diff options
Diffstat (limited to 'src/network')
| -rw-r--r-- | src/network/access/qnetworkaccessmanager.cpp | 2 | ||||
| -rw-r--r-- | src/network/access/qnetworkreplyhttpimpl.cpp | 8 | ||||
| -rw-r--r-- | src/network/access/qnetworkrequest.cpp | 15 | ||||
| -rw-r--r-- | src/network/access/qnetworkrequest.h | 12 | ||||
| -rw-r--r-- | src/network/ssl/qsslconfiguration.cpp | 78 | ||||
| -rw-r--r-- | src/network/ssl/qsslconfiguration.h | 5 | ||||
| -rw-r--r-- | src/network/ssl/qsslsocket.cpp | 47 | ||||
| -rw-r--r-- | src/network/ssl/qsslsocket.h | 16 |
8 files changed, 153 insertions, 30 deletions
diff --git a/src/network/access/qnetworkaccessmanager.cpp b/src/network/access/qnetworkaccessmanager.cpp index 76b95b5823..98c82c81ae 100644 --- a/src/network/access/qnetworkaccessmanager.cpp +++ b/src/network/access/qnetworkaccessmanager.cpp @@ -1240,7 +1240,7 @@ void QNetworkAccessManager::connectToHostEncrypted(const QString &hostName, quin // There is no way to enable SPDY/HTTP2 via a request, so we need to check // the ssl configuration whether SPDY/HTTP2 is allowed here. if (sslConfiguration.allowedNextProtocols().contains(QSslConfiguration::ALPNProtocolHTTP2)) - request.setAttribute(QNetworkRequest::HTTP2AllowedAttribute, true); + request.setAttribute(QNetworkRequest::Http2AllowedAttribute, true); else if (sslConfiguration.allowedNextProtocols().contains(QSslConfiguration::NextProtocolSpdy3_0)) request.setAttribute(QNetworkRequest::SpdyAllowedAttribute, true); diff --git a/src/network/access/qnetworkreplyhttpimpl.cpp b/src/network/access/qnetworkreplyhttpimpl.cpp index 8ac81d1780..44c1d3e422 100644 --- a/src/network/access/qnetworkreplyhttpimpl.cpp +++ b/src/network/access/qnetworkreplyhttpimpl.cpp @@ -777,7 +777,7 @@ void QNetworkReplyHttpImplPrivate::postRequest(const QNetworkRequest &newHttpReq if (request.attribute(QNetworkRequest::SpdyAllowedAttribute).toBool()) httpRequest.setSPDYAllowed(true); - if (request.attribute(QNetworkRequest::HTTP2AllowedAttribute).toBool()) + if (request.attribute(QNetworkRequest::Http2AllowedAttribute).toBool()) httpRequest.setHTTP2Allowed(true); if (request.attribute(QNetworkRequest::Http2DirectAttribute).toBool()) { @@ -1280,15 +1280,15 @@ void QNetworkReplyHttpImplPrivate::replyDownloadMetaData(const QList<QPair<QByte } q->setAttribute(QNetworkRequest::HttpPipeliningWasUsedAttribute, pu); - const QVariant http2Allowed = request.attribute(QNetworkRequest::HTTP2AllowedAttribute); + const QVariant http2Allowed = request.attribute(QNetworkRequest::Http2AllowedAttribute); const QVariant http2Direct = request.attribute(QNetworkRequest::Http2DirectAttribute); if ((http2Allowed.isValid() && http2Allowed.toBool()) || (http2Direct.isValid() && http2Direct.toBool())) { - q->setAttribute(QNetworkRequest::HTTP2WasUsedAttribute, spdyWasUsed); + q->setAttribute(QNetworkRequest::Http2WasUsedAttribute, spdyWasUsed); q->setAttribute(QNetworkRequest::SpdyWasUsedAttribute, false); } else { q->setAttribute(QNetworkRequest::SpdyWasUsedAttribute, spdyWasUsed); - q->setAttribute(QNetworkRequest::HTTP2WasUsedAttribute, false); + q->setAttribute(QNetworkRequest::Http2WasUsedAttribute, false); } // reconstruct the HTTP header diff --git a/src/network/access/qnetworkrequest.cpp b/src/network/access/qnetworkrequest.cpp index 118fb6b1fb..7899bce32b 100644 --- a/src/network/access/qnetworkrequest.cpp +++ b/src/network/access/qnetworkrequest.cpp @@ -277,23 +277,30 @@ QT_BEGIN_NAMESPACE Indicates whether the QNetworkAccessManager code is allowed to use SPDY with this request. This applies only to SSL requests, and depends on the server supporting SPDY. + Obsolete, use Http2 instead of Spdy. \value SpdyWasUsedAttribute Replies only, type: QMetaType::Bool Indicates whether SPDY was used for receiving - this reply. + this reply. Obsolete, use Http2 instead of Spdy. - \value HTTP2AllowedAttribute + \value Http2AllowedAttribute Requests only, type: QMetaType::Bool (default: false) Indicates whether the QNetworkAccessManager code is allowed to use HTTP/2 with this request. This applies to SSL requests or 'cleartext' HTTP/2. - \value HTTP2WasUsedAttribute + \value Http2WasUsedAttribute Replies only, type: QMetaType::Bool (default: false) Indicates whether HTTP/2 was used for receiving this reply. (This value was introduced in 5.9.) + \value HTTP2AllowedAttribute + Obsolete alias for Http2AllowedAttribute. + + \value HTTP2WasUsedAttribute + Obsolete alias for Http2WasUsedAttribute. + \value EmitAllUploadProgressSignalsAttribute Requests only, type: QMetaType::Bool (default: false) Indicates whether all upload signals should be emitted. @@ -329,7 +336,7 @@ QT_BEGIN_NAMESPACE server supports HTTP/2. The attribute works with SSL or 'cleartext' HTTP/2. If a server turns out to not support HTTP/2, when HTTP/2 direct was specified, QNetworkAccessManager gives up, without attempting to - fall back to HTTP/1.1. If both HTTP2AllowedAttribute and + fall back to HTTP/1.1. If both Http2AllowedAttribute and Http2DirectAttribute are set, Http2DirectAttribute takes priority. (This value was introduced in 5.11.) diff --git a/src/network/access/qnetworkrequest.h b/src/network/access/qnetworkrequest.h index e09ff8aaae..72a6555d91 100644 --- a/src/network/access/qnetworkrequest.h +++ b/src/network/access/qnetworkrequest.h @@ -89,12 +89,18 @@ public: DownloadBufferAttribute, // internal SynchronousRequestAttribute, // internal BackgroundRequestAttribute, +#if QT_DEPRECATED_SINCE(5, 15) SpdyAllowedAttribute, SpdyWasUsedAttribute, - EmitAllUploadProgressSignalsAttribute, +#endif // QT_DEPRECATED_SINCE(5, 15) + EmitAllUploadProgressSignalsAttribute = BackgroundRequestAttribute + 3, FollowRedirectsAttribute, - HTTP2AllowedAttribute, - HTTP2WasUsedAttribute, + Http2AllowedAttribute, + Http2WasUsedAttribute, +#if QT_DEPRECATED_SINCE(5, 15) + HTTP2AllowedAttribute Q_DECL_ENUMERATOR_DEPRECATED_X("Use Http2AllowedAttribute") = Http2AllowedAttribute, + HTTP2WasUsedAttribute Q_DECL_ENUMERATOR_DEPRECATED_X("Use Http2WasUsedAttribute"), +#endif // QT_DEPRECATED_SINCE(5, 15) OriginalContentLengthAttribute, RedirectPolicyAttribute, Http2DirectAttribute, diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp index 7e92d3a526..a2e694ec92 100644 --- a/src/network/ssl/qsslconfiguration.cpp +++ b/src/network/ssl/qsslconfiguration.cpp @@ -631,11 +631,10 @@ QList<QSslCipher> QSslConfiguration::supportedCiphers() Returns this connection's CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer's certificate. It can be modified prior to the - handshake with setCaCertificates(), or with \l{QSslSocket}'s - \l{QSslSocket::}{addCaCertificate()} and - \l{QSslSocket::}{addCaCertificates()}. + handshake with setCaCertificates(), or with addCaCertificate() and + addCaCertificates(). - \sa setCaCertificates() + \sa setCaCertificates(), addCaCertificate(), addCaCertificates() */ QList<QSslCertificate> QSslConfiguration::caCertificates() const { @@ -652,7 +651,7 @@ QList<QSslCertificate> QSslConfiguration::caCertificates() const that is not available (as is commonly the case on iOS), the default database is empty. - \sa caCertificates() + \sa caCertificates(), addCaCertificates(), addCaCertificate() */ void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certificates) { @@ -661,6 +660,72 @@ void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certific } /*! + Searches all files in the \a path for certificates encoded in the + specified \a format and adds them to this socket's CA certificate + database. \a path must be a file or a pattern matching one or more + files, as specified by \a syntax. Returns \c true if one or more + certificates are added to the socket's CA certificate database; + otherwise returns \c false. + + The CA certificate database is used by the socket during the + handshake phase to validate the peer's certificate. + + For more precise control, use addCaCertificate(). + + \sa addCaCertificate(), QSslCertificate::fromPath() +*/ +bool QSslConfiguration::addCaCertificates(const QString &path, QSsl::EncodingFormat format, + QRegExp::PatternSyntax syntax) +{ + QList<QSslCertificate> certs = QSslCertificate::fromPath(path, format, syntax); + if (certs.isEmpty()) + return false; + + d->caCertificates += certs; + return true; +} + +/*! + \since 5.15 + + Adds \a certificate to this configuration's CA certificate database. + The certificate database must be set prior to the SSL handshake. + The CA certificate database is used by the socket during the + handshake phase to validate the peer's certificate. + + \note The default configuration uses the system CA certificate database. If + that is not available (as is commonly the case on iOS), the default database + is empty. + + \sa caCertificates(), setCaCertificates(), addCaCertificates() +*/ +void QSslConfiguration::addCaCertificate(const QSslCertificate &certificate) +{ + d->caCertificates += certificate; + d->allowRootCertOnDemandLoading = false; +} + +/*! + \since 5.15 + + Adds \a certificates to this configuration's CA certificate database. + The certificate database must be set prior to the SSL handshake. + The CA certificate database is used by the socket during the + handshake phase to validate the peer's certificate. + + \note The default configuration uses the system CA certificate database. If + that is not available (as is commonly the case on iOS), the default database + is empty. + + \sa caCertificates(), setCaCertificates(), addCaCertificate() +*/ +void QSslConfiguration::addCaCertificates(const QList<QSslCertificate> &certificates) +{ + d->caCertificates += certificates; + d->allowRootCertOnDemandLoading = false; +} + +/*! \since 5.5 This function provides the CA certificate database @@ -668,7 +733,8 @@ void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certific returned by this function is used to initialize the database returned by caCertificates() on the default QSslConfiguration. - \sa caCertificates(), setCaCertificates(), defaultConfiguration() + \sa caCertificates(), setCaCertificates(), defaultConfiguration(), + addCaCertificate(), addCaCertificates() */ QList<QSslCertificate> QSslConfiguration::systemCaCertificates() { diff --git a/src/network/ssl/qsslconfiguration.h b/src/network/ssl/qsslconfiguration.h index c25c2686de..247f3aecc9 100644 --- a/src/network/ssl/qsslconfiguration.h +++ b/src/network/ssl/qsslconfiguration.h @@ -131,6 +131,11 @@ public: // Certificate Authority (CA) settings QList<QSslCertificate> caCertificates() const; void setCaCertificates(const QList<QSslCertificate> &certificates); + bool addCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, + QRegExp::PatternSyntax syntax = QRegExp::FixedString); + void addCaCertificate(const QSslCertificate &certificate); + void addCaCertificates(const QList<QSslCertificate> &certificates); + static QList<QSslCertificate> systemCaCertificates(); void setSslOption(QSsl::SslOption option, bool on); diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp index e302aa1761..690251727d 100644 --- a/src/network/ssl/qsslsocket.cpp +++ b/src/network/ssl/qsslsocket.cpp @@ -139,10 +139,21 @@ before the handshake phase with setLocalCertificate() and setPrivateKey(). \li The CA certificate database can be extended and customized with - addCaCertificate(), addCaCertificates(), addDefaultCaCertificate(), - addDefaultCaCertificates(), and QSslConfiguration::defaultConfiguration().setCaCertificates(). + QSslConfiguration::addCaCertificate(), + QSslConfiguration::addCaCertificates(). \endlist + To extend the list of \e default CA certificates used by the SSL sockets + during the SSL handshake you must update the default configuration, as + in the snippet below: + + \code + QList<QSslCertificate> certificates = getCertificates(); + QSslConfiguration configuration = QSslConfiguration::defaultConfiguration(); + configuration.addCaCertificates(certificates); + QSslConfiguration::setDefaultConfiguration(configuration); + \endcode + \note If available, root certificates on Unix (excluding \macos) will be loaded on demand from the standard certificate directories. If you do not want to load root certificates on demand, you need to call either @@ -1384,6 +1395,10 @@ QList<QSslCipher> QSslSocket::supportedCiphers() #endif // #if QT_DEPRECATED_SINCE(5, 5) /*! + \deprecated + + Use QSslConfiguration::addCaCertificates() instead. + Searches all files in the \a path for certificates encoded in the specified \a format and adds them to this socket's CA certificate database. \a path must be a file or a pattern matching one or more @@ -1411,6 +1426,10 @@ bool QSslSocket::addCaCertificates(const QString &path, QSsl::EncodingFormat for } /*! + \deprecated + + Use QSslConfiguration::addCaCertificate() instead. + Adds the \a certificate to this socket's CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer's certificate. @@ -1427,6 +1446,10 @@ void QSslSocket::addCaCertificate(const QSslCertificate &certificate) } /*! + \deprecated + + Use QSslConfiguration::addCaCertificates() instead. + Adds the \a certificates to this socket's CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer's certificate. @@ -1489,6 +1512,10 @@ QList<QSslCertificate> QSslSocket::caCertificates() const #endif // #if QT_DEPRECATED_SINCE(5, 5) /*! + \deprecated + + Use QSslConfiguration::addCaCertificates() on the default QSslConfiguration instead. + Searches all files in the \a path for certificates with the specified \a encoding and adds them to the default CA certificate database. \a path can be an explicit file, or it can contain @@ -1498,8 +1525,8 @@ QList<QSslCertificate> QSslSocket::caCertificates() const Each SSL socket's CA certificate database is initialized to the default CA certificate database. - \sa QSslConfiguration::caCertificates(), addCaCertificates(), - addDefaultCaCertificate() + \sa QSslConfiguration::caCertificates(), QSslConfiguration::addCaCertificates(), + QSslConfiguration::addDefaultCaCertificate() */ bool QSslSocket::addDefaultCaCertificates(const QString &path, QSsl::EncodingFormat encoding, QRegExp::PatternSyntax syntax) @@ -1508,11 +1535,15 @@ bool QSslSocket::addDefaultCaCertificates(const QString &path, QSsl::EncodingFor } /*! + \deprecated + + Use QSslConfiguration::addCaCertificate() on the default QSslConfiguration instead. + Adds \a certificate to the default CA certificate database. Each SSL socket's CA certificate database is initialized to the default CA certificate database. - \sa QSslConfiguration::caCertificates(), addCaCertificates() + \sa QSslConfiguration::caCertificates(), QSslConfiguration::addCaCertificates() */ void QSslSocket::addDefaultCaCertificate(const QSslCertificate &certificate) { @@ -1520,11 +1551,15 @@ void QSslSocket::addDefaultCaCertificate(const QSslCertificate &certificate) } /*! + \deprecated + + Use QSslConfiguration::addCaCertificates() on the default QSslConfiguration instead. + Adds \a certificates to the default CA certificate database. Each SSL socket's CA certificate database is initialized to the default CA certificate database. - \sa QSslConfiguration::caCertificates(), addCaCertificates() + \sa QSslConfiguration::caCertificates(), QSslConfiguration::addCaCertificates() */ void QSslSocket::addDefaultCaCertificates(const QList<QSslCertificate> &certificates) { diff --git a/src/network/ssl/qsslsocket.h b/src/network/ssl/qsslsocket.h index 35943c7d7e..843e2d15f5 100644 --- a/src/network/ssl/qsslsocket.h +++ b/src/network/ssl/qsslsocket.h @@ -164,18 +164,22 @@ public: #endif // QT_DEPRECATED_SINCE(5, 5) // CA settings. - bool addCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, +#if QT_DEPRECATED_SINCE(5, 15) + QT_DEPRECATED_X("Use QSslConfiguration::addCaCertificates()") bool addCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, QRegExp::PatternSyntax syntax = QRegExp::FixedString); - void addCaCertificate(const QSslCertificate &certificate); - void addCaCertificates(const QList<QSslCertificate> &certificates); + QT_DEPRECATED_X("Use QSslConfiguration::addCaCertificate()") void addCaCertificate(const QSslCertificate &certificate); + QT_DEPRECATED_X("Use QSslConfiguration::addCaCertificates()") void addCaCertificates(const QList<QSslCertificate> &certificates); +#endif // QT_DEPRECATED_SINCE(5, 15) #if QT_DEPRECATED_SINCE(5, 5) QT_DEPRECATED_X("Use QSslConfiguration::setCaCertificates()") void setCaCertificates(const QList<QSslCertificate> &certificates); QT_DEPRECATED_X("Use QSslConfiguration::caCertificates()") QList<QSslCertificate> caCertificates() const; #endif // QT_DEPRECATED_SINCE(5, 5) - static bool addDefaultCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, +#if QT_DEPRECATED_SINCE(5, 15) + QT_DEPRECATED static bool addDefaultCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, QRegExp::PatternSyntax syntax = QRegExp::FixedString); - static void addDefaultCaCertificate(const QSslCertificate &certificate); - static void addDefaultCaCertificates(const QList<QSslCertificate> &certificates); + QT_DEPRECATED static void addDefaultCaCertificate(const QSslCertificate &certificate); + QT_DEPRECATED static void addDefaultCaCertificates(const QList<QSslCertificate> &certificates); +#endif // QT_DEPRECATED_SINCE(5, 15) #if QT_DEPRECATED_SINCE(5, 5) QT_DEPRECATED static void setDefaultCaCertificates(const QList<QSslCertificate> &certificates); QT_DEPRECATED static QList<QSslCertificate> defaultCaCertificates(); |