summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslsocket_openssl.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-03-031-1/+1
|\ | | | | | | Change-Id: If36d96c0fef3de5ab6503977501c55c62a2ecc97
| * Use Qt::SplitBehavior in preference to QString::SplitBehaviorEdward Welbourne2020-02-281-1/+1
| | | | | | | | | | | | | | | | The Qt version was added in 5.14 "for use as eventual replacement for QString::SplitBehavior." Move another step closer to that goal. Change-Id: I399b5ea56e9255e775ca1746632f7421519a6616 Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devLars Knoll2020-02-281-1/+1
|\| | | | | | | Change-Id: I469b0501cc65fc5ce4d797a69ae89405cc69c7f8
| * Revert "QAbstractSocket: deprecate 'error' member-function"Alexander Akulich2020-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 94b3dd77f29a00ebbd1efdc66d75f57e1c75b152. The patch fixes ambiguity between a getter and a signal by changing the getter name, but we still have to rename the signal to follow the signals naming convention. Revert the commit to keep the getter as is and change the signal name instead. Change-Id: I0dd60cf1ae9d1bd95beeb8ad58661ca4b1fb63b9 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* | Merge remote-tracking branch 'origin/5.15' into devLiang Qi2020-02-131-0/+70
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: examples/widgets/graphicsview/boxes/scene.h src/corelib/Qt5CoreMacros.cmake src/corelib/Qt6CoreMacros.cmake src/network/ssl/qsslsocket.cpp src/network/ssl/qsslsocket.h src/platformsupport/fontdatabases/windows/qwindowsfontenginedirectwrite.cpp src/testlib/CMakeLists.txt src/testlib/.prev_CMakeLists.txt tests/auto/corelib/tools/qscopeguard/tst_qscopeguard.cpp Disabled building manual tests with CMake for now, because qmake doesn't do it, and it confuses people. Done-With: Alexandru Croitor <alexandru.croitor@qt.io> Done-With: Volker Hilsheimer <volker.hilsheimer@qt.io> Change-Id: I865ae347bd01f4e59f16d007b66d175a52f1f152
| * Implement/fix session resumption with TLS 1.3Timur Pocheptsov2020-01-291-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The session we cache at the end of a handshake is non-resumable in TLS 1.3, since NewSessionTicket message appears quite some time after the handshake was complete. OpenSSL has a callback where we can finally obtain a resumable session and inform an application about session ticket updated by emitting a signal. Truism: OpenSSL-only. [ChangeLog][QtNetwork] A new signal introduced to report when a valid session ticket received (TLS 1.3) Fixes: QTBUG-81591 Change-Id: I4d22fad5cc082e431577e20ddbda2835e864b511 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-01-131-1/+1
|\| | | | | | | | | | | | | Conflicts: tests/auto/network/ssl/qsslsocket/tst_qsslsocket.cpp Change-Id: I4d3041fa291a918c774ffa5eb5c8792a0966451d
| * QAbstractSocket: deprecate 'error' member-functionTimur Pocheptsov2020-01-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The one that is a getter for the last error found. This is to disambiguate the expression '&QAbstractSocket::error'. Introduce a new member-function socketError as a replacement. [ChangeLog][Deprecation Notice] QAbstractSocket::error() (the getter) is deprecated; superseded by socketError(). Task-number: QTBUG-80369 Change-Id: Ia2e3d108657aaa7929ab0810babe2ede309740ba Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2019-12-041-8/+4
|\| | | | | | | Change-Id: I4134c0c6b6c9911950f58b3b5c86e789d28a185b
| * Merge remote-tracking branch 'origin/5.14' into 5.15Ulf Hermann2019-12-031-8/+4
| |\ | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/serialization/qcborvalue.cpp Change-Id: I675a3029955c96e81a33ed9d98b72b55b6784b52
| | * QSslSocket (OpenSSL) fix a resource leakTimur Pocheptsov2019-11-271-8/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Introduced by fe6e54fb1f5cda652b9489f740763f8d735621dd. The probability -> 0, meaning malloc must fail to trigger it, but it is still a leak. We now use std::unique_ptr which improves the code in general a bit and fixes a leak. Change-Id: I6c0fa36953196d3235fb60354dc9ad2396d8dfcb Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | QSslSocket (OpenSSL) improve alert messages handlingTimur Pocheptsov2019-12-031-13/+233
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Add a new verification callback. This gives an option to report errors directly from this callback (by emitting handshakeInterruptedOnError()). This allows an application to explain to its peer why the handshake was interrupted (by sending a corresponding alert message). 2. This also means we want to notice such alerts (in Qt, from the application's point of view, they are mostly informational only, no interaction is required). So we also introduce a new 'info callback', that can notice alert messages read or written. We also introduce two new enums describing the level and type of an alert message. QSslSocket gets three new signals (for incoming/outgoing alerts and verification errors found early). 3. In case we requested a certificate, but the peer provided none, we would previously abruptly close the connection without a proper alert message (and such a situation is not handled by any verification callbacks, since there is no certificate(s) to verify essentially). So we now introduce a new verification option that maps to what OpenSSL calls 'SSL_VERIFY_FAIL_IF_NO_PEER_CERT'. This way, the proper alert will be generated. Fixes: QTBUG-68419 Change-Id: I5d1e9298b4040a2d4f867f5b1a3567a2253927b8 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | QSsl - delete all mentions of SslV2 and SslV3Timur Pocheptsov2019-11-281-26/+18
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, change the notion of 'unsupported protocol' for QSslSocket, previously it was SslV2 and SslV3, now instead it's all versions of DTLS and UnknownProtocol: - makes no sense at all to connect using TCP socket and then suddenly start using DTLS_client/server_method - UnknownProtocol is not to be set in a configuration, unknown means that some ciphersuite's protocol version cannot be established. - 'disabledProtocols' auto-test becomes 'unsupportedProtocols' and tests that QSslSocket fails to start encryption if the protocol version is wrong. Handling these enumerators (SslV2 and SslV2) as errors not needed anymore. Removed from QSslContext and our existing backends (qsslsocket_whatever). TlsV1SslV3 enumerator is not making any sense at all (previously was [SSL v3, TLS 1.0], then became "the same as TLS v. 1.0", but now this name is very confusing. Removed. Task-number: QTBUG-75638 Task-number: QTBUG-76501 Change-Id: I2781ba1c3051a7791b476266d4561d956948974a Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* / QSslSocket - remove old OpenSSL backend (< 1.1)Timur Pocheptsov2019-11-011-45/+231
|/ | | | | | | | | | | | | | OpenSSL 1.0.2 will stop receiving all support at the end of 2019. Qt 5.15 is our next LTS thus makes sense remove OpenSSL 1.0.2 support there. This also allows us quite a significant cleanup of an old heavily if-defed code and all 'pre11' suffixed source files. [ChangeLog][QtNetwork][SSL] Removed OpenSSL 1.0.x support, now 1.1.x is required Change-Id: I70c70c56cbd8aeff793afe793335696d1b1b7408 Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-07-011-1/+0
|\ | | | | | | | | | | | | | | Conflicts: src/network/ssl/qsslsocket_openssl.cpp src/platformsupport/vkconvenience/qvkconvenience.cpp Change-Id: I97ce6ed185f7fdad8102cc58d3cfec0119fd7bb4
| * qsslsocket_openssl.cpp - restructure the codeTimur Pocheptsov2019-06-281-6/+4
| | | | | | | | | | | | | | not to resolve merge conflicts on every 5.13->dev merge. Change-Id: Id41a7efff52148fe46bedcde828646694fd1764d Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-06-271-0/+1
|\| | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/network/ssl/qsslsocket_openssl.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ibb57a0548b4977797b400637487a56245ac1c024
| * Merge remote-tracking branch 'origin/5.12' into 5.13Liang Qi2019-06-251-54/+55
| |\ | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qstorageinfo_unix.cpp src/network/ssl/qsslsocket_openssl.cpp Change-Id: Ibc9ce799bef62d60d616beaa9fbde8ebeadfbc20
| * | checkOcspResponse - remove unneeded lockingTimur Pocheptsov2019-06-171-14/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and also plain wrong comments: since we don't set verification callback on a store - we don't have to lock (our q_X509Callback never gets called). This change should simplify the merge with change I have in 5.12 (where I completely got rid of locking). Since I don't care about exact errors found (relying on the fact it's the same chain of certs we check in SSL_connect/SSL_accept), for now we don't try to extract them from OCSP_basic_verify. In fufure, if these chains are different, we can create a temporary store (see how it's done in 'verify', for example) and set a VF callback on this store. Change-Id: I4a36e19836d19c2ea95c869dcfe85f49fe723ff0 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackMårten Nordheim2019-06-131-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Reviewed-by: Simo Fält <simo.falt@qt.io> (cherry picked from commit d8efc8d718e3b3a0464f321e740541f5b221a5d6) Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2019-06-251-73/+116
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/gui/painting/qdrawhelper.cpp src/gui/text/qdistancefield.cpp src/gui/text/qdistancefield_p.h src/network/ssl/qsslsocket_openssl.cpp src/plugins/platforms/android/qandroidinputcontext.cpp src/widgets/styles/qstylesheetstyle.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ia7daad21f077ea889898f17734ec46303e71fe6b
| * | TLS socket: make verification callback lock-free (OpenSSL)Timur Pocheptsov2019-06-171-51/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When our QSslSocketBackendPrivate (OpenSSL backend) was developed, the ancient versions of OpenSSL did not have an API needed to pass an application-specific data into verification callback. Thus the developers resorted to the use of global variables (a list with errors) and locks. Some of our auto-tests use QNAM and in-process server. Whenever the client (essentially qhttpthreadeddelegate) and the server live in different threads, any use of 'https' is dead-lock prone, which recent events demonstrated and which were previously observed but not understood properly (rare occasions, not always easy to reproduce). Now we fix this for good by removing locking. There are two places (in 5.12) where these locks are needed: 1. Before calling SSL_connect/SSL_accept (handshake) - here we reuse the same trick we do in PSK callback ('SSL' has an external data set, and it's 'this', meaning an object of type QSslSocketBackendPrivate). 2. The static member function 'verify', here we do not have 'SSL', but we have our temporary 'X509_STORE', to which we can directly attach an external data - a pointer to a vector to collect verification errors. Note, this change assumes that OpenSSL Qt is build/linked against is at least of version 1.0.1 - we set external data on SSL unconditionally (no version checks). Fixes: QTBUG-76157 Change-Id: I05c98e77dfd5fb0c2c260fb6c463732facf53ffc Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackv5.12.4Mårten Nordheim2019-06-121-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Simo Fält <simo.falt@qt.io>
* | | Port from QAtomic::load() to loadRelaxed()Giuseppe D'Angelo2019-06-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Semi-automated, just needed ~20 manual fixes: $ find \( -iname \*.cpp -or -iname \*.h \) -exec perl -pe 's/(\.|->)load\(\)/$1loadRelaxed\(\)/g' -i \{\} + $ find \( -iname \*.cpp -or -iname \*.h \) -exec perl -pe 's/(\.|->)store\(/$1storeRelaxed\(/g' -i \{\} + It can be easily improved (e.g. for store check that there are no commas after the opening parens). The most common offender is QLibrary::load, and some code using std::atomic directly. Change-Id: I07c38a3c8ed32c924ef4999e85c7e45cf48f0f6c Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
* | | Fix a typoTimur Pocheptsov2019-02-221-1/+2
| |/ |/| | | | | | | | | | | | | in a comment. Change-Id: I10252b2e732636993daba6b72ed86116691f2030 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Jesus Fernandez <Jesus.Fernandez@qt.io>
* | OCSP response - fix APITimur Pocheptsov2019-02-181-14/+14
| | | | | | | | | | | | | | | | | | as proposed in the API review. Change-Id: I607a38d24d533da59fc0d33dac886fa7693ed6c8 Fixes: QTBUG-73739 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Merge remote-tracking branch 'origin/5.12' into 5.13Liang Qi2019-02-081-0/+4
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: src/android/templates/AndroidManifest.xml src/network/ssl/qsslsocket_mac.cpp src/widgets/styles/qstylesheetstyle.cpp tests/auto/corelib/kernel/qtimer/BLACKLIST tests/auto/testlib/selftests/blacklisted/tst_blacklisted.cpp tests/auto/testlib/selftests/expected_blacklisted.lightxml tests/auto/testlib/selftests/expected_blacklisted.tap tests/auto/testlib/selftests/expected_blacklisted.teamcity tests/auto/testlib/selftests/expected_blacklisted.txt tests/auto/testlib/selftests/expected_blacklisted.xml tests/auto/testlib/selftests/expected_blacklisted.xunitxml tests/auto/testlib/selftests/expected_float.tap tests/auto/testlib/selftests/expected_float.teamcity tests/auto/testlib/selftests/expected_float.txt tests/auto/testlib/selftests/expected_float.xunitxml Done-With: Christian Ehrlicher <ch.ehrlicher@gmx.de> Done-With: Edward Welbourne <edward.welbourne@qt.io> Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: If93cc432a56ae3ac1b6533d0028e4dc497415a52
| * Fix session resumption with OpenSSL 1.1André Klitzing2019-01-311-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.0 and higher requires SSL_shutdown to mark a session as resumable. QHttpNetworkConnection/Channel tries to re-use one shared SSL context (and the session) for its 'channels'. The session is marked as non-resumable without shutdown sent/received. This makes it useless for QHttpNetworkConnection. See: https://github.com/openssl/openssl/issues/1550 Fixes: QTBUG-71967 Change-Id: Iaaceb18c4c5a090f997f9850981a27f04f1f8b06 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Feature 'ocsp' - fix a broken win-64 buildTimur Pocheptsov2019-02-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | Alas, we have to do the job ossl_typ.h failed to - undef macros coming from wincrypt.h (?) and clashing with identifiers/naming conventions not exactly very wisely chosen by OpenSSL. Change-Id: I1725c4f769be64dbb391d040b2c1574b20b65151 Fixes: QTBUG-73322 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | QSslSocket - make ocsp response into ... ocsp responseSTimur Pocheptsov2019-01-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | If later we try to introduce multiple ocsp support, the API returning a single response will be somewhat broken and illogical/not clear how to use at all. Let's return a vector of responses (for now it's one, can change in future). This makes isNull() redundant on a response, also, we now need 'subject' - a cert that response was for. Change-Id: Ibbd9dec163b53906b2fd61fa31c43db7d08adc4d Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Add class QOcspResponse, providing a bit more detailsTimur Pocheptsov2019-01-231-3/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | about why a certificate was revoked (if it was) and the responder's certificate, if we managed to verify a signature, as was previously shortly discussed in the 'OCSP stapling' patch-set. Auto-test update will be in a separate patch. [ChangeLog][QtNetwork][Ssl] Added class QOcspResponse as a part of OCSP stapling support. Change-Id: I4e17fb6fc4c3dae0b8ad04ff2897a4823736d16e Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: remove some < 1.0 codepathsGiuseppe D'Angelo2018-12-131-1/+1
| | | | | | | | | | | | | | | | We require OpenSSL >= 1.0 now. Change-Id: I6ffe8b2dd606d600671565ebc8bc8ac2b9e0d6c2 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: drop support for SSLv2 and SSLv3Giuseppe D'Angelo2018-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 6176 (2011) and RFC 7568 (2015). Code-wise, we're left with the decision of what to do with a few enumerators in QSsl::Protocol; I've made TlsV1SslV3 act as TlsV1, and adjusted the description of AnyProtocol. A new test was introduced - deprecatedProtocol() - to test that we, indeed, do not allow use of SSL v2 and v3. protocol() and protocolServerSide() were reduced to exclude the (now) no-op and meaningless tests - neither client nor server side can start a handshake now, since we bail out early in initSslContext(). [ChangeLog][QtNetwork][SSL] Support for SSLv2 and SSLv3 sockets has been dropped, as per RFC 6176 (2011) and RFC 7568 (2015). Change-Id: I2fe4e8c3e82adf7aa10d4bdc9e3f7b8c299f77b6 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Add tst_QOcsp auto-testTimur Pocheptsov2018-12-061-0/+52
| | | | | | | | | | | | | | | | | | This patch introduces a private 'API' to enable server-side OCSP responses and implements a simple OCSP responder, tests OCSP status on a client side (the test is pretty basic, but for now should suffice). Change-Id: I4c6cacd4a1b949dd0ef5e6b59322fb0967d02120 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Enable OCSP stapling in QSslSocketTimur Pocheptsov2018-12-031-4/+305
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables OCSP stapling in QSslSocket::SslClientMode (OpenSSL back-end only). OCSP stapling is described by RFC6066 and based on the original OCSP as defined by RFC2560. At the moment multiple certificate status protocol is not supported (not implemented in OpenSSL). SecureTransport does not support OCSP stapling at the moment. [ChangeLog][QtNetwork][TLS] Added OCSP-stapling support for OpenSSL backend Task-number: QTBUG-12812 Task-number: QTBUG-17158 Change-Id: Id2e0f4cc861311d1ece462864e5e30c76184af8c Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2018-11-221-0/+6
|\| | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qdir.cpp src/corelib/kernel/qtimer.cpp src/corelib/kernel/qtimer.h Done-With: Edward Welbourne <edward.welbourne@qt.io> Change-Id: I683d897760ec06593136d77955f8bc87fdef3f9f
| * Merge remote-tracking branch 'origin/5.12.0' into 5.12Liang Qi2018-11-161-0/+6
| |\ | | | | | | | | | Change-Id: Ic1dd39044e19f50e1068d4ac70dacaad6440e570
| | * Add missing protocol enumerators, report TLS 1.3 if negotiatedTimur Pocheptsov2018-11-071-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Remove the conditional inclusion of DTLS versions, they made difficult and unnecessary ugly adding new protocols (something like TlsV1_2OrLater + 4). 2. OpenSSL 1.1.1 first introduced TLS 1.3 support. OpenSSL 1.1 back-end is compatible with OpenSSL 1.1.1, but would fail to extract/report protocol versions and set versions like 'TLS 1.3 only' or 'TLS 1.3 or better' on a new context. Given 1.1.1 is deployed/adapted fast by different distros, and 5.12 is LTS, we fix this issue by introducing QSsl::Tls1_3 and QSsl::Tls1_3OrLater. SecureTransport, WinRT and OpenSSL below 1.1.1 will report an error in case the application requests this protocol (SecureTransport in future will probably enable TLS 1.3). Saying all that, TLS 1.3 support is experimental in QSslSocket. Done-by: Albert Astals Cid <albert.astals.cid@kdab.com> Done-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: I4a97cc789b62763763cf41c44157ef0a9fd6cbec Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* | | Ssl: Windows: Don't load Crypt32 symbols on runtimeMårten Nordheim2018-11-161-21/+13
|/ / | | | | | | | | | | | | We have linked against Crypt32 for a while. Change-Id: I7ec9401a63d7405e4b5357d6589501e997e31aca Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* / Fix supportsSsl() to make it more consistentTimur Pocheptsov2018-11-021-0/+5
|/ | | | | | | | | | | | | | | | | | | Attempts to use QSslSocket and its OpenSSL 1.1 back-end with OpenSSL 1.1.1 in a very peculiar way (for some reason the reporter calls OPENSSL_no_config()) combined with a bug in OpenSSL 1.1.1 resulted in a QSslSocket dead-locking in initialization. This was happening because supportsSsl() first reported false (OpenSSL internally fails to initialize after OPENSSL_no_config()), but we have s_libraryLoaded set to true too early, thus the first supportsSsl() returns false, the second - true. Move setting of s_libraryLoaded later so that we don't claim to support OpenSSL when an earlier ensureLibraryLoaded() attempt failed. Task-number: QTBUG-70956 Task-number: QTBUG-71446 Change-Id: I8ad8763d357c84fc38c62e2ce914366367c2b445 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-09-301-1/+6
|\ | | | | | | Change-Id: Iaa438d14357be1bf75bb645cb8d3245947c055b8
| * SSL: Don't write to closed socket or write to deallocated bufferMårten Nordheim2018-09-281-1/+6
| | | | | | | | | | | | Change-Id: I061848ae570b382d640f8e46a1c54aeaeddbd77d Fixes: QTBUG-61307 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Ssl: clang-tidy modernize-use-nullptrMårten Nordheim2018-08-091-13/+15
| | | | | | | | | | | | | | | | And reflow the text where it exceeds the 100 column limit. Change-Id: I0d270c6a74a4c6ecba30e4e4d38a5d8f2cf81040 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Extend the feature 'dtls' to handle missing DTLS support in OpenSSLTimur Pocheptsov2018-07-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL has 'no-dtls' configure option (or can be too ancient to properly support it), we shall respect such builds. This patch extends configure.json with a 'dtls' test and adds protection against linkage/compile-time issues in the QtNetwork's code. Change-Id: I0c0dd94f5c226115cee4285b82c83aa546555aea Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | QSslSocketBackendPrivate - avoid recursion while handing errorsTimur Pocheptsov2018-07-121-7/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logic seems to be simple - if client code on error signal tries to close TLS socket and this socket has buffered data, it calls 'flush' and 'transmit' or even 'startHandshake' as a result, which in turn will set and emit error again. To auto- test this, we initiate a handshake with pre-shared key hint on a server side and both client/server sockets incorrectly configured (missing PSK signals). We also do early write into the client socket to make sure it has some data buffered by the moment we call 'close'. Task-number: QTBUG-68089 Task-number: QTBUG-56476 Change-Id: I6ba6435bd572ad85d9209c4c81774a397081b34f Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | QtNetwork: Fix and streamline translations of QDtlsFriedemann Kleint2018-06-281-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Use %-placeholder formatting instead of string concatenation for messages of the form "XX failed: %1" - Introduce helper functions for duplicate messages - Introduce helper function for message reporting function failures to avoid duplication - Extract helper function for reporting SSL handshake errors Complemements ac583b686d0677517e7f8a10ce4e79c7fe227ccf. Change-Id: Iaf6c158ca8086d0b17a3e3c51955707734829615 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Let's encrypt datagramsTimur Pocheptsov2018-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds DTLS support to QtNetwork module (and its OpenSSL back-end). DTLS over UDP is defined by RFC 6347. The new API consists of 1) QDtlsClientVerifier which checks if a client that sent us ClientHello is a real DTLS client by generating a cookie, sending a HelloVerifyRequest with this cookie attached, and then verifiying a cookie received back. To be deployed in combination with a server-side QUdpSocket. 2) QDtls - initiates and proceeds with a TLS handshake (client or server side), with certificates and/or pre-shared key (PSK), and encrypts/decrypts datagrams after the handshake has finished. This patch does not implement yet another UDP socket, instead it allows use of existing QUdpSocket(s), by adding DTLS support on top. OpenSSL back-end uses a custom BIO to make it work with QUdpSocket and give a finer control over IO operations. On the server side, demultiplexing is left to client code (could be done either by connecting QUdpSocket or by extracting address/port for an incoming datagram and then forwarding/dispatching them to the corresponding QDtls object). Task-number: QTPM-779 Change-Id: Ifcdf8586c70c3018b0c5549efc722e795f2c1c52 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into devQt Forward Merge Bot2018-05-051-3/+1
|\| | | | | | | Change-Id: Ib58433da04bffb5dfab5486b80f17f39cc4145fa
| * Fix crash in qsslsocket_opensslMårten Nordheim2018-05-041-3/+1
| | | | | | | | | | | | | | | | We were using the wrong free function in a path which was hit in an edge case (PKCS#12 certificate without a private key attached). Change-Id: I5335b5dea7a926b242bed0fd9b989b681a5828d8 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Add a new (D)TLS configurationTimur Pocheptsov2018-04-061-19/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | Namespace QSsl: introduce DtlsV1_0/DtlsV1_2/DtlsV1_2OrLater enumerators into SslProtocol. Implement QSslConfiguration::defaultDtlsConfiguration. Make some functions shared - now not only QSslSocket needs them, but also DTLS-related code. This patch-set also enables protocol-specific set of ciphers (so for DTLS we are using the correct method - 'DTLS_method'). Change-Id: I828fc898674aa3c0a471e8e5b94575bb50538601 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-18 20:05:00 +0000