summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslsocket_openssl.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Convert QSslSocket(Backend)Private into pluginTimur Pocheptsov2021-03-171-2278/+0
| | | | | | | | | | | | | | All backend-specific code is now separated and removed from QSslSocket(Private) code. The original code is mostly preserved to avoid (as much as possible) regressions (and to simplify code-review). Fixes: QTBUG-91173 Task-number: QTBUG-65922 Change-Id: I3ac4ba35d952162c8d6dc62d747cbd62dca0ef78 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit 9391ba55149336c395b866b24dc9b844334d50da)
* Fix a BIC introduced by extending the namespace QSsl in _p.h filesTimur Pocheptsov2021-03-051-11/+11
| | | | | | | | | | Renamed the private part of the namespace to QTlsPrivate. Fixes: QTBUG-91531 Change-Id: Id2d9c458d8d958b35e437eee42889177dad0a7a7 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit e4efa00c72c7011f4e5c27722c2a522b30274610) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* Convert elliptic curves and DH params to work with QTlsBackendTimur Pocheptsov2021-03-031-13/+13
| | | | | | | | | | | | | | | The corresponding API is becoming a part of QTlsBackend interface, since it's too minimalistic and does not require additional interfaces, unlike certificates or keys. Fixes: QTBUG-91177 Fixes: QTBUG-91175 Task-number: QTBUG-65922 Change-Id: I44dd0adbdf2427962451998664efe234d59fae24 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit cdf4976b5a01bc5b65aed746acc9cc7f87b0fd97) Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Move QSslCertificate's details and cert-related code to the pluginsTimur Pocheptsov2021-03-021-150/+10
| | | | | | | | | | | | | | | Also since we have to properly support 'no-ssl' configure option (alas, we support QSslCertificate on such builds) - introduce a minimal crippled QTlsBackendCertOnly, which depends on X509CertificateGeneric. Fixes: QTBUG-90954 Task-number: QTBUG-65922 Change-Id: Ib9d62903f16b7c0eaaa23e319a822c24a7631dc6 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit 41fc143635c25f937a557f09890601f6c7d38736) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* Port QSslKey to the new plugin-based implementationTimur Pocheptsov2021-02-191-112/+5
| | | | | | | | | | | | | The idea is to have QSslKey(Private) backend-neutral and hide all library-specific code inside plugins. Fixes: QTBUG-90953 Task-number: QTBUG-65922 Change-Id: I2eeee3b2b72c78c2e24f2fb914abce3caa913be8 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit 0352cf8e1bf57615b9faf3f6f383896444e762ac) Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Introduce QSsl::X509Certificate interface and its implementationsTimur Pocheptsov2021-02-181-74/+3
| | | | | | | | | | | | | To enable QSslCertificate to use TLS plugins. All backend-specific code is to be moved from QSslCertificate(Private) making them backend-neutral. Task-number: QTBUG-90954 Task-number: QTBUG-65922 Change-Id: Ic9d5abf91e42ce81fe56239f95ae97b64035e950 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> (cherry picked from commit 405337ee7276be4b76e86745c0694c51283b6b07) Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSsl::TlsKey - provide the interface and implementationsTimur Pocheptsov2021-02-011-0/+6
| | | | | | | | which will become parts of TLS plugins in the future. Task-number: QTBUG-65922 Change-Id: I4ee3c59c435fc34a9f4dacd3ff0e3cfb44251e23 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* TLS backend: merge with its factoryTimur Pocheptsov2021-01-281-17/+3
| | | | | | | | | | | | | | QTlsBackend is a factory itself - it creates TLS/X509 objects. Having an intermediary between Factory->Backend->TLS primitive does not look very natural thus let's squash the first two parts. Backend is a factory creating TLS primitives, but its static functions also provide information about backends availablei and give access to those backends. Fixes: QTBUG-90606 Task-number: QTBUG-65922 Change-Id: I8409d81fd11fb46e6ab4465b4937a7680a8c2447 Reviewed-by: Alex Blasche <alexander.blasche@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSsl: add a new private APITimur Pocheptsov2021-01-221-104/+88
| | | | | | | | | This is an abstraction for TLS backend and its factory, preparing to transition to plugin-based design. Task-number: QTBUG-65922 Change-Id: Ibe810e77fd1b715a6bea66cd3f44312b015ac274 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSslSocket - introduce the API providing information about backendsTimur Pocheptsov2021-01-211-1/+107
| | | | | | | | | | | | | | This API gives the names of available backends and provides a basic information about features/protocols supported by those backends. Also, it has the 'loadBackend' functions which allow to select a particular backend (which are becoming plugins). At the moment, the implementation is still 'hardcoded', the follow-up patch will allow to select different backends in runtime. Task-number: QTBUG-65922 Change-Id: I05877de9c02857594e76b24d52e7578bdb01df69 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSslSocket::verify: do not alter the default configurationTimur Pocheptsov2020-11-301-3/+9
| | | | | | | | | | | | | | | | | | | | | QSslCertificate::verify() has an undocumented and not very desirable property - on some platorms it updates the default configuration, which can be surprising. For example, we deprecated QSslSocket::setDefaultCaCertificates() and recommend using QSslConfiguration::defaultConfiguration(), QSslConfiguration::setDefaultConfiguration(), and QSslConfiguration::setCaCertificates(). If an application does this to select CA roots it trusts explicitly, and then for some reason is calling verify, the application can have its QSslSockets successfully connecting to a host, whose root was not trusted by the application. Also, on Windows, defaultCaCertificates() include system roots already, no need to have them twice. [ChangeLog][QtCore][QtNetwork] QSslSocket::verify - do not change the default configuration Pick-to: 5.15 Pick-to: 6.0 Pick-to: 6.0.0 Fixes: QTBUG-88639 Change-Id: I1cd40b259d0a6dcd15c78d1e7c027ff10859595c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Refactor QMutexLocker to be able to handle recursive mutexesLars Knoll2020-10-171-2/+2
| | | | | | | | Since we're going to split QMutex and QRecursiveMutex into separate classes, make sure QMutexLocker is prepared for that. Change-Id: Id5e9a955d1db7c8ee663dd3811ad6448dad0aeae Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* QSslContext - do a little cleanup (OpenSSL)Timur Pocheptsov2020-08-191-0/+4
| | | | | | | | | | | | | | | 1. Remove a useless forward declaration of a non-existing class. 2. Simplify the cipher filtering. 3. A missing private key (when local cert is present) found by the Qt, not OpenSSL, so no need in asking OpenSSL for errors in queue. 3. Fix a potential double-free (for opaque keys). 4. read/write BIOs normally owned by SSL object, but if we fail to allocate any of them, we return early, potentially failing to free the one that was allocated. Change-Id: Ifb52fbc9fd1a38f101bd7ff02e79b82d6eb7e5b0 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Mark QSslError(SslError error) as explicitLars Schmertmann2020-08-061-5/+5
| | | | | | | | | | | | | | | Currently it is possible to compare a QSslError with a QSslError::SslError because QSslError has an implicit constructor. But the comparison often fails because a QSslError received from the system contains a certificate. [ChangeLog][QtNetwork][QSslError] The constructor QSslError(QSslError::SslError error) is now explicit. Change-Id: I36cc5895245d3b43ab4b8d65a9635893d6b0e6a4 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSslSocket (OpenSSL, Windows) - make sure we ignore stale fetch resultsTimur Pocheptsov2020-07-281-1/+14
| | | | | | | | | | | The CA fetcher on Windows works on a separate thread, it can take quite some time to finish its job and if a connection was meanwhile closed (via 'abort', 'close' or 'disconnectFromHost') but the socket is still alive/re-used - we don't want to be fooled by the previous fetch 'finished' signal, only if it's fetching for the same certificate. Change-Id: Ibd0a70000ad10cff10207d37d7b47c38e615d0f1 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Fix OCSP-Stapling error if identity cannot be verifiedAndré Klitzing2020-07-171-0/+5
| | | | | | | | | | | | | | | If QSslConfiguration::setCaCertificates is set to empty list openssl cannot verify the OCSP-Response. Qt will provide it as QSslError::OcspResponseCannotBeTrusted that can be ignored. But the openssl error is still in the error queue and prevents a successful reply in QNetworkReply::finished. So let's clear the queue after OCSP checking to avoid side affects. Change-Id: I44a7f45a2eebd20ea86a235a0534f80986c40a26 Fixes: QTBUG-85638 Pick-to: 5.15 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Add ; to Q_UNUSEDLars Schmertmann2020-07-071-1/+1
| | | | | | | | This is required to remove the ; from the macro with Qt 6. Task-number: QTBUG-82978 Change-Id: I3f0b6717956ca8fa486bed9817b89dfa19f5e0e1 Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
* Move QAlertLevel and QAlertType enums into the namespace QSslTimur Pocheptsov2020-06-291-7/+9
| | | | | | | | | | Not to pollute the global namespace with rather generic names (especially in case QT_NAMESPACE is none); also drop the (now)redundant 'Q' prefix in the names. Change-Id: I57ea7e3996cced705f7ddbdbc1e0231191b31c43 Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Use QList instead of QVector in networkJarek Kobus2020-06-261-6/+6
| | | | | | Task-number: QTBUG-84469 Change-Id: I7827da68e73ca8ff1e599c836f2157894c452b63 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSslSocket: remove certificate-related settersTimur Pocheptsov2020-06-221-1/+3
| | | | | | | | | | They were deprecated with replacements in QSslConfiguration proposed (and some without alternative, which we'll provide if there is any demand in such an API). Special thanks to M.N. for a nice hint on how to amend the test without introducing a new API. Change-Id: I7841a5b3f30469d8204b61cb65921c34275e0650 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Port QtNetwork from QStringRef to QStringViewLars Knoll2020-06-101-1/+1
| | | | | | | | Task-number: QTBUG-84319 Change-Id: I0f4e83c282b58ab4cc5e397b21981978f79d92cf Reviewed-by: Alex Blasche <alexander.blasche@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* CA fetcher (Windows) - relax the logic a bitTimur Pocheptsov2020-05-291-43/+88
| | | | | | | | | | | | | | | | | | | | | In case a certificate chain is missing an intermediate, for a certificate having "Authority Information Access" extension it's possible to fetch this intermediate and build the chain up to the trusted root. Unfortunately, it's not always possible to install the root certificate in the system "ROOT" store and then an application wants to set it in the socket's configuration, using setCaCertificates(). But this call also disables CA fetcher ('no on demand root loading'). It makes sense to relax this logic for such certificates and try to fetch the intermediate CA and then have the complete chain verified. Pick-to: 5.15 Fixes: QTBUG-84173 Change-Id: I5b9b4271767eba6f5fd2b5cf05e942360c6aa245 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSslSocket::addCaCertificates - do not duplicate certsTimur Pocheptsov2020-05-201-2/+2
| | | | | | | | | If we already know the certificate, there is no need in adding it again. This function is deprecated, but will stay forever in 5.15. Pick-to: 5.15 Change-Id: I760f5bcffea78ac02c5643ee1112725edd32f15a Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Make OpenSSL back-end work with 3.0 alphaTimur Pocheptsov2020-05-201-0/+7
| | | | | | | | | | | | | | DSA/DH/etc _bits functions were first deprecated, then un-deprecated, so we don't worry about them for now. SSL_CTX_load_verify_location was deprecated and two new functions were introduced instead (one using file, the second - path). It's unfortunately 3.0 only, so we have to check OpenSSL version. DH_check is deprecated and we have to use EVP_PKEY_param_check with tons of a boilerplate code around. Fixes: QTBUG-83733 Pick-to: 5.15 Change-Id: Icd401ab6aad30c23c37443c7bc82c702fb843640 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-04-221-6/+17
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: src/widgets/widgets/qabstractbutton.cpp src/widgets/widgets/qbuttongroup.cpp src/widgets/widgets/qbuttongroup.h src/widgets/widgets/qsplashscreen.cpp tests/auto/widgets/widgets/qbuttongroup/tst_qbuttongroup.cpp tests/benchmarks/opengl/main.cpp Needed update: src/plugins/platforms/cocoa/CMakeLists.txt Change-Id: I7be4baebb63844ec2b3e0de859ca9de1bc730bb5
| * OpenSSL: handle SSL_shutdown's errors properlyTimur Pocheptsov2020-04-151-6/+17
| | | | | | | | | | | | | | | | | | | | | | Do not call SSL_shutdown on a session that is in handshake state (SSL_in_init(s) returns 1). Also, do not call SSL_shutdown if a session encountered a fatal error (SSL_ERROR_SYSCALL or SSL_ERROR_SSL was found before). If SSL_shutdown was unsuccessful (returned code != 1), we have to clear the error(s) it queued. Fixes: QTBUG-83450 Change-Id: I6326119f4e79605429263045ac20605c30dccca3 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-04-081-0/+6
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: examples/opengl/doc/src/cube.qdoc src/corelib/global/qlibraryinfo.cpp src/corelib/text/qbytearray_p.h src/corelib/text/qlocale_data_p.h src/corelib/time/qhijricalendar_data_p.h src/corelib/time/qjalalicalendar_data_p.h src/corelib/time/qromancalendar_data_p.h src/network/ssl/qsslcertificate.h src/widgets/doc/src/graphicsview.qdoc src/widgets/widgets/qcombobox.cpp src/widgets/widgets/qcombobox.h tests/auto/corelib/tools/qscopeguard/tst_qscopeguard.cpp tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp tests/benchmarks/corelib/io/qdiriterator/qdiriterator.pro tests/manual/diaglib/debugproxystyle.cpp tests/manual/diaglib/qwidgetdump.cpp tests/manual/diaglib/qwindowdump.cpp tests/manual/diaglib/textdump.cpp util/locale_database/cldr2qlocalexml.py util/locale_database/qlocalexml.py util/locale_database/qlocalexml2cpp.py Resolution of util/locale_database/ are based on: https://codereview.qt-project.org/c/qt/qtbase/+/294250 and src/corelib/{text,time}/*_data_p.h were then regenerated by running those scripts. Updated CMakeLists.txt in each of tests/auto/corelib/serialization/qcborstreamreader/ tests/auto/corelib/serialization/qcborvalue/ tests/auto/gui/kernel/ and generated new ones in each of tests/auto/gui/kernel/qaddpostroutine/ tests/auto/gui/kernel/qhighdpiscaling/ tests/libfuzzer/corelib/text/qregularexpression/optimize/ tests/libfuzzer/gui/painting/qcolorspace/fromiccprofile/ tests/libfuzzer/gui/text/qtextdocument/sethtml/ tests/libfuzzer/gui/text/qtextdocument/setmarkdown/ tests/libfuzzer/gui/text/qtextlayout/beginlayout/ by running util/cmake/pro2cmake.py on their changed .pro files. Changed target name in tests/auto/gui/kernel/qaction/qaction.pro tests/auto/gui/kernel/qaction/qactiongroup.pro tests/auto/gui/kernel/qshortcut/qshortcut.pro to ensure unique target names for CMake Changed tst_QComboBox::currentIndex to not test the currentIndexChanged(QString), as that one does not exist in Qt 6 anymore. Change-Id: I9a85705484855ae1dc874a81f49d27a50b0dcff7
| * OpenSSL: bump the minimum supported version to 1.1.1Giuseppe D'Angelo2020-03-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | We don't support 1.0 any more, and 1.1.0 has reached EOL. Bump to 1.1.1 so we can freely use its APIs. [ChangeLog][QtNetwork][SSL] The minimum required version of OpenSSL is now 1.1.1. Change-Id: I5cfb6672fadfa48aedaefbcd6a954aa9eb85bfa5 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-03-031-1/+1
|\| | | | | | | Change-Id: If36d96c0fef3de5ab6503977501c55c62a2ecc97
| * Use Qt::SplitBehavior in preference to QString::SplitBehaviorEdward Welbourne2020-02-281-1/+1
| | | | | | | | | | | | | | | | The Qt version was added in 5.14 "for use as eventual replacement for QString::SplitBehavior." Move another step closer to that goal. Change-Id: I399b5ea56e9255e775ca1746632f7421519a6616 Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devLars Knoll2020-02-281-1/+1
|\| | | | | | | Change-Id: I469b0501cc65fc5ce4d797a69ae89405cc69c7f8
| * Revert "QAbstractSocket: deprecate 'error' member-function"Alexander Akulich2020-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 94b3dd77f29a00ebbd1efdc66d75f57e1c75b152. The patch fixes ambiguity between a getter and a signal by changing the getter name, but we still have to rename the signal to follow the signals naming convention. Revert the commit to keep the getter as is and change the signal name instead. Change-Id: I0dd60cf1ae9d1bd95beeb8ad58661ca4b1fb63b9 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* | Merge remote-tracking branch 'origin/5.15' into devLiang Qi2020-02-131-0/+70
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: examples/widgets/graphicsview/boxes/scene.h src/corelib/Qt5CoreMacros.cmake src/corelib/Qt6CoreMacros.cmake src/network/ssl/qsslsocket.cpp src/network/ssl/qsslsocket.h src/platformsupport/fontdatabases/windows/qwindowsfontenginedirectwrite.cpp src/testlib/CMakeLists.txt src/testlib/.prev_CMakeLists.txt tests/auto/corelib/tools/qscopeguard/tst_qscopeguard.cpp Disabled building manual tests with CMake for now, because qmake doesn't do it, and it confuses people. Done-With: Alexandru Croitor <alexandru.croitor@qt.io> Done-With: Volker Hilsheimer <volker.hilsheimer@qt.io> Change-Id: I865ae347bd01f4e59f16d007b66d175a52f1f152
| * Implement/fix session resumption with TLS 1.3Timur Pocheptsov2020-01-291-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The session we cache at the end of a handshake is non-resumable in TLS 1.3, since NewSessionTicket message appears quite some time after the handshake was complete. OpenSSL has a callback where we can finally obtain a resumable session and inform an application about session ticket updated by emitting a signal. Truism: OpenSSL-only. [ChangeLog][QtNetwork] A new signal introduced to report when a valid session ticket received (TLS 1.3) Fixes: QTBUG-81591 Change-Id: I4d22fad5cc082e431577e20ddbda2835e864b511 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-01-131-1/+1
|\| | | | | | | | | | | | | Conflicts: tests/auto/network/ssl/qsslsocket/tst_qsslsocket.cpp Change-Id: I4d3041fa291a918c774ffa5eb5c8792a0966451d
| * QAbstractSocket: deprecate 'error' member-functionTimur Pocheptsov2020-01-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The one that is a getter for the last error found. This is to disambiguate the expression '&QAbstractSocket::error'. Introduce a new member-function socketError as a replacement. [ChangeLog][Deprecation Notice] QAbstractSocket::error() (the getter) is deprecated; superseded by socketError(). Task-number: QTBUG-80369 Change-Id: Ia2e3d108657aaa7929ab0810babe2ede309740ba Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2019-12-041-8/+4
|\| | | | | | | Change-Id: I4134c0c6b6c9911950f58b3b5c86e789d28a185b
| * Merge remote-tracking branch 'origin/5.14' into 5.15Ulf Hermann2019-12-031-8/+4
| |\ | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/serialization/qcborvalue.cpp Change-Id: I675a3029955c96e81a33ed9d98b72b55b6784b52
| | * QSslSocket (OpenSSL) fix a resource leakTimur Pocheptsov2019-11-271-8/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Introduced by fe6e54fb1f5cda652b9489f740763f8d735621dd. The probability -> 0, meaning malloc must fail to trigger it, but it is still a leak. We now use std::unique_ptr which improves the code in general a bit and fixes a leak. Change-Id: I6c0fa36953196d3235fb60354dc9ad2396d8dfcb Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | QSslSocket (OpenSSL) improve alert messages handlingTimur Pocheptsov2019-12-031-13/+233
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Add a new verification callback. This gives an option to report errors directly from this callback (by emitting handshakeInterruptedOnError()). This allows an application to explain to its peer why the handshake was interrupted (by sending a corresponding alert message). 2. This also means we want to notice such alerts (in Qt, from the application's point of view, they are mostly informational only, no interaction is required). So we also introduce a new 'info callback', that can notice alert messages read or written. We also introduce two new enums describing the level and type of an alert message. QSslSocket gets three new signals (for incoming/outgoing alerts and verification errors found early). 3. In case we requested a certificate, but the peer provided none, we would previously abruptly close the connection without a proper alert message (and such a situation is not handled by any verification callbacks, since there is no certificate(s) to verify essentially). So we now introduce a new verification option that maps to what OpenSSL calls 'SSL_VERIFY_FAIL_IF_NO_PEER_CERT'. This way, the proper alert will be generated. Fixes: QTBUG-68419 Change-Id: I5d1e9298b4040a2d4f867f5b1a3567a2253927b8 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | QSsl - delete all mentions of SslV2 and SslV3Timur Pocheptsov2019-11-281-26/+18
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, change the notion of 'unsupported protocol' for QSslSocket, previously it was SslV2 and SslV3, now instead it's all versions of DTLS and UnknownProtocol: - makes no sense at all to connect using TCP socket and then suddenly start using DTLS_client/server_method - UnknownProtocol is not to be set in a configuration, unknown means that some ciphersuite's protocol version cannot be established. - 'disabledProtocols' auto-test becomes 'unsupportedProtocols' and tests that QSslSocket fails to start encryption if the protocol version is wrong. Handling these enumerators (SslV2 and SslV2) as errors not needed anymore. Removed from QSslContext and our existing backends (qsslsocket_whatever). TlsV1SslV3 enumerator is not making any sense at all (previously was [SSL v3, TLS 1.0], then became "the same as TLS v. 1.0", but now this name is very confusing. Removed. Task-number: QTBUG-75638 Task-number: QTBUG-76501 Change-Id: I2781ba1c3051a7791b476266d4561d956948974a Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* / QSslSocket - remove old OpenSSL backend (< 1.1)Timur Pocheptsov2019-11-011-45/+231
|/ | | | | | | | | | | | | | OpenSSL 1.0.2 will stop receiving all support at the end of 2019. Qt 5.15 is our next LTS thus makes sense remove OpenSSL 1.0.2 support there. This also allows us quite a significant cleanup of an old heavily if-defed code and all 'pre11' suffixed source files. [ChangeLog][QtNetwork][SSL] Removed OpenSSL 1.0.x support, now 1.1.x is required Change-Id: I70c70c56cbd8aeff793afe793335696d1b1b7408 Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-07-011-1/+0
|\ | | | | | | | | | | | | | | Conflicts: src/network/ssl/qsslsocket_openssl.cpp src/platformsupport/vkconvenience/qvkconvenience.cpp Change-Id: I97ce6ed185f7fdad8102cc58d3cfec0119fd7bb4
| * qsslsocket_openssl.cpp - restructure the codeTimur Pocheptsov2019-06-281-6/+4
| | | | | | | | | | | | | | not to resolve merge conflicts on every 5.13->dev merge. Change-Id: Id41a7efff52148fe46bedcde828646694fd1764d Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-06-271-0/+1
|\| | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/network/ssl/qsslsocket_openssl.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ibb57a0548b4977797b400637487a56245ac1c024
| * Merge remote-tracking branch 'origin/5.12' into 5.13Liang Qi2019-06-251-54/+55
| |\ | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qstorageinfo_unix.cpp src/network/ssl/qsslsocket_openssl.cpp Change-Id: Ibc9ce799bef62d60d616beaa9fbde8ebeadfbc20
| * | checkOcspResponse - remove unneeded lockingTimur Pocheptsov2019-06-171-14/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and also plain wrong comments: since we don't set verification callback on a store - we don't have to lock (our q_X509Callback never gets called). This change should simplify the merge with change I have in 5.12 (where I completely got rid of locking). Since I don't care about exact errors found (relying on the fact it's the same chain of certs we check in SSL_connect/SSL_accept), for now we don't try to extract them from OCSP_basic_verify. In fufure, if these chains are different, we can create a temporary store (see how it's done in 'verify', for example) and set a VF callback on this store. Change-Id: I4a36e19836d19c2ea95c869dcfe85f49fe723ff0 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackMårten Nordheim2019-06-131-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Reviewed-by: Simo Fält <simo.falt@qt.io> (cherry picked from commit d8efc8d718e3b3a0464f321e740541f5b221a5d6) Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2019-06-251-73/+116
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/gui/painting/qdrawhelper.cpp src/gui/text/qdistancefield.cpp src/gui/text/qdistancefield_p.h src/network/ssl/qsslsocket_openssl.cpp src/plugins/platforms/android/qandroidinputcontext.cpp src/widgets/styles/qstylesheetstyle.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ia7daad21f077ea889898f17734ec46303e71fe6b
| * | TLS socket: make verification callback lock-free (OpenSSL)Timur Pocheptsov2019-06-171-51/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When our QSslSocketBackendPrivate (OpenSSL backend) was developed, the ancient versions of OpenSSL did not have an API needed to pass an application-specific data into verification callback. Thus the developers resorted to the use of global variables (a list with errors) and locks. Some of our auto-tests use QNAM and in-process server. Whenever the client (essentially qhttpthreadeddelegate) and the server live in different threads, any use of 'https' is dead-lock prone, which recent events demonstrated and which were previously observed but not understood properly (rare occasions, not always easy to reproduce). Now we fix this for good by removing locking. There are two places (in 5.12) where these locks are needed: 1. Before calling SSL_connect/SSL_accept (handshake) - here we reuse the same trick we do in PSK callback ('SSL' has an external data set, and it's 'this', meaning an object of type QSslSocketBackendPrivate). 2. The static member function 'verify', here we do not have 'SSL', but we have our temporary 'X509_STORE', to which we can directly attach an external data - a pointer to a vector to collect verification errors. Note, this change assumes that OpenSSL Qt is build/linked against is at least of version 1.0.1 - we set external data on SSL unconditionally (no version checks). Fixes: QTBUG-76157 Change-Id: I05c98e77dfd5fb0c2c260fb6c463732facf53ffc Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-09 14:02:07 +0000