summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslcertificate.cpp
Commit message (Collapse)AuthorAgeFilesLines
* QtNetwork: optimize container usageAnton Kudryavtsev2016-03-031-2/+3
| | | | | | | | | Don't perform lookup twice. Just cache iterator or position. Change-Id: I454fd292614dee62167ff248fc3ddec0f79435b0 Reviewed-by: Edward Welbourne <edward.welbourne@theqtcompany.com> Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
* Updated license headersJani Heikkinen2016-01-151-14/+20
| | | | | | | | | | | From Qt 5.7 -> LGPL v2.1 isn't an option anymore, see http://blog.qt.io/blog/2016/01/13/new-agreement-with-the-kde-free-qt-foundation/ Updated license headers to use new LGPL header instead of LGPL21 one (in those files which will be under LGPL v3) Change-Id: I046ec3e47b1876cd7b4b0353a576b352e3a946d9 Reviewed-by: Lars Knoll <lars.knoll@theqtcompany.com>
* Doc: Edit description of QSslSocket::AddCaCertificates()Topi Reinio2015-10-231-2/+2
| | | | | | | | | | | | | | | The QSslSocket::addCaCertificates() variant that takes a path argument uses QSslCertificate::fromPath() in its implementation. Edit the description of the former to match that of the latter. Fix minor issues in QSslCertificate::fromPath() documentation; add a missing word, limit code snippet line width. Task-number: QTBUG-47359 Change-Id: Ibead74c998503e60a67d0b8eb551536bd20feff8 Reviewed-by: Venugopal Shivashankar <venugopal.shivashankar@digia.com> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@theqtcompany.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Make data tables const.Volker Krause2015-05-051-1/+1
| | | | | | | | | | Moves some of them to the .rodata section, the rest at least to .data.rel.ro[.local]. Change-Id: I85676ddf22b0c0097f3f0dce4c3dc018dc29d045 Reviewed-by: Marc Mutz <marc.mutz@kdab.com> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
* Network: Fix operator<<(QDebug, ...) operationsKai Koehne2015-02-121-7/+9
| | | | | | | | | | | | Use the QDebugStateSaver saver(debug); debug.resetFormat().nospace(); idiom to unify the formatting and whitespace handling. Change-Id: Id346d63b3f589b60ca19e4459271d587f1a0c003 Reviewed-by: Richard J. Moore <rich@kde.org>
* Update copyright headersJani Heikkinen2015-02-111-7/+7
| | | | | | | | | | | | | | | | | | Qt copyrights are now in The Qt Company, so we could update the source code headers accordingly. In the same go we should also fix the links to point to qt.io. Outdated header.LGPL removed (use header.LGPL21 instead) Old header.LGPL3 renamed to header.LGPL3-COMM to match actual licensing combination. New header.LGPL-COMM taken in the use file which were using old header.LGPL3 (src/plugins/platforms/android/extract.cpp) Added new header.LGPL3 containing Commercial + LGPLv3 + GPLv2 license combination Change-Id: I6f49b819a8a20cc4f88b794a8f6726d975e8ffbe Reviewed-by: Matti Paaso <matti.paaso@theqtcompany.com>
* Add SecureTransport based SSL backend for iOS and OS XJeremy Lainé2015-02-021-0/+4
| | | | | | | | | | | Add support for SSL on iOS/OS X by adding a SecureTransport based backend. [ChangeLog][QtNetwork][QSslSocket] A new SSL backend for iOS and OS X, implemented with Apple's Secure Transport (Security Framework). Change-Id: I7466db471be2a8a2170f9af9d6ad4c7b6425738b Reviewed-by: Richard J. Moore <rich@kde.org>
* [QSSL] Pass params of shareable type by const-ref rather than by valueKonstantin Ritt2015-01-281-0/+4
| | | | | | Change-Id: I9c09a3e2dfb90eb22d4509ac6c450a0bb5da48f6 Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Use categorized logging for ssl codeKai Koehne2014-12-101-1/+2
| | | | | | | | | Place all debug output into the 'qt.network.ssl' category. This allows people to disable certain warnings at runtime. Task-number: QTBUG-43173 Change-Id: Ide731fae3109f9cd7730cc096ee069a5b99d35f1 Reviewed-by: Richard J. Moore <rich@kde.org>
* Use camel case in PKCS#12 functionAlejandro Exojo2014-11-241-2/+2
| | | | | | | | | This makes it follow the coding style, which says to camel case acronyms too, and makes it consistent with the rest of the class. Change-Id: I4a1b21de1815530e476fc5aa8a0d41c724fc8021 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: hjk <hjk121@nokiamail.com>
* Add qHash(QSslCertificate) overloadMarc Mutz2014-10-191-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qsslsocket_winrt.cpp defined it locally, which runs the risk of clashes with a potential user-defined qHash(QSslCertificate), so make it public. Also, the implementation in qsslsocket_winrt.cpp simply hashed the handle(), which violates the principle that equal instances must hash to the same value. Also, for some platforms, the implementation returns nullptr unconditionally, which, while not violating the above-mentioned principle, will make all users of the hash have worst-case complexity. To calculate a meaningful hash, therefore, the certificate needs to be inspected deeper than just the handle. For OpenSSL, we use X509::sha1_hash, which also X509_cmp uses internally to determine inequality (it checks more stuff, but if X059::sha1_hash is different, X509_cmp() returns non-zero, which is sufficient for the purposes of qHash()). sha1_hash may not be up-to-date, though, so we call X509_cmp to make it valid. Ugh. For WinRT/Qt, we use the DER encoding, as that is the native storage format used in QSslCertificate. This is not equivalent to the implementation used in qsslsocket_winrt.cpp before, but since handle() == handle() => toDer() == toDer(), it should not be a problem. [ChangeLog][QtNetwork][QSslCertificate] Can now be used as a key in QSet/QHash. Change-Id: I10858fe648c70fc9535af6913dd3b7f3b2cf0eba Reviewed-by: Oliver Wolff <oliver.wolff@digia.com>
* Update license headers and add new license filesMatti Paaso2014-09-241-18/+10
| | | | | | | | | - Renamed LICENSE.LGPL to LICENSE.LGPLv21 - Added LICENSE.LGPLv3 - Removed LICENSE.GPL Change-Id: Iec3406e3eb3f133be549092015cefe33d259a3f2 Reviewed-by: Iikka Eklund <iikka.eklund@digia.com>
* ssl: common certificate parser support for extensionsJeremy Lainé2014-09-051-150/+0
| | | | | | | | | | | | This makes non-OpenSSL backends able to handle to certificate extensions. This also converts the Q_OS_WINRT #ifdef's in the unit test to QT_NO_OPENSSL as the behavior is the same for any non-OpenSSL backend. Change-Id: I6a8306dc5c97a659ec96063d5a59cee2ee9a63a9 Reviewed-by: Richard J. Moore <rich@kde.org>
* Added QAsn1ElementJeremy Lainé2014-08-241-0/+150
| | | | | | | | | | | | | | This element can be used for backends that do not offer all the information that is needed when implementing a ssl certificate backend. WinRT and the SecureTransport lack functionality in this area for example. The sources and tests are added for ssl and openssl configurations in order to be tested. The condition for adding these can be changed as soon as they are used by an actual implementation Change-Id: I2b836133105afdc178bf3b1ee7d732bea069effa Reviewed-by: Andrew Knight <andrew.knight@digia.com>
* Introduce secure transport backend for Windows RuntimeOliver Wolff2014-08-131-0/+3
| | | | | | | | | | The change creates a stub implementation for WinRT, adding the needed files and classes to build SSL support on that platform. Task-number: QTBUG-37497 Change-Id: Idc3e8aa91c5eb8a938705f2385d1074fe6c1d83e Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Andrew Knight <andrew.knight@digia.com>
* SSL: split ssl files into general and "_openssl" implementationOliver Wolff2014-08-091-660/+56
| | | | | | | | | | | | | | | In order to prepare the addition of WinRT and iOS (SecureTransport) implementations of SSL the structure of some SSL files has to be redone. Parts of certificate that probably can be reused by other ports stayed in qsslcertificate.cpp while other parts were moved to qsslcertificate_openssl.cpp. qsslcontext, qsslkey and qsslsocket were suffixed by _openssl to show that these are pure openssl implementations. Change-Id: I7b022dec49759f882274999c0991bf95788f2a3a Reviewed-by: Andrew Knight <andrew.knight@digia.com> Reviewed-by: Oliver Wolff <oliver.wolff@digia.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Merge remote-tracking branch 'origin/5.3' into devFrederik Gladhorn2014-07-101-0/+3
|\ | | | | | | Change-Id: Ia12ffdb27ecdf25c2a2bdb0eed1945387502108a
| * QSslCertificate: blacklist NIC certificates from IndiaPeter Hartmann2014-07-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | Those intermediate certificates were used to issue "unauthorized" certificates according to http://googleonlinesecurity.blogspot.de/2014/07/maintaining-digital-certificate-security.html , and are by default trusted on Windows, so to be safe we blacklist them here. Change-Id: I9891c5bee2dd82c22eb0f45e9b04abd25efeb596 Reviewed-by: Richard J. Moore <rich@kde.org>
* | Move the PKCS#12 support from QSslSocket to QSslCertificate.Richard J. Moore2014-05-141-0/+20
| | | | | | | | | | | | | | | | Discussed with Peter and agreed that it's a slightly better fit there. Change-Id: If8db777336e2273670a23d75d8542b30c07e0d7b Reviewed-by: Daniel Molkentin <daniel@molkentin.de> Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
* | QSslCertificate::isSelfSigned(): add since tag in documentationPeter Hartmann2014-05-111-0/+1
| | | | | | | | | | Change-Id: I6a4e96fb1a94a1a55eabe6b3e0df09b5d27fd8a2 Reviewed-by: Richard J. Moore <rich@kde.org>
* | Provide new API: QSslCertificate::isSelfSigned()Daniel Molkentin2014-04-301-0/+15
|/ | | | | Change-Id: I382a017a0b865b849667301aff8b2f87b676ecc6 Reviewed-by: Richard J. Moore <rich@kde.org>
* Correct the documentation of the return types of subjectInfo and issuerInfo.Richard J. Moore2014-02-121-8/+11
| | | | | | | | | | These functions now return a QStringList to reflect the possibility of there being more than one entry of a given type, but the documentation did not reflect this. Task-Number: QTBUG-36304 Change-Id: Iba2eda5e2c3174c8dcea640b5aed9cdc9a432392 Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
* SSL: blacklist ANSSI intermediate certificatePeter Hartmann2013-12-101-0/+2
| | | | | | | | ... because it was used to operate a man-in-the-middle proxy. Task-number: QTBUG-35474 Change-Id: Ic7f19708b278b866e4f06533cbd84e0ff43357e9 Reviewed-by: Richard J. Moore <rich@kde.org>
* Doc: Adding mark-up to boolean default values.Jerome Pasion2013-10-081-8/+8
| | | | | | | | | | | | | | | | | Default values should have mark-up to denote that they are code. This commit changes: -"property is true" to "property is \c true". -"Returns true" to "Returns \c true". -"property is false" to "property is \c false". -"returns true" to "returns \c true". -"returns false" to "returns \c false". src/3rdparty and non-documentation instances were ignored. Task-number: QTBUG-33360 Change-Id: Ie87eaa57af947caa1230602b61c5c46292a4cf4e Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@digia.com> Reviewed-by: Jerome Pasion <jerome.pasion@digia.com>
* Fix loading of SSL certificate of DER files.BogDan Vatra2013-02-081-4/+10
| | | | | | | | | DER certificates should not be opened as text files, so we only pass the QIODevice::Text flag when the format is QSsl::Pem. Change-Id: I4bad98023c397b967d5beeec0aaa6c414e06fd9c Reviewed-by: Richard J. Moore <rich@kde.org>
* Update copyright year in Digia's license headersSergio Ahumada2013-01-181-1/+1
| | | | | Change-Id: Ic804938fc352291d011800d21e549c10acac66fb Reviewed-by: Lars Knoll <lars.knoll@digia.com>
* SSL certificates: blacklist mis-issued Turktrust certificatesPeter Hartmann2013-01-041-0/+3
| | | | | | | | | | | | Those certificates have erroneously set the CA attribute to true, meaning everybody in possesion of their keys can issue certificates on their own. Task-number: QTBUG-28937 Change-Id: Iff351e590ad3e6ab802e6fa1d65a9a9a9f7683de Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Fix typo in docs.Richard Moore2012-12-211-1/+1
| | | | | Change-Id: I37ccb10d40d2a848b7c251286d29aeb85411e912 Reviewed-by: hjk <qthjk@ovi.com>
* Add more qtbase implictly-shared classes to the listGiuseppe D'Angelo2012-11-301-0/+1
| | | | | | | QText*Format and QDns* ones are still missing. Change-Id: I8e87fba596e87289ca935717e0a90bfc0b0a26c0 Reviewed-by: hjk <qthjk@ovi.com>
* Change copyrights from Nokia to DigiaIikka Eklund2012-09-221-24/+24
| | | | | | | | Change copyrights and license headers from Nokia to Digia Change-Id: If1cc974286d29fd01ec6c19dd4719a67f4c3f00e Reviewed-by: Lars Knoll <lars.knoll@digia.com> Reviewed-by: Sergio Ahumada <sergio.ahumada@digia.com>
* QtNetwork: add member-swap to shared classesMarc Mutz2012-07-061-0/+8
| | | | | | | | Implemented as in other shared classes (e.g. QPen). Change-Id: Ib3d87ff99603e617cc8810489f9f5e9fe054cd2a Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* QSslCertificate::fromPath fix wildcard handlingMartin Petersson2012-07-031-23/+30
| | | | | | | | | | | | | | The reqExp used to handle wildcards in the path was broken. So we always searched the working directory and not the specified path. Autotest where passing because of a hack used for Windows paths where we removed the first two chars in the path string. This fix will not use nativeSeparators thus removing the Windows hack and fix the regExp to match wildcard chars. Task-number: QTBUG-23573 Change-Id: I56fadbb67f25b8ce9c0f17cb6232e0bdb9148b1c Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Change QSslCertificate::toText() to return a QString.Richard Moore2012-05-211-6/+6
| | | | | | | | | | A couple of people reviewing the toText() method (which is new in 5.0) have said that since the string returned is human readable it should be a QString not a QByteArray. This change follows their advice. Change-Id: Ibade9a24870805f7fbe2d299abeb9c6e964f0cf4 Reviewed-by: Girish Ramakrishnan <girish.1.ramakrishnan@nokia.com> Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* Doc: Modularize QtNetwork documentation.Casper van Donderen2012-05-091-1/+1
| | | | | | | This change moves the snippets and imagesto the modularized directories. Change-Id: If14912692a7f72d7de345eaf88d9ec9752310fca Reviewed-by: Marius Storm-Olsen <marius.storm-olsen@nokia.com>
* Various minor fixes for qdoc warnings.Richard Moore2012-05-061-7/+9
| | | | | Change-Id: I54c5ab6e1bfb1816bb510be9e2bfa1e3362faa36 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Document new APIs in 5.0Shane Kearns2012-05-031-0/+8
| | | | | | | | The \since 5.0 directive was missing from many places. Task-number: QTBUG-24001 Change-Id: I191ba8891ae66d78f923164bcab2fccb16eabef9 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Document QSslCertificate deprecated functionsShane Kearns2012-05-031-4/+16
| | | | | | | | With the new functions linked Task-number: QTBUG-24001 Change-Id: I9fd2de746a6342a1f4f182189e7f2529f092c003 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Trivial doc fix.Richard Moore2012-04-161-0/+4
| | | | | | Change-Id: I837c74d38b9f73aed41c3839421f5faad9d22f3f Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* QtNetwork: blacklist two more certificatesMartin Petersson2012-03-081-0/+2
| | | | | | | | | | | The comodogate 72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0 certificate is a test certificate and the MD5 Collisions was created as a proof of concept deliberately made to be expired at the time of it's creation. Task-number: QTBUG-24654 Change-Id: Ic8eb417363569fe50bf19cd229658f5e371862f7 Reviewed-by: Richard J. Moore <rich@kde.org>
* QSslCertificate - make lazy initialisation thread safeShane Kearns2012-03-061-0/+9
| | | | | | | | | | | | | | | | | | | QSslCertificate can be copied around into multiple threads, without detaching. For example, the https worker threads inside QNetworkAccessManager. There are const methods, which lazily initialise members of the private class without detaching (i.e. caching results of expensive function calls) These functions now lock the d pointer using QMutexPool to avoid concurrency related crashes. autotest crashes 20% of the time in release builds without the fix, passes 100 times in a row with the fix. Task-number: QTBUG-20452 Change-Id: I64a01af8159216f2dd6215a08669890f6c029ca8 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Remove "All rights reserved" line from license headers.Jason McDonald2012-01-301-1/+1
| | | | | | | | | | As in the past, to avoid rewriting various autotests that contain line-number information, an extra blank line has been inserted at the end of the license text to ensure that this commit does not change the total number of lines in the license header. Change-Id: I311e001373776812699d6efc045b5f742890c689 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Update contact information in license headers.Jason McDonald2012-01-231-1/+1
| | | | | | | Replace Nokia contact email address with Qt Project website. Change-Id: I431bbbf76d7c27d8b502f87947675c116994c415 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Remove unused QT_NO_TEXTSTREAM.David Faure2012-01-111-1/+1
| | | | | | | | It was checked in a few places, but it didn't actually remove QTextStream, so it was pretty useless. Change-Id: I8eaf28893cd6c7acbe1c0b69d58de90742aee755 Reviewed-by: João Abecasis <joao.abecasis@nokia.com>
* Update copyright year in license headers.Jason McDonald2012-01-051-1/+1
| | | | | Change-Id: I02f2c620296fcd91d4967d58767ea33fc4e1e7dc Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* SSL certificate blacklist: reformat serial numbers to hexadecimalPeter Hartmann2011-11-251-10/+10
| | | | | | | | | | Since recently QSslCertificate::serialNumber() always returns the hexadecimal format, so we need to adapt to that when checking the serial numbers for the blacklisted certificates. Change-Id: I43bdb1be77faad7ad79a835c896fc39477452e75 Reviewed-by: Shane Kearns <shane.kearns@accenture.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Always use the hex format for certificate serial numbers.Richard Moore2011-11-151-16/+8
| | | | | | | | | In Qt 4.x the serial number is reported by a mixture of the hex value and the number, The hex is what is used by other tools, and we should do the same. Change-Id: Ia0361d43fb5b920d053c95e932e0c8a012436e5e Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* Deprecate QSslCertificate::isValid() replace with isBlacklisted()Richard Moore2011-11-141-11/+18
| | | | | | | | | | | Currently isValid wrongly gives the impression it checks a certificate for validity - it doesn't. It merely checks if the certificate dates are valid and if the certificate is blacklisted. Since it's already easy for users to check the dates, let's just give them access to the ability to check for blacklisting. Change-Id: I25be3bde6a01063034702a9574b28469bf4882cd Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* SSL: blacklist intermediate certificates that issued weak certsPeter Hartmann2011-11-081-0/+3
| | | | | | | | | | | ... as did browser vendors. Tested manually with affected CA certificates. Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit e1d6df4e5931ee49b4b68dd5a33146f5639268b7) Change-Id: I5bf6c147abf6d2de0f313d65faa2d9a1e9684cea Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* SSL certificates: add functionality to read extensionsRichard Moore2011-11-061-9/+236
| | | | | | | | | | ... by adding a new class QSslCertificateExtension and methods in QSslCertificate to support extensions. This is needed e.g. for OCSP (checking revocation status of a certificate) or Extended Validation certificates. Change-Id: I5c5d9513fa640cd487786bb9a5af734afebd0828 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* QSslCertificate: block all DigiNotar (intermediate and root) certsPeter Hartmann2011-09-071-2/+25
| | | | | | | | | | | and do not only check leaf certificates, but all intermediates and the root. Tested manually with the cross-signed intermediates. Change-Id: I860dc9b568bc244abc9228486dbb374a1a2b47c4 Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit 64adbd0c5775f97343afbe0e7b5fde0d70bdaedd) Reviewed-on: http://codereview.qt.nokia.com/4291 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-08 01:05:16 +0000