summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslcertificate.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Correct the documentation of the return types of subjectInfo and issuerInfo.Richard J. Moore2014-02-121-8/+11
| | | | | | | | | | These functions now return a QStringList to reflect the possibility of there being more than one entry of a given type, but the documentation did not reflect this. Task-Number: QTBUG-36304 Change-Id: Iba2eda5e2c3174c8dcea640b5aed9cdc9a432392 Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
* SSL: blacklist ANSSI intermediate certificatePeter Hartmann2013-12-101-0/+2
| | | | | | | | ... because it was used to operate a man-in-the-middle proxy. Task-number: QTBUG-35474 Change-Id: Ic7f19708b278b866e4f06533cbd84e0ff43357e9 Reviewed-by: Richard J. Moore <rich@kde.org>
* Doc: Adding mark-up to boolean default values.Jerome Pasion2013-10-081-8/+8
| | | | | | | | | | | | | | | | | Default values should have mark-up to denote that they are code. This commit changes: -"property is true" to "property is \c true". -"Returns true" to "Returns \c true". -"property is false" to "property is \c false". -"returns true" to "returns \c true". -"returns false" to "returns \c false". src/3rdparty and non-documentation instances were ignored. Task-number: QTBUG-33360 Change-Id: Ie87eaa57af947caa1230602b61c5c46292a4cf4e Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@digia.com> Reviewed-by: Jerome Pasion <jerome.pasion@digia.com>
* Fix loading of SSL certificate of DER files.BogDan Vatra2013-02-081-4/+10
| | | | | | | | | DER certificates should not be opened as text files, so we only pass the QIODevice::Text flag when the format is QSsl::Pem. Change-Id: I4bad98023c397b967d5beeec0aaa6c414e06fd9c Reviewed-by: Richard J. Moore <rich@kde.org>
* Update copyright year in Digia's license headersSergio Ahumada2013-01-181-1/+1
| | | | | Change-Id: Ic804938fc352291d011800d21e549c10acac66fb Reviewed-by: Lars Knoll <lars.knoll@digia.com>
* SSL certificates: blacklist mis-issued Turktrust certificatesPeter Hartmann2013-01-041-0/+3
| | | | | | | | | | | | Those certificates have erroneously set the CA attribute to true, meaning everybody in possesion of their keys can issue certificates on their own. Task-number: QTBUG-28937 Change-Id: Iff351e590ad3e6ab802e6fa1d65a9a9a9f7683de Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Fix typo in docs.Richard Moore2012-12-211-1/+1
| | | | | Change-Id: I37ccb10d40d2a848b7c251286d29aeb85411e912 Reviewed-by: hjk <qthjk@ovi.com>
* Add more qtbase implictly-shared classes to the listGiuseppe D'Angelo2012-11-301-0/+1
| | | | | | | QText*Format and QDns* ones are still missing. Change-Id: I8e87fba596e87289ca935717e0a90bfc0b0a26c0 Reviewed-by: hjk <qthjk@ovi.com>
* Change copyrights from Nokia to DigiaIikka Eklund2012-09-221-24/+24
| | | | | | | | Change copyrights and license headers from Nokia to Digia Change-Id: If1cc974286d29fd01ec6c19dd4719a67f4c3f00e Reviewed-by: Lars Knoll <lars.knoll@digia.com> Reviewed-by: Sergio Ahumada <sergio.ahumada@digia.com>
* QtNetwork: add member-swap to shared classesMarc Mutz2012-07-061-0/+8
| | | | | | | | Implemented as in other shared classes (e.g. QPen). Change-Id: Ib3d87ff99603e617cc8810489f9f5e9fe054cd2a Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* QSslCertificate::fromPath fix wildcard handlingMartin Petersson2012-07-031-23/+30
| | | | | | | | | | | | | | The reqExp used to handle wildcards in the path was broken. So we always searched the working directory and not the specified path. Autotest where passing because of a hack used for Windows paths where we removed the first two chars in the path string. This fix will not use nativeSeparators thus removing the Windows hack and fix the regExp to match wildcard chars. Task-number: QTBUG-23573 Change-Id: I56fadbb67f25b8ce9c0f17cb6232e0bdb9148b1c Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Change QSslCertificate::toText() to return a QString.Richard Moore2012-05-211-6/+6
| | | | | | | | | | A couple of people reviewing the toText() method (which is new in 5.0) have said that since the string returned is human readable it should be a QString not a QByteArray. This change follows their advice. Change-Id: Ibade9a24870805f7fbe2d299abeb9c6e964f0cf4 Reviewed-by: Girish Ramakrishnan <girish.1.ramakrishnan@nokia.com> Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* Doc: Modularize QtNetwork documentation.Casper van Donderen2012-05-091-1/+1
| | | | | | | This change moves the snippets and imagesto the modularized directories. Change-Id: If14912692a7f72d7de345eaf88d9ec9752310fca Reviewed-by: Marius Storm-Olsen <marius.storm-olsen@nokia.com>
* Various minor fixes for qdoc warnings.Richard Moore2012-05-061-7/+9
| | | | | Change-Id: I54c5ab6e1bfb1816bb510be9e2bfa1e3362faa36 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Document new APIs in 5.0Shane Kearns2012-05-031-0/+8
| | | | | | | | The \since 5.0 directive was missing from many places. Task-number: QTBUG-24001 Change-Id: I191ba8891ae66d78f923164bcab2fccb16eabef9 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Document QSslCertificate deprecated functionsShane Kearns2012-05-031-4/+16
| | | | | | | | With the new functions linked Task-number: QTBUG-24001 Change-Id: I9fd2de746a6342a1f4f182189e7f2529f092c003 Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com>
* Trivial doc fix.Richard Moore2012-04-161-0/+4
| | | | | | Change-Id: I837c74d38b9f73aed41c3839421f5faad9d22f3f Reviewed-by: Casper van Donderen <casper.vandonderen@nokia.com> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* QtNetwork: blacklist two more certificatesMartin Petersson2012-03-081-0/+2
| | | | | | | | | | | The comodogate 72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0 certificate is a test certificate and the MD5 Collisions was created as a proof of concept deliberately made to be expired at the time of it's creation. Task-number: QTBUG-24654 Change-Id: Ic8eb417363569fe50bf19cd229658f5e371862f7 Reviewed-by: Richard J. Moore <rich@kde.org>
* QSslCertificate - make lazy initialisation thread safeShane Kearns2012-03-061-0/+9
| | | | | | | | | | | | | | | | | | | QSslCertificate can be copied around into multiple threads, without detaching. For example, the https worker threads inside QNetworkAccessManager. There are const methods, which lazily initialise members of the private class without detaching (i.e. caching results of expensive function calls) These functions now lock the d pointer using QMutexPool to avoid concurrency related crashes. autotest crashes 20% of the time in release builds without the fix, passes 100 times in a row with the fix. Task-number: QTBUG-20452 Change-Id: I64a01af8159216f2dd6215a08669890f6c029ca8 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Remove "All rights reserved" line from license headers.Jason McDonald2012-01-301-1/+1
| | | | | | | | | | As in the past, to avoid rewriting various autotests that contain line-number information, an extra blank line has been inserted at the end of the license text to ensure that this commit does not change the total number of lines in the license header. Change-Id: I311e001373776812699d6efc045b5f742890c689 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Update contact information in license headers.Jason McDonald2012-01-231-1/+1
| | | | | | | Replace Nokia contact email address with Qt Project website. Change-Id: I431bbbf76d7c27d8b502f87947675c116994c415 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Remove unused QT_NO_TEXTSTREAM.David Faure2012-01-111-1/+1
| | | | | | | | It was checked in a few places, but it didn't actually remove QTextStream, so it was pretty useless. Change-Id: I8eaf28893cd6c7acbe1c0b69d58de90742aee755 Reviewed-by: João Abecasis <joao.abecasis@nokia.com>
* Update copyright year in license headers.Jason McDonald2012-01-051-1/+1
| | | | | Change-Id: I02f2c620296fcd91d4967d58767ea33fc4e1e7dc Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* SSL certificate blacklist: reformat serial numbers to hexadecimalPeter Hartmann2011-11-251-10/+10
| | | | | | | | | | Since recently QSslCertificate::serialNumber() always returns the hexadecimal format, so we need to adapt to that when checking the serial numbers for the blacklisted certificates. Change-Id: I43bdb1be77faad7ad79a835c896fc39477452e75 Reviewed-by: Shane Kearns <shane.kearns@accenture.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Always use the hex format for certificate serial numbers.Richard Moore2011-11-151-16/+8
| | | | | | | | | In Qt 4.x the serial number is reported by a mixture of the hex value and the number, The hex is what is used by other tools, and we should do the same. Change-Id: Ia0361d43fb5b920d053c95e932e0c8a012436e5e Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* Deprecate QSslCertificate::isValid() replace with isBlacklisted()Richard Moore2011-11-141-11/+18
| | | | | | | | | | | Currently isValid wrongly gives the impression it checks a certificate for validity - it doesn't. It merely checks if the certificate dates are valid and if the certificate is blacklisted. Since it's already easy for users to check the dates, let's just give them access to the ability to check for blacklisting. Change-Id: I25be3bde6a01063034702a9574b28469bf4882cd Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* SSL: blacklist intermediate certificates that issued weak certsPeter Hartmann2011-11-081-0/+3
| | | | | | | | | | | ... as did browser vendors. Tested manually with affected CA certificates. Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit e1d6df4e5931ee49b4b68dd5a33146f5639268b7) Change-Id: I5bf6c147abf6d2de0f313d65faa2d9a1e9684cea Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* SSL certificates: add functionality to read extensionsRichard Moore2011-11-061-9/+236
| | | | | | | | | | ... by adding a new class QSslCertificateExtension and methods in QSslCertificate to support extensions. This is needed e.g. for OCSP (checking revocation status of a certificate) or Extended Validation certificates. Change-Id: I5c5d9513fa640cd487786bb9a5af734afebd0828 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* QSslCertificate: block all DigiNotar (intermediate and root) certsPeter Hartmann2011-09-071-2/+25
| | | | | | | | | | | and do not only check leaf certificates, but all intermediates and the root. Tested manually with the cross-signed intermediates. Change-Id: I860dc9b568bc244abc9228486dbb374a1a2b47c4 Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit 64adbd0c5775f97343afbe0e7b5fde0d70bdaedd) Reviewed-on: http://codereview.qt.nokia.com/4291 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* QSslCertificate: also check common name for blacklisted certificatesPeter Hartmann2011-09-021-11/+12
| | | | | | | | | | | | | | | ... to reduce the possibility of blacklisting valid certificates that happen to have the same serial number as a blacklisted one, which is unlikely, but possible. Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit 6b1a8129623e3716f2fc075608b260ce7c381fe2 and adapted to the source incompatible change) Change-Id: If714c34f6ce028032eee6d68f34d088b6ad5a0cc Reviewed-on: http://codereview.qt.nokia.com/3895 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* QSslCertificate: blacklist fraudulent *.google.comPeter Hartmann2011-08-301-0/+1
| | | | | | | | | | | | | | blacklist the leaf certificate for now. There might well be more fake certificates in the wild, for that either the Diginotar.nl root cert needs to be disabled on the system or OCSP would need to be enabled (not supported by Qt yet). Reviewed-by: Richard J. Moore <rich@kde.org> (cherry picked from commit 70f6a1b91b242174682c30be976c2aa36c450cc7) Change-Id: I7cd3fdc4c6e85202914764f983a60d301e54aa35 Reviewed-on: http://codereview.qt.nokia.com/3893 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* QSslCertificate: deprecate alternateSubjectNames()Peter Hartmann2011-08-041-4/+4
| | | | | | | | | | ... and add a new method subjectAlternativeNames() instead. This was a typo in the API. Change-Id: Id8704c387c9ff8e1af2b9a524ff628f5c053a294 Reviewed-on: http://codereview.qt.nokia.com/2618 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: João Abecasis <joao.abecasis@nokia.com>
* QSslCertificate: extend documentation for new verify methodPeter Hartmann2011-07-121-2/+6
| | | | | | | Change-Id: I47e038299a7e6ef18206839ff59ecef9f0860415 Reviewed-on: http://codereview.qt.nokia.com/1510 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: Markus Goetz
* Add the ability to verify a chain of certificatesRichard Moore2011-07-121-0/+12
| | | | | | | | | | | Currently it is only possible to verify a certificate chain when connecting to a server. This change makes it possible to verify a chain at any time. Change-Id: Ib70ad7b81418f880e995f391b82ce59561ededb8 Merge-request: 11 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/1509
* QSslCertificate: rename "tag" to "attribute", as in the RFCPeter Hartmann2011-07-121-14/+14
| | | | | | | | | | | RFC 2459 "Internet X.509 Public Key Infrastructure" uses the word "attribute" for fields in a certificate like common name, organization etc. Change-Id: I51e595acbe3e146acf81af21cf48e554fa9490e4 Reviewed-on: http://codereview.qt.nokia.com/1453 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: Martin Petersson <Martin.Petersson@nokia.com>
* SSL: Move the code for extracting the name of an ASN1_OBJECTRichard Moore2011-07-111-12/+15
| | | | | | | | | | | | Moves the code for extracting the name of an ASN1_OBJECT to a function. We're going to need this again for implementing support for X509 extensions. Change-Id: I43276eb375b37f5fef0d981f4003220d7e7b81ba Merge-request: 18 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/1452 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com>
* SSL: Add methods to access the tags of the subject and issuer of a certRichard Moore2011-07-111-0/+38
| | | | | | | | | | | Add methods that return a list of the tags in use in a certificate issuer or subject. This means that unknown elements of these fields can be accessed. Change-Id: I588989e34f541b1d31cc9e97f5a85d1624ece1b1 Merge-request: 18 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/1451
* SSL: Make the internals of certificate name info match the externals.Richard Moore2011-07-111-17/+17
| | | | | | | | | | | | The internals of QSslCertificate were using QString but the API used QByteArray, this commit unifies the code. This means that we don't keep converting things. Change-Id: I29fc149a85b77e786a6e90e5154c62f713476599 Merge-request: 18 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/1450 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com>
* SSL: Store x509 name entries that have no short name as their OID.Richard Moore2011-07-111-2/+14
| | | | | | | | | | | | Previously, x509 name entries that didn't have a shortname would all be (accidentally) stored with the tag 'UNDEF'. This commit changes things so that they are stored using the string form of their OID. Change-Id: I667306cc4f91b1ca84f29b986bc21daadeb089b6 Merge-request: 18 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/1449 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com>
* Certificates can have each issuer and subject field many timesRichard Moore2011-06-271-9/+15
| | | | | | | | | | | | | | | | | | THIS COMMIT BREAKS SOURCE COMPATIBILITY BETWEEN Qt 4 AND Qt 5 Qt4 assumed that there was only one entry of each type in the subject and issuer of a certificate. This is incorrect (eg. you can have many common names). In addition, some of the fields required by RFC3280 were not suppport. This change modifiers the API to return a list of entries of each type and adds support for the missing fields. It also updates the commonname matching code for SSL connections to handle multiple entries. Change-Id: I9457266a205def0a07c13de47094ff56ead42845 Merge-request: 5 Reviewed-on: http://codereview.qt.nokia.com/796 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: Sergio Ahumada <sergio.ahumada@nokia.com>
* SSL certificate printing: increase max certificate sizePeter Hartmann2011-06-221-2/+2
| | | | | | | | | | apparently there are really big certificates around, so 4k might not always be enough. Change-Id: I84df82d117469a14b4c6db81e0ceecc1a8ba47b3 Reviewed-on: http://codereview.qt.nokia.com/554 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com> Reviewed-by: Martin Petersson <Martin.Petersson@nokia.com>
* Add the ability to convert a certificate to textRichard Moore2011-06-211-0/+37
| | | | | | | | | | | | | Adds a function that will convert a certificate to human readable text format using the openssl print function. This is useful for debugging and for displaying the full details of a certificate (including those parts not supported by the Qt API). Change-Id: I27238d05df37f8b15ad09f8e761b06344631a9ce Merge-request: 2 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-on: http://codereview.qt.nokia.com/551 Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com>
* Merge branch 'master' of git://scm.dev.nokia.troll.no/qt/qtbase-stagingQt Continuous Integration System2011-05-251-17/+17
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'master' of git://scm.dev.nokia.troll.no/qt/qtbase-staging: (21 commits) Fixed line endings. Update licenseheader text in source files for qtbase Qt module New configure.exe binary Add -qpa option on Windows Use qglobal.h's VERSION number instead of hardcoded current version More examples adjusted to Symbian and Maemo5. (cherry picked from commit a97b9620a584c9b1a2e006873183526b3d7e001e) Doc: Added some details to the accessibility events API documentation. Doc: Fixed qdoc warnings. Doc: Fixed qdoc warnings. Doc: Made an additional change for clarity. Doc: Noted that the example will not work as expected with a mouse. Doc: Fixed qdoc warnings. Doc: Applying a pending change from previous merges. Doc: Fixed qdoc warning. Doc: Fixed qdoc warnings. Doc: Applied pending fixes to API documentation. Doc: Various fixes to documentation, some based on changes in master. Doc: Added missing project and desktop files. Doc: Documented the value returned when no field can be found. Squashed commit of changes from the 4.8-temp branch. ...
| * Update licenseheader text in source files for qtbase Qt moduleJyri Tahtela2011-05-241-17/+17
| | | | | | | | | | | | | | Updated version of LGPL and FDL licenseheaders. Apply release phase licenseheaders for all source files. Reviewed-by: Trust Me
* | fix coding style for merge request re. utf8 characters in SSL certsPierre Rossi2011-05-231-7/+6
| | | | | | | | | | | | | | | | | | fixes minor coding issues for "Use OpenSSL X509_NAME_ENTRY API to parse UTF8 subjectName/issuerName" Task-number: QTBUG-7912 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> (cherry picked from commit 2e8d206fd9f656cd88b797c059ef83ed3df32881)
* | Use OpenSSL X509_NAME_ENTRY API to parse UTF8 subjectName/issuerNameRaul Metsma2011-05-231-33/+14
|/ | | | | | | | | ... to be able to display non-ASCII names from subject and issuerInfo. Task-number: QTBUG-7912 Merge-request: 922 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> (cherry picked from commit e5d94256be2525c24a8b61edd771662b7f2b8be3)
* Initial import from the monolithic Qt.Qt by Nokia2011-04-271-0/+858
This is the beginning of revision history for this module. If you want to look at revision history older than this, please refer to the Qt Git wiki for how to use Git history grafting. At the time of writing, this wiki is located here: http://qt.gitorious.org/qt/pages/GitIntroductionWithQt If you have already performed the grafting and you don't see any history beyond this commit, try running "git log" with the "--follow" argument. Branched from the monolithic repo, Qt master branch, at commit 896db169ea224deb96c59ce8af800d019de63f12
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-06 05:46:14 +0000