summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslsocket_openssl_symbols.cpp
Commit message (Collapse)AuthorAgeFilesLines
* OpenSSL: handle SSL_shutdown's errors properlyTimur Pocheptsov2020-04-161-0/+8
| | | | | | | | | | | | | | Do not call SSL_shutdown on a session that is in handshake state (SSL_in_init(s) returns 1). Also, do not call SSL_shutdown if a session encountered a fatal error (SSL_ERROR_SYSCALL or SSL_ERROR_SSL was found before). If SSL_shutdown was unsuccessful (returned code != 1), we have to clear the error(s) it queued. Unfortunately, SSL_in_init was a macro in OpenSSL 1.0.x. We have to resolve SSL_state to implement SSL_in_init. Fixes: QTBUG-83450 Change-Id: I6326119f4e79605429263045ac20605c30dccca3 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> (cherry picked from commit 8907635da59c2ae0e8db01f27b24a841b830e655)
* q_getTimeFromASN1: fix invalid accessTimur Pocheptsov2020-03-191-1/+17
| | | | | | | | | No sanitizer is needed, just looking at the code is enough. It was wrong. Change-Id: I9df417c137d6b3361c3161865e099a8be40860de Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Fix symbol resolving for OPENSSL_NO_NEXPROTONEGTimur Pocheptsov2020-02-051-4/+4
| | | | | | | | | | | | Our ALPN-related definitions were conditioned both on OPENSSL_NO_NEXTPROTONEG and OpenSSL version (since ALPN first was introduced in 1.0.2), but resolving was only under version check, not OPENSSL_NO_NEXTPROTONEG. This went unnoticed for many years, and was found only recently with OpenSSL built with no-nexprotoneg. Fixes: QTBUG-81762 Change-Id: I7afca0b2034a234a19b5bcdefd3ce26f4202cddb Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-07-301-0/+17
|\ | | | | | | | | | | | | Conflicts: qmake/generators/win32/mingw_make.cpp Change-Id: I2f790bc8572bd22fea01edf7ca74595b29f063eb
| * Merge remote-tracking branch 'origin/5.12' into 5.13Qt Forward Merge Bot2019-07-291-0/+17
| |\ | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qresource.cpp Change-Id: I54917f72444a621bd08aeaa15f5d17415993144d
| | * Android: Fix SSL 1.1 support on API-21BogDan Vatra2019-07-261-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.x libs must be suffixed otherwise it will use the system ones which on API-21 are OpenSSL 1.0 not 1.1 Fixes: QTBUG-76884 Change-Id: I7d4052be68cf7dc65f74a48da8e1e37182056a5e Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
| * | Merge remote-tracking branch 'origin/5.12' into 5.13Liang Qi2019-06-251-0/+10
| |\| | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qstorageinfo_unix.cpp src/network/ssl/qsslsocket_openssl.cpp Change-Id: Ibc9ce799bef62d60d616beaa9fbde8ebeadfbc20
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackMårten Nordheim2019-06-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Reviewed-by: Simo Fält <simo.falt@qt.io> (cherry picked from commit d8efc8d718e3b3a0464f321e740541f5b221a5d6) Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | qsslsocket_openssl_symbols.cpp: replace manual memory management with ↵Marc Mutz2019-07-101-51/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | std::unique_ptr Also fix the name mismatch between the Windows- and non-Windows versions of loadOpenSsl(), which, presumably, were caused by having two different return values, something easily fixed by defining a small struct instead of using a QPair. Some #ifdef'ery saved, and a lot of brittle deletes on early returns. Change-Id: I77440de2f6fa51759510506ff4ef51917eb5b3ea Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | qsslsocket_openssl_symbols.cpp: replace mutex pool use with QBasicMutexMarc Mutz2019-07-081-14/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The use of QMutexPool caused an #ifdef, because, lacking an object, some OpenSSL function pointer was used as the address required as input for the mutex pool. Sadly, the names of the functions differ between OpenSSL versions, thus the need for an #ifdef. By simply using a QBasicMutex (defined at namespace scope to evade https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79561), the #ifdef can go away. Another level of #ifdefs goes away because, even for non-QT_CONFIG(thread) builds, Q*Mutex etc are defined, just as no-ops. So we can freely use them without QT_CONFIG(thread) guard, unlike QMutexPool. Finally, optimize for the (common?) case of already-loaded libraries by making symbolsResolved an atomic variable, and checking that before taking the mutex (double-checked locking, done right). For reasons of said GCC bug, again, the QBasicAtomic is defined at namespace scope. And then move the other boolean there for symmetry. Change-Id: Ic5f44871fb200e5368b9af327e4d1e852fbc586c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2019-06-251-0/+12
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/gui/painting/qdrawhelper.cpp src/gui/text/qdistancefield.cpp src/gui/text/qdistancefield_p.h src/network/ssl/qsslsocket_openssl.cpp src/plugins/platforms/android/qandroidinputcontext.cpp src/widgets/styles/qstylesheetstyle.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ia7daad21f077ea889898f17734ec46303e71fe6b
| * | TLS socket: make verification callback lock-free (OpenSSL)Timur Pocheptsov2019-06-171-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When our QSslSocketBackendPrivate (OpenSSL backend) was developed, the ancient versions of OpenSSL did not have an API needed to pass an application-specific data into verification callback. Thus the developers resorted to the use of global variables (a list with errors) and locks. Some of our auto-tests use QNAM and in-process server. Whenever the client (essentially qhttpthreadeddelegate) and the server live in different threads, any use of 'https' is dead-lock prone, which recent events demonstrated and which were previously observed but not understood properly (rare occasions, not always easy to reproduce). Now we fix this for good by removing locking. There are two places (in 5.12) where these locks are needed: 1. Before calling SSL_connect/SSL_accept (handshake) - here we reuse the same trick we do in PSK callback ('SSL' has an external data set, and it's 'this', meaning an object of type QSslSocketBackendPrivate). 2. The static member function 'verify', here we do not have 'SSL', but we have our temporary 'X509_STORE', to which we can directly attach an external data - a pointer to a vector to collect verification errors. Note, this change assumes that OpenSSL Qt is build/linked against is at least of version 1.0.1 - we set external data on SSL unconditionally (no version checks). Fixes: QTBUG-76157 Change-Id: I05c98e77dfd5fb0c2c260fb6c463732facf53ffc Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackv5.12.4Mårten Nordheim2019-06-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Simo Fält <simo.falt@qt.io>
* | | Deprecate conversion functions between QList and QSetLars Knoll2019-05-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users should use range constructors instead to do the conversion. Keep conversion methods between QList and QVector as these will turn into a no-op in Qt 6, whereas forcing people to use range constructors would lead to deep copies of the data. Change-Id: Id9fc9e4d007044e019826da523e8418857c91283 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* | | tst_qsslkey: test AES encryption in the 'encrypt' testMårten Nordheim2019-03-261-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | And export the required symbols in OpenSSL so we can run the test there as well even if it's not needed for any functionality. Change-Id: I4246d2b0bbdd42079d255f97f3c66ce8bb37390b Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Extend the test for QSslKeyLars Schmertmann2019-03-021-0/+4
| |/ |/| | | | | | | | | | | | | | | | | Check if QSslKey::handle() returns data representing the same key information as that passed to the constructor. Task-number: QTBUG-64495 Change-Id: I1a91264e6f6d92d259b51fca9de00fcbfd5cc845 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: remove some more pre-1.0 fallbacksGiuseppe D'Angelo2018-12-141-31/+0
| | | | | | | | | | | | | | | | Again, 1.0 is required now. Change-Id: Icca5dc38eb33c1579653d96d6c079b335a401aad Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: drop support for SSLv2 and SSLv3Giuseppe D'Angelo2018-12-131-36/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 6176 (2011) and RFC 7568 (2015). Code-wise, we're left with the decision of what to do with a few enumerators in QSsl::Protocol; I've made TlsV1SslV3 act as TlsV1, and adjusted the description of AnyProtocol. A new test was introduced - deprecatedProtocol() - to test that we, indeed, do not allow use of SSL v2 and v3. protocol() and protocolServerSide() were reduced to exclude the (now) no-op and meaningless tests - neither client nor server side can start a handshake now, since we bail out early in initSslContext(). [ChangeLog][QtNetwork][SSL] Support for SSLv2 and SSLv3 sockets has been dropped, as per RFC 6176 (2011) and RFC 7568 (2015). Change-Id: I2fe4e8c3e82adf7aa10d4bdc9e3f7b8c299f77b6 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.12' into devQt Forward Merge Bot2018-12-111-9/+18
|\| | | | | | | Change-Id: I91e684e74c36467efda8ded6ed19791baa0c1a1f
| * Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-12-101-9/+18
| |\ | | | | | | | | | Change-Id: If49df791f73e9edf616baa094e0f301a44cb853d
| | * OpenSSL: also try the "1.0.2" sonameGiuseppe D'Angelo2018-11-291-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Turns out that also Debian patches OpenSSL 1.0, changing its soname to "1.0.2". Therefore, try also to load that one. Amends 2708c6c11d685ab25c12d558961d924c9a4533d2. Task-number: QTBUG-68156 Change-Id: I37cc060e90422779a6c29a324ab900f0fb99cfa7 Reviewed-by: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Add tst_QOcsp auto-testTimur Pocheptsov2018-12-061-1/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a private 'API' to enable server-side OCSP responses and implements a simple OCSP responder, tests OCSP status on a client side (the test is pretty basic, but for now should suffice). Change-Id: I4c6cacd4a1b949dd0ef5e6b59322fb0967d02120 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Enable OCSP stapling in QSslSocketTimur Pocheptsov2018-12-031-1/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables OCSP stapling in QSslSocket::SslClientMode (OpenSSL back-end only). OCSP stapling is described by RFC6066 and based on the original OCSP as defined by RFC2560. At the moment multiple certificate status protocol is not supported (not implemented in OpenSSL). SecureTransport does not support OCSP stapling at the moment. [ChangeLog][QtNetwork][TLS] Added OCSP-stapling support for OpenSSL backend Task-number: QTBUG-12812 Task-number: QTBUG-17158 Change-Id: Id2e0f4cc861311d1ece462864e5e30c76184af8c Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devQt Forward Merge Bot2018-11-271-0/+2
|\| | | | | | | | | | | Change-Id: I04afffdce6b78856d0301eb583f21d334c7466b0
| * | Fix build errors in OpenSSL 1.1 backendTimur Pocheptsov2018-11-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | SSL_CTX_set_ciphers is new in 1.1.1. Task-number: QTBUG-71983 Change-Id: If0ae9f95dcc867c62ed0d3a6a60c22c7f5e1cc9f Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Add support for Diffie-Hellman keys to QSslKeyLars Schmertmann2018-11-231-0/+8
|/ / | | | | | | | | | | | | | | | | | | | | | | This is necessary to provide details for the key too, when the server is using DHE-RSA-AESxxx-SHAxxx. Amends 7f77dc84fb434f33ffe96f6633792706b80fb0a3. Change-Id: I8ab15b6987c17c857f54bc368df3c6c1818f428c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Add missing protocol enumerators, report TLS 1.3 if negotiatedTimur Pocheptsov2018-11-071-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Remove the conditional inclusion of DTLS versions, they made difficult and unnecessary ugly adding new protocols (something like TlsV1_2OrLater + 4). 2. OpenSSL 1.1.1 first introduced TLS 1.3 support. OpenSSL 1.1 back-end is compatible with OpenSSL 1.1.1, but would fail to extract/report protocol versions and set versions like 'TLS 1.3 only' or 'TLS 1.3 or better' on a new context. Given 1.1.1 is deployed/adapted fast by different distros, and 5.12 is LTS, we fix this issue by introducing QSsl::Tls1_3 and QSsl::Tls1_3OrLater. SecureTransport, WinRT and OpenSSL below 1.1.1 will report an error in case the application requests this protocol (SecureTransport in future will probably enable TLS 1.3). Saying all that, TLS 1.3 support is experimental in QSslSocket. Done-by: Albert Astals Cid <albert.astals.cid@kdab.com> Done-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: I4a97cc789b62763763cf41c44157ef0a9fd6cbec Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-10-211-0/+23
|\| | | | | | | Change-Id: Iaf28977e7ecf566b28b9406dcb005d48621169c2
| * OpenSSL: force the "1.0.0" soname when loading OpenSSL 1.0Giuseppe D'Angelo2018-10-191-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some Linux distributions patch OpenSSL's soname, making builds on such distributions not deployable elsewhere. The problem is that the code loading OpenSSL symbols would attempt to use the soname of the build machine, and therefore not finding the OpenSSL libraries on the deploy system. The binary builds of Qt for Linux are affected by this problem, as they build under RHEL7.4 which changes to soname of OpenSSL to a non-standard string. This makes the binary builds not pick up OpenSSL 1.0 from the machine where the build gets installed on. Given that in the pre-1.1 versions only the 1.0 series is supported, bump the minimum requirement of Qt to that. The 1.0.x releases (up to 1.0.2, at the time of this writing) have kept binary compatibility, and advertise a soname of "1.0.0", which is used by most distributions. So, if loading of OpenSSL with the build-time soname fails, try to load them with the "1.0.0" hardcoded soname. [ChangeLog][QtNetwork][SSL] OpenSSL >= 1.0 is now required to build Qt with OpenSSL support. Task-number: QTBUG-68156 Change-Id: Ieff1561a3c1d278b511f09fef06580f034f188c6 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | wasm: enable Network for nothreadLorn Potter2018-09-281-0/+4
| | | | | | | | | | | | | | Task-number: QTBUG-70208 Change-Id: Ib73ca0d3c0736336bf517ffb968cbdbab4610319 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
* | Modernize the "thread" featureUlf Hermann2018-08-171-2/+0
| | | | | | | | | | | | | | | | | | | | Add it to configure.json and replace all occurrences of QT_NO_THREAD with QT_CONFIG(thread). Add conditions for other features that depend on thread support. Remove conditions where we can use the QMutex and QThreadStorage stubs. Change-Id: I284e5d794fda9a4c6f4a1ab29e55aa686272a0eb Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
* | Ssl: clang-tidy modernize-use-nullptrMårten Nordheim2018-08-091-115/+115
| | | | | | | | | | | | | | | | And reflow the text where it exceeds the 100 column limit. Change-Id: I0d270c6a74a4c6ecba30e4e4d38a5d8f2cf81040 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Extend the feature 'dtls' to handle missing DTLS support in OpenSSLTimur Pocheptsov2018-07-131-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL has 'no-dtls' configure option (or can be too ancient to properly support it), we shall respect such builds. This patch extends configure.json with a 'dtls' test and adds protection against linkage/compile-time issues in the QtNetwork's code. Change-Id: I0c0dd94f5c226115cee4285b82c83aa546555aea Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | OpenSSL: remove unused symbols/declarationsTimur Pocheptsov2018-07-131-8/+0
| | | | | | | | | | | | | | | | | | | | These are leftovers from the prototype version of DTLS connection and no code is using them now. Change-Id: I3970a56303a59ce95e9c22344fac89e89f6559c8 Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Let's encrypt datagramsTimur Pocheptsov2018-06-181-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds DTLS support to QtNetwork module (and its OpenSSL back-end). DTLS over UDP is defined by RFC 6347. The new API consists of 1) QDtlsClientVerifier which checks if a client that sent us ClientHello is a real DTLS client by generating a cookie, sending a HelloVerifyRequest with this cookie attached, and then verifiying a cookie received back. To be deployed in combination with a server-side QUdpSocket. 2) QDtls - initiates and proceeds with a TLS handshake (client or server side), with certificates and/or pre-shared key (PSK), and encrypts/decrypts datagrams after the handshake has finished. This patch does not implement yet another UDP socket, instead it allows use of existing QUdpSocket(s), by adding DTLS support on top. OpenSSL back-end uses a custom BIO to make it work with QUdpSocket and give a finer control over IO operations. On the server side, demultiplexing is left to client code (could be done either by connecting QUdpSocket or by extracting address/port for an incoming datagram and then forwarding/dispatching them to the corresponding QDtls object). Task-number: QTPM-779 Change-Id: Ifcdf8586c70c3018b0c5549efc722e795f2c1c52 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into devQt Forward Merge Bot2018-05-291-0/+8
|\| | | | | | | Change-Id: I8d8b03ea46c537b091b72dc7b68aa6aa3a627ba6
| * Fix build if openssl is configured with no-des or no-rc2André Klitzing2018-05-241-0/+8
| | | | | | | | | | | | | | | | | | A custom build of openssl can disable DES or RC2. This allows to build Qt against those builds. Change-Id: I9b91c943fab4d217a791381e81a7d87a9ff5031a Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into devQt Forward Merge Bot2018-04-181-0/+2
|\| | | | | | | Change-Id: I86f04fc3b2e4291f161a4985adddd6fd6c789d33
| * QSslCertificate (OpenSSL) use the correct *_free functionv5.11.0-beta4Timur Pocheptsov2018-04-151-0/+2
| | | | | | | | | | | | | | | | | | | | When releasing a STACK_OF(GENERAL_NAME). Actually, GENERAL_NAME_free is a special function, not the same as OPENSSL_sk_free. Task-number: QTBUG-57679 Change-Id: I3ed300bb95e8be35bd9cd06b6dbc6e59c7c6a4ee Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Add DTLS-related API (OpenSSL)Timur Pocheptsov2018-03-191-1/+77
|/ | | | | | | | | This patch adds several macros, functions and typedefs, needed by DTLS, into our qsslsocket_openssl_symbols. Change-Id: I9e4dccc0c576b26b3f629cee6e3245e707604674 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* Introduce QSslConfiguration::backendConfigLars Schmertmann2018-01-261-0/+16
| | | | | | | | With this change it is possible to use all supported configurations in different backends without any new interfaces. Change-Id: Ib233539a970681d30ae3907258730e491f8d3531 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSsl: use QT_CONFIG(feature) instead of hardcoded constantTimur Pocheptsov2017-11-071-1/+1
| | | | | | | | | | | The test OPENSSL_VERSION_NUMBER >= 0x1010000000L was introduced before 1.1 support. Now a couple of conditional inclusions can be converted into QT_CONFIG(opensslv11). Task-number: QTBUG-64275 Change-Id: I627e6b06f334deac70c827e463ecbfad879dfc24 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* Fix loadOpenSslWin32Timur Pocheptsov2017-09-211-0/+18
| | | | | | | | | The libraries are now 'libssl-1_1' and 'libcrypto-1_1', not 'ssleay32' or 'libeay32'. 64-bit versions also have -x64 suffix in their names. Task-number: QTBUG-62692 Change-Id: Ic15bf8f8271d0f6266cb9d2143e292ddba643ded Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* QSslSocket: OpenSSL 1.1 backendRichard J. Moore2017-07-041-184/+325
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch-set implements a new QSslSocket backend based on OpenSSL 1.1. 1. General. The code in this patch was organized to achieve these (somewhat contradicting) objectives: - keep the new code free of #if-ery, as far as possible; - make it easy to clean away dead code when we're eventually able to retire out-dated OpenSSL versions; - reduce the amount of code duplication. If changes in some file/component were insignificant (~5 one-liners per file), we still use pp-checks like: #if QT_CONFIG(opensslv11) ... #else ... #endif - the logic is simple and it's still easy to clean the code if we remove the legacy back-end. Where it saved #if-ery, we also introduced 'forward-compatible' macros implementing equivalents of 1.1 functions using older OpenSSL. In case some class contains a lot of version-specific ifdefs (particularly where nested #if-ery was complex) we choose to split code into: "pre11" h/cpp files, "shared" h/cpp files (they preserve their original names, e.g qsslsocket_openssl.cpp) and "11" h/cpp files. If in future we remove the legacy back-end, "pre11" should be removed; "shared" and "11" parts - merged. 2. Configuration. We introduced a new feature 'opensslv11' which complements the pre-existing 'openssl' and 'openssl-linked' features. The 'opensslv11' feature is enabled by a simple test which either compiles successfully or ends in a compilation error, depending on a value of the OPENSSL_VERSION_NUMBER constant. If the feature was enabled, we also append an additional compilation flag -DOPENSSL_API_COMPAT=0x10100000L to make sure our new code does not contain deprecated structures, function calls, macro-invocations from OpenSSL < 1.1. Change-Id: I2064efbe9685def5d2bb2233a66f7581954fb74a Reviewed-by: André Klitzing <aklitzing@gmail.com> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Merge remote-tracking branch 'origin/5.9' into devLiang Qi2017-05-291-1/+10
|\ | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf mkspecs/common/msvc-desktop.conf mkspecs/win32-g++/qmake.conf mkspecs/win32-icc/qmake.conf src/platformsupport/fontdatabases/mac/coretext.pri src/plugins/platforms/cocoa/qcocoawindow.h src/plugins/platforms/cocoa/qcocoawindow.mm Change-Id: I74a6f7705c9547ed8bbac7260eb4645543e32655
| * QSslSocket (OpenSSL) make supportsSsl return false, if v >= 1.1Timur Pocheptsov2017-05-211-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our OpenSSL backend allows missing symbols and in general protected from possible related failures. Unfortunately, for OpenSSL 1.1 this means not only missing symbols (removed functions), but new incompatible opaque data-structures and our 1.0 code trying to use them and probably accessing some data-members via macros - we end up in UB and crashes. SSLeay, which returns a version number, was removed in 1.1. A failure to resolve this symbol we consider as a version mismatch and we make 'supportsSsl' to return false. Task-number: QTCREATORBUG-18137 Change-Id: I5cd270f9c61a729105149779ee7277816f9467d7 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Merge remote-tracking branch 'origin/5.9' into devLiang Qi2017-03-201-7/+6
|\| | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qfilesystemengine_win.cpp src/gui/text/qdistancefield.cpp src/plugins/platforms/xcb/qxcbconnection.h Change-Id: I1be4a6f440ccb7599991159e3cb9de60990e4b1e
| * Use QT_CONFIG(library) instead of QT_NO_LIBRARYUlf Hermann2017-03-061-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | For the windows file system engine, we add an extra macro to use library loading if configured to do so, but avoid it on WinRT, as none of the symbols would be found. We also QT_REQUIRE_CONFIG(library) in the library headers and exclude the sources from the build if library loading is disabled. This, in turn, makes it necessary to clean up some header inclusions. Change-Id: I2b152cb5b47a2658996b6f4702b038536a5704ec Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io>
| * qsslsocket_openssl_symbols.cpp: Fix signedness warning in DEFINEFUNC2Friedemann Kleint2017-01-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Fix warning: qsslsocket_openssl_symbols.cpp157:78:warning: implicit conversion changes signedness: 'int' to 'unsigned long' note: expanded from macro 'DEFINEFUNC2' Amends change 2cf63c71ebe139890526057dcc51b24ea6df6c30 Change-Id: I694c5199d272d05f0070288af2e00b6fce42fc91 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> (cherry picked from commit 38a446b69e95423d8d42d33b30b3154caa475e09)
* | Workaround the broken 'OPENSSL_config' (Windows)Timur Pocheptsov2017-02-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | In old versions of OpenSSL this function can try to access a config file sometimes resulting in EACCES. While handling ENOENT correctly, OPENSSL_config unconditionally calls std::exit on EACCES, which is unacceptable, especially if we have a Qt-app which is not using SSL at all (but, for example, is using QNAM). To workaround this, we pre-test if this file can be opened and if not and the last error is ERR_R_SYS_LIB we just skip q_OPENSSL_add_all_algorithms call. Task-number: QTBUG-43843 Change-Id: I309172d3b5e7847f67a87ba33c406d4751bc60ca Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-23 19:29:25 +0000