocket << "requesting : SSLv3";
-    #endif
-        err = SSLSetProtocolVersionMin(context, kSSLProtocol3);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kSSLProtocol3);
-    } else if (configuration.protocol == QSsl::TlsV1_0) {
+    if (configuration.protocol == QSsl::TlsV1_0) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : TLSv1.0";
     #endif
@@ -1141,45 +1154,34 @@ bool QSslSocketBackendPrivate::setSessionProtocol()
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : any";
     #endif
-        // kSSLProtocol3, since kSSLProtocol2 is disabled:
-        err = SSLSetProtocolVersionMin(context, kSSLProtocol3);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
+        err = SSLSetProtocolVersionMin(context, kTLSProtocol1);
     } else if (configuration.protocol == QSsl::TlsV1SslV3) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : SSLv3 - TLSv1.2";
     #endif
-        err = SSLSetProtocolVersionMin(context, kSSLProtocol3);
+        err = SSLSetProtocolVersionMin(context, kTLSProtocol1);
         if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
+            err = SSLSetProtocolVersionMax(context, kTLSProtocol1);
     } else if (configuration.protocol == QSsl::SecureProtocols) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : TLSv1 - TLSv1.2";
     #endif
         err = SSLSetProtocolVersionMin(context, kTLSProtocol1);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
     } else if (configuration.protocol == QSsl::TlsV1_0OrLater) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : TLSv1 - TLSv1.2";
     #endif
         err = SSLSetProtocolVersionMin(context, kTLSProtocol1);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
     } else if (configuration.protocol == QSsl::TlsV1_1OrLater) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : TLSv1.1 - TLSv1.2";
     #endif
         err = SSLSetProtocolVersionMin(context, kTLSProtocol11);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
     } else if (configuration.protocol == QSsl::TlsV1_2OrLater) {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "requesting : TLSv1.2";
     #endif
         err = SSLSetProtocolVersionMin(context, kTLSProtocol12);
-        if (err == errSecSuccess)
-            err = SSLSetProtocolVersionMax(context, kTLSProtocol12);
     } else {
     #ifdef QSSLSOCKET_DEBUG
         qCDebug(lcSsl) << plainSocket << "no protocol version found in the configuration";
@@ -1205,7 +1207,7 @@ bool QSslSocketBackendPrivate::verifySessionProtocol() const
     if (configuration.protocol == QSsl::AnyProtocol)
         protocolOk = true;
     else if (configuration.protocol == QSsl::TlsV1SslV3)
-        protocolOk = (sessionProtocol() >= QSsl::SslV3);
+        protocolOk = (sessionProtocol() == QSsl::TlsV1_0);
     else if (configuration.protocol == QSsl::SecureProtocols)
         protocolOk = (sessionProtocol() >= QSsl::TlsV1_0);
     else if (configuration.protocol == QSsl::TlsV1_0OrLater)
@@ -1214,6 +1216,8 @@ bool QSslSocketBackendPrivate::verifySessionProtocol() const
         protocolOk = (sessionProtocol() >= QSsl::TlsV1_1);
     else if (configuration.protocol == QSsl::TlsV1_2OrLater)
         protocolOk = (sessionProtocol() >= QSsl::TlsV1_2);
+    else if (configuration.protocol == QSsl::TlsV1_3OrLater)
+        protocolOk = (sessionProtocol() >= QSsl::TlsV1_3OrLater);
     else
         protocolOk = (sessionProtocol() == configuration.protocol);