diff options
Diffstat (limited to 'src/network')
-rw-r--r-- | src/network/ssl/qssl.cpp | 10 | ||||
-rw-r--r-- | src/network/ssl/qsslcontext_openssl.cpp | 7 | ||||
-rw-r--r-- | src/network/ssl/qsslsocket_openssl.cpp | 4 |
3 files changed, 13 insertions, 8 deletions
diff --git a/src/network/ssl/qssl.cpp b/src/network/ssl/qssl.cpp index 63c826a3d7..740131797c 100644 --- a/src/network/ssl/qssl.cpp +++ b/src/network/ssl/qssl.cpp @@ -119,12 +119,12 @@ QT_BEGIN_NAMESPACE a TLS 1.0 Client Hello, enabling TLSv1_0 and SSLv3 connections. On the server side, this will enable both SSLv3 and TLSv1_0 connections. \value SecureProtocols The default option, using protocols known to be secure; - currently behaves like TlsV1SslV3. + currently behaves similar to TlsV1Ssl3 except denying SSLv3 connections that does + not upgrade to TLS. - \note most servers using SSL understand both versions (2 and 3), - but it is recommended to use the latest version only for security - reasons. However, SSL and TLS are not compatible with each other: - if you get unexpected handshake failures, verify that you chose + \note most servers understand both SSL and TLS, but it is recommended to use + TLS only for security reasons. However, SSL and TLS are not compatible with + each other: if you get unexpected handshake failures, verify that you chose the correct setting for your protocol. */ diff --git a/src/network/ssl/qsslcontext_openssl.cpp b/src/network/ssl/qsslcontext_openssl.cpp index 6daddebba3..c042d98056 100644 --- a/src/network/ssl/qsslcontext_openssl.cpp +++ b/src/network/ssl/qsslcontext_openssl.cpp @@ -139,8 +139,11 @@ init_context: case QSsl::SslV3: sslContext->ctx = q_SSL_CTX_new(client ? q_SSLv3_client_method() : q_SSLv3_server_method()); break; - case QSsl::SecureProtocols: // SslV2 will be disabled below - case QSsl::TlsV1SslV3: // SslV2 will be disabled below + case QSsl::SecureProtocols: + // SSLv2 and SSLv3 will be disabled by SSL options + // But we need q_SSLv23_server_method() otherwise AnyProtocol will be unable to connect on Win32. + case QSsl::TlsV1SslV3: + // SSLv2 will will be disabled by SSL options case QSsl::AnyProtocol: default: sslContext->ctx = q_SSL_CTX_new(client ? q_SSLv23_client_method() : q_SSLv23_server_method()); diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp index 1d675edbbb..84b0d9c75e 100644 --- a/src/network/ssl/qsslsocket_openssl.cpp +++ b/src/network/ssl/qsslsocket_openssl.cpp @@ -280,8 +280,10 @@ int q_X509Callback(int ok, X509_STORE_CTX *ctx) long QSslSocketBackendPrivate::setupOpenSslOptions(QSsl::SslProtocol protocol, QSsl::SslOptions sslOptions) { long options; - if (protocol == QSsl::TlsV1SslV3 || protocol == QSsl::SecureProtocols) + if (protocol == QSsl::TlsV1SslV3) options = SSL_OP_ALL|SSL_OP_NO_SSLv2; + else if (protocol == QSsl::SecureProtocols) + options = SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3; else options = SSL_OP_ALL; |