summaryrefslogtreecommitdiffstats
path: root/src/network/ssl/qsslsocket_openssl_symbols.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Move plugin code from QtNetwork to qtbase/pluginsTimur Pocheptsov2021-04-221-1234/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All TLS (and non-TLS) backends that QSsl classes rely on are now in plugins/tls (as openssl, securetransport, schannel and certonly plugins). For now, I have to disable some tests that were using OpenSSL calls - this to be refactored/re-thought. These include: qsslsocket auto-test (test-case where we work with private keys), qsslkey auto-test (similar to qsslsocket - test-case working with keys using OpenSSL calls). qasn1element moved to plugins too, so its auto-test have to be re-thought. Since now we can have more than one working TLS-backend on a given platform, the presence of OpenSSL also means I force this backend as active before running tests, to make sure features implemented only in OpenSSL-backend are tested. OCSP auto test is disabled for now, since it heavily relies on OpenSSL symbols (to be refactored). [ChangeLog][QtNetwork][QSslSocket] QSslSocket by default prefers 'openssl' backend if it is available. [ChangeLog][QtNetwork][QSslSocket] TLS-backends are not mutually exclusive anymore, depending on a platform, more than one TLS backend can be built. E.g., configuring Qt with -openssl does not prevent SecureTransport or Schannel plugin from being built. Fixes: QTBUG-91928 Change-Id: I4c05e32f10179066bee3a518bdfdd6c4b15320c3 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSsl: fix OpenSSL DLL names for Windows on ARMCameron Gutman2021-01-191-5/+9
| | | | | | | | | | | OpenSSL adds an '-arm'/'-arm64' suffix to the DLL names when building for VC-WIN32-ARM or VC-WIN64-ARM. This needs to be accounted for in Qt to find the OpenSSL DLLs correctly. Fixes: QTBUG-89647 Pick-to: 5.15 Change-Id: Ibc9b81e06f8e64c0676f335e13024fa7fe3a4fa3 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Replace qt_make_unique with std::make_uniqueAllan Sandfeld Jensen2020-11-231-4/+3
| | | | | | | We can depend on C++14 now. Change-Id: Iee9796cd22dbfbb70d4bdb25f0eee1662a026d6d Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* QSsl: workaround a 'very secure' OpenSSL version (CentOS 8.x et al)Timur Pocheptsov2020-09-121-0/+4
| | | | | | | | | | | | | CentOS it seems not only backported some OpenSSL 3 functions, but also raised the default security level to 2, making some of our keys (and MDs?) 'too weak' and failing auto-tests here and there as a result. For our auto-test we lower the level to 1, as it is expected to be. Fixes: QTBUG-86336 Pick-to: 5.15 Change-Id: I7062a1b292e8b60eb9c2b2e82bd002f09f9da603 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSslSocket (OpenSSL) - fix a minor type errorTimur Pocheptsov2020-07-281-1/+1
| | | | | | Change-Id: I76bf6c7d47c7d29228837bbb139a7f6a32de0e5e Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QSslCertificate: remove manual parsing code for ASN.1 (on OpenSSL)Giuseppe D'Angelo2020-07-171-104/+7
| | | | | | | | OpenSSL 1.1.1 has a convenient function for parsing ASN.1 times; use that instead of the hand-rolled code. Change-Id: Ic0aecc915f362c02b220819305f3f3c347a75297 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Use QList instead of QVector in networkJarek Kobus2020-06-261-2/+2
| | | | | | Task-number: QTBUG-84469 Change-Id: I7827da68e73ca8ff1e599c836f2157894c452b63 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Port QtNetwork from QStringRef to QStringViewLars Knoll2020-06-101-4/+4
| | | | | | | | Task-number: QTBUG-84319 Change-Id: I0f4e83c282b58ab4cc5e397b21981978f79d92cf Reviewed-by: Alex Blasche <alexander.blasche@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSsl: port a local QStringList to QDuplicateTrackerMarc Mutz2020-06-081-4/+5
| | | | | | | | | | | | Apart from a more fitting, minimal, API, QDuplicateTracker also transparently uses C++17 pmr::monotonic_buffer_resource to avoid, or at least reduce, memory allocations. The code is the first user of the collected data, so make that available by adding QDuplicateTracker::appendTo(Container&) methods. Change-Id: Ibd8810c0070db7e6b3ead6d6a569facdab88b646 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Make OpenSSL back-end work with 3.0 alphaTimur Pocheptsov2020-05-201-0/+20
| | | | | | | | | | | | | | DSA/DH/etc _bits functions were first deprecated, then un-deprecated, so we don't worry about them for now. SSL_CTX_load_verify_location was deprecated and two new functions were introduced instead (one using file, the second - path). It's unfortunately 3.0 only, so we have to check OpenSSL version. DH_check is deprecated and we have to use EVP_PKEY_param_check with tons of a boilerplate code around. Fixes: QTBUG-83733 Pick-to: 5.15 Change-Id: Icd401ab6aad30c23c37443c7bc82c702fb843640 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-04-221-0/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: src/widgets/widgets/qabstractbutton.cpp src/widgets/widgets/qbuttongroup.cpp src/widgets/widgets/qbuttongroup.h src/widgets/widgets/qsplashscreen.cpp tests/auto/widgets/widgets/qbuttongroup/tst_qbuttongroup.cpp tests/benchmarks/opengl/main.cpp Needed update: src/plugins/platforms/cocoa/CMakeLists.txt Change-Id: I7be4baebb63844ec2b3e0de859ca9de1bc730bb5
| * OpenSSL: handle SSL_shutdown's errors properlyTimur Pocheptsov2020-04-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | Do not call SSL_shutdown on a session that is in handshake state (SSL_in_init(s) returns 1). Also, do not call SSL_shutdown if a session encountered a fatal error (SSL_ERROR_SYSCALL or SSL_ERROR_SSL was found before). If SSL_shutdown was unsuccessful (returned code != 1), we have to clear the error(s) it queued. Fixes: QTBUG-83450 Change-Id: I6326119f4e79605429263045ac20605c30dccca3 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-04-081-1/+17
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: examples/opengl/doc/src/cube.qdoc src/corelib/global/qlibraryinfo.cpp src/corelib/text/qbytearray_p.h src/corelib/text/qlocale_data_p.h src/corelib/time/qhijricalendar_data_p.h src/corelib/time/qjalalicalendar_data_p.h src/corelib/time/qromancalendar_data_p.h src/network/ssl/qsslcertificate.h src/widgets/doc/src/graphicsview.qdoc src/widgets/widgets/qcombobox.cpp src/widgets/widgets/qcombobox.h tests/auto/corelib/tools/qscopeguard/tst_qscopeguard.cpp tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp tests/benchmarks/corelib/io/qdiriterator/qdiriterator.pro tests/manual/diaglib/debugproxystyle.cpp tests/manual/diaglib/qwidgetdump.cpp tests/manual/diaglib/qwindowdump.cpp tests/manual/diaglib/textdump.cpp util/locale_database/cldr2qlocalexml.py util/locale_database/qlocalexml.py util/locale_database/qlocalexml2cpp.py Resolution of util/locale_database/ are based on: https://codereview.qt-project.org/c/qt/qtbase/+/294250 and src/corelib/{text,time}/*_data_p.h were then regenerated by running those scripts. Updated CMakeLists.txt in each of tests/auto/corelib/serialization/qcborstreamreader/ tests/auto/corelib/serialization/qcborvalue/ tests/auto/gui/kernel/ and generated new ones in each of tests/auto/gui/kernel/qaddpostroutine/ tests/auto/gui/kernel/qhighdpiscaling/ tests/libfuzzer/corelib/text/qregularexpression/optimize/ tests/libfuzzer/gui/painting/qcolorspace/fromiccprofile/ tests/libfuzzer/gui/text/qtextdocument/sethtml/ tests/libfuzzer/gui/text/qtextdocument/setmarkdown/ tests/libfuzzer/gui/text/qtextlayout/beginlayout/ by running util/cmake/pro2cmake.py on their changed .pro files. Changed target name in tests/auto/gui/kernel/qaction/qaction.pro tests/auto/gui/kernel/qaction/qactiongroup.pro tests/auto/gui/kernel/qshortcut/qshortcut.pro to ensure unique target names for CMake Changed tst_QComboBox::currentIndex to not test the currentIndexChanged(QString), as that one does not exist in Qt 6 anymore. Change-Id: I9a85705484855ae1dc874a81f49d27a50b0dcff7
| * Merge remote-tracking branch 'origin/5.14' into 5.15Mitch Curtis2020-03-201-1/+17
| |\ | | | | | | | | | Change-Id: Ib2a2e3a292af43be3a980c2ccc943c08f4bbf72f
| | * q_getTimeFromASN1: fix invalid accessTimur Pocheptsov2020-03-191-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | No sanitizer is needed, just looking at the code is enough. It was wrong. Change-Id: I9df417c137d6b3361c3161865e099a8be40860de Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
| | * Fix symbol resolving for OPENSSL_NO_NEXPROTONEGTimur Pocheptsov2020-02-051-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our ALPN-related definitions were conditioned both on OPENSSL_NO_NEXTPROTONEG and OpenSSL version (since ALPN first was introduced in 1.0.2), but resolving was only under version check, not OPENSSL_NO_NEXTPROTONEG. This went unnoticed for many years, and was found only recently with OpenSSL built with no-nexprotoneg. Fixes: QTBUG-81762 Change-Id: I7afca0b2034a234a19b5bcdefd3ce26f4202cddb Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Merge remote-tracking branch 'origin/5.15' into devQt Forward Merge Bot2020-03-031-2/+2
|\| | | | | | | | | | | Change-Id: If36d96c0fef3de5ab6503977501c55c62a2ecc97
| * | Use Qt::SplitBehavior in preference to QString::SplitBehaviorEdward Welbourne2020-02-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The Qt version was added in 5.14 "for use as eventual replacement for QString::SplitBehavior." Move another step closer to that goal. Change-Id: I399b5ea56e9255e775ca1746632f7421519a6616 Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* | | Merge remote-tracking branch 'origin/5.15' into devLiang Qi2020-02-131-0/+4
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: examples/widgets/graphicsview/boxes/scene.h src/corelib/Qt5CoreMacros.cmake src/corelib/Qt6CoreMacros.cmake src/network/ssl/qsslsocket.cpp src/network/ssl/qsslsocket.h src/platformsupport/fontdatabases/windows/qwindowsfontenginedirectwrite.cpp src/testlib/CMakeLists.txt src/testlib/.prev_CMakeLists.txt tests/auto/corelib/tools/qscopeguard/tst_qscopeguard.cpp Disabled building manual tests with CMake for now, because qmake doesn't do it, and it confuses people. Done-With: Alexandru Croitor <alexandru.croitor@qt.io> Done-With: Volker Hilsheimer <volker.hilsheimer@qt.io> Change-Id: I865ae347bd01f4e59f16d007b66d175a52f1f152
| * | Implement/fix session resumption with TLS 1.3Timur Pocheptsov2020-01-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The session we cache at the end of a handshake is non-resumable in TLS 1.3, since NewSessionTicket message appears quite some time after the handshake was complete. OpenSSL has a callback where we can finally obtain a resumable session and inform an application about session ticket updated by emitting a signal. Truism: OpenSSL-only. [ChangeLog][QtNetwork] A new signal introduced to report when a valid session ticket received (TLS 1.3) Fixes: QTBUG-81591 Change-Id: I4d22fad5cc082e431577e20ddbda2835e864b511 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | QSslSocket (OpenSSL) improve alert messages handlingTimur Pocheptsov2019-12-031-1/+7
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Add a new verification callback. This gives an option to report errors directly from this callback (by emitting handshakeInterruptedOnError()). This allows an application to explain to its peer why the handshake was interrupted (by sending a corresponding alert message). 2. This also means we want to notice such alerts (in Qt, from the application's point of view, they are mostly informational only, no interaction is required). So we also introduce a new 'info callback', that can notice alert messages read or written. We also introduce two new enums describing the level and type of an alert message. QSslSocket gets three new signals (for incoming/outgoing alerts and verification errors found early). 3. In case we requested a certificate, but the peer provided none, we would previously abruptly close the connection without a proper alert message (and such a situation is not handled by any verification callbacks, since there is no certificate(s) to verify essentially). So we now introduce a new verification option that maps to what OpenSSL calls 'SSL_VERIFY_FAIL_IF_NO_PEER_CERT'. This way, the proper alert will be generated. Fixes: QTBUG-68419 Change-Id: I5d1e9298b4040a2d4f867f5b1a3567a2253927b8 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* / QSslSocket - remove old OpenSSL backend (< 1.1)Timur Pocheptsov2019-11-011-285/+40
|/ | | | | | | | | | | | | | OpenSSL 1.0.2 will stop receiving all support at the end of 2019. Qt 5.15 is our next LTS thus makes sense remove OpenSSL 1.0.2 support there. This also allows us quite a significant cleanup of an old heavily if-defed code and all 'pre11' suffixed source files. [ChangeLog][QtNetwork][SSL] Removed OpenSSL 1.0.x support, now 1.1.x is required Change-Id: I70c70c56cbd8aeff793afe793335696d1b1b7408 Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* Merge remote-tracking branch 'origin/5.13' into devLiang Qi2019-07-301-0/+17
|\ | | | | | | | | | | | | Conflicts: qmake/generators/win32/mingw_make.cpp Change-Id: I2f790bc8572bd22fea01edf7ca74595b29f063eb
| * Merge remote-tracking branch 'origin/5.12' into 5.13Qt Forward Merge Bot2019-07-291-0/+17
| |\ | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qresource.cpp Change-Id: I54917f72444a621bd08aeaa15f5d17415993144d
| | * Android: Fix SSL 1.1 support on API-21BogDan Vatra2019-07-261-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.x libs must be suffixed otherwise it will use the system ones which on API-21 are OpenSSL 1.0 not 1.1 Fixes: QTBUG-76884 Change-Id: I7d4052be68cf7dc65f74a48da8e1e37182056a5e Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
| * | Merge remote-tracking branch 'origin/5.12' into 5.13Liang Qi2019-06-251-0/+10
| |\| | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/io/qstorageinfo_unix.cpp src/network/ssl/qsslsocket_openssl.cpp Change-Id: Ibc9ce799bef62d60d616beaa9fbde8ebeadfbc20
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackMårten Nordheim2019-06-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Reviewed-by: Simo Fält <simo.falt@qt.io> (cherry picked from commit d8efc8d718e3b3a0464f321e740541f5b221a5d6) Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | qsslsocket_openssl_symbols.cpp: replace manual memory management with ↵Marc Mutz2019-07-101-51/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | std::unique_ptr Also fix the name mismatch between the Windows- and non-Windows versions of loadOpenSsl(), which, presumably, were caused by having two different return values, something easily fixed by defining a small struct instead of using a QPair. Some #ifdef'ery saved, and a lot of brittle deletes on early returns. Change-Id: I77440de2f6fa51759510506ff4ef51917eb5b3ea Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | qsslsocket_openssl_symbols.cpp: replace mutex pool use with QBasicMutexMarc Mutz2019-07-081-14/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The use of QMutexPool caused an #ifdef, because, lacking an object, some OpenSSL function pointer was used as the address required as input for the mutex pool. Sadly, the names of the functions differ between OpenSSL versions, thus the need for an #ifdef. By simply using a QBasicMutex (defined at namespace scope to evade https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79561), the #ifdef can go away. Another level of #ifdefs goes away because, even for non-QT_CONFIG(thread) builds, Q*Mutex etc are defined, just as no-ops. So we can freely use them without QT_CONFIG(thread) guard, unlike QMutexPool. Finally, optimize for the (common?) case of already-loaded libraries by making symbolsResolved an atomic variable, and checking that before taking the mutex (double-checked locking, done right). For reasons of said GCC bug, again, the QBasicAtomic is defined at namespace scope. And then move the other boolean there for symmetry. Change-Id: Ic5f44871fb200e5368b9af327e4d1e852fbc586c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2019-06-251-0/+12
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/gui/painting/qdrawhelper.cpp src/gui/text/qdistancefield.cpp src/gui/text/qdistancefield_p.h src/network/ssl/qsslsocket_openssl.cpp src/plugins/platforms/android/qandroidinputcontext.cpp src/widgets/styles/qstylesheetstyle.cpp Done-With: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: Ia7daad21f077ea889898f17734ec46303e71fe6b
| * | TLS socket: make verification callback lock-free (OpenSSL)Timur Pocheptsov2019-06-171-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When our QSslSocketBackendPrivate (OpenSSL backend) was developed, the ancient versions of OpenSSL did not have an API needed to pass an application-specific data into verification callback. Thus the developers resorted to the use of global variables (a list with errors) and locks. Some of our auto-tests use QNAM and in-process server. Whenever the client (essentially qhttpthreadeddelegate) and the server live in different threads, any use of 'https' is dead-lock prone, which recent events demonstrated and which were previously observed but not understood properly (rare occasions, not always easy to reproduce). Now we fix this for good by removing locking. There are two places (in 5.12) where these locks are needed: 1. Before calling SSL_connect/SSL_accept (handshake) - here we reuse the same trick we do in PSK callback ('SSL' has an external data set, and it's 'this', meaning an object of type QSslSocketBackendPrivate). 2. The static member function 'verify', here we do not have 'SSL', but we have our temporary 'X509_STORE', to which we can directly attach an external data - a pointer to a vector to collect verification errors. Note, this change assumes that OpenSSL Qt is build/linked against is at least of version 1.0.1 - we set external data on SSL unconditionally (no version checks). Fixes: QTBUG-76157 Change-Id: I05c98e77dfd5fb0c2c260fb6c463732facf53ffc Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
| * | QSslSocket: add and set the TLSv1.3-specific PSK callbackv5.12.4Mårten Nordheim2019-06-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If this callback is not set then OpenSSL will call the callback used for <= TLS 1.2 unconditionally when connecting. If using PSK it will call it again later once the preshared key is needed. We don't currently handle the TLSv1.3 PSK, but we definitely should. But for now we can work around it - when psk_use_session_callback is called we simply change the PSK callback to a dummy function whose only purpose is to restore the old callback. This is mostly done to keep behavior the same as it is now for users (and to keep our tests running). Later we can add a new signal and handle this new feature properly. Task-number: QTBUG-67463 Change-Id: I4aca4ae73ec4be7c4f82a85e8864de103f35a834 Reviewed-by: Simo Fält <simo.falt@qt.io>
* | | Deprecate conversion functions between QList and QSetLars Knoll2019-05-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users should use range constructors instead to do the conversion. Keep conversion methods between QList and QVector as these will turn into a no-op in Qt 6, whereas forcing people to use range constructors would lead to deep copies of the data. Change-Id: Id9fc9e4d007044e019826da523e8418857c91283 Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
* | | tst_qsslkey: test AES encryption in the 'encrypt' testMårten Nordheim2019-03-261-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | And export the required symbols in OpenSSL so we can run the test there as well even if it's not needed for any functionality. Change-Id: I4246d2b0bbdd42079d255f97f3c66ce8bb37390b Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Extend the test for QSslKeyLars Schmertmann2019-03-021-0/+4
| |/ |/| | | | | | | | | | | | | | | | | Check if QSslKey::handle() returns data representing the same key information as that passed to the constructor. Task-number: QTBUG-64495 Change-Id: I1a91264e6f6d92d259b51fca9de00fcbfd5cc845 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: remove some more pre-1.0 fallbacksGiuseppe D'Angelo2018-12-141-31/+0
| | | | | | | | | | | | | | | | Again, 1.0 is required now. Change-Id: Icca5dc38eb33c1579653d96d6c079b335a401aad Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | OpenSSL: drop support for SSLv2 and SSLv3Giuseppe D'Angelo2018-12-131-36/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 6176 (2011) and RFC 7568 (2015). Code-wise, we're left with the decision of what to do with a few enumerators in QSsl::Protocol; I've made TlsV1SslV3 act as TlsV1, and adjusted the description of AnyProtocol. A new test was introduced - deprecatedProtocol() - to test that we, indeed, do not allow use of SSL v2 and v3. protocol() and protocolServerSide() were reduced to exclude the (now) no-op and meaningless tests - neither client nor server side can start a handshake now, since we bail out early in initSslContext(). [ChangeLog][QtNetwork][SSL] Support for SSLv2 and SSLv3 sockets has been dropped, as per RFC 6176 (2011) and RFC 7568 (2015). Change-Id: I2fe4e8c3e82adf7aa10d4bdc9e3f7b8c299f77b6 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge remote-tracking branch 'origin/5.12' into devQt Forward Merge Bot2018-12-111-9/+18
|\| | | | | | | Change-Id: I91e684e74c36467efda8ded6ed19791baa0c1a1f
| * Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-12-101-9/+18
| |\ | | | | | | | | | Change-Id: If49df791f73e9edf616baa094e0f301a44cb853d
| | * OpenSSL: also try the "1.0.2" sonameGiuseppe D'Angelo2018-11-291-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Turns out that also Debian patches OpenSSL 1.0, changing its soname to "1.0.2". Therefore, try also to load that one. Amends 2708c6c11d685ab25c12d558961d924c9a4533d2. Task-number: QTBUG-68156 Change-Id: I37cc060e90422779a6c29a324ab900f0fb99cfa7 Reviewed-by: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | Add tst_QOcsp auto-testTimur Pocheptsov2018-12-061-1/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a private 'API' to enable server-side OCSP responses and implements a simple OCSP responder, tests OCSP status on a client side (the test is pretty basic, but for now should suffice). Change-Id: I4c6cacd4a1b949dd0ef5e6b59322fb0967d02120 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Enable OCSP stapling in QSslSocketTimur Pocheptsov2018-12-031-1/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables OCSP stapling in QSslSocket::SslClientMode (OpenSSL back-end only). OCSP stapling is described by RFC6066 and based on the original OCSP as defined by RFC2560. At the moment multiple certificate status protocol is not supported (not implemented in OpenSSL). SecureTransport does not support OCSP stapling at the moment. [ChangeLog][QtNetwork][TLS] Added OCSP-stapling support for OpenSSL backend Task-number: QTBUG-12812 Task-number: QTBUG-17158 Change-Id: Id2e0f4cc861311d1ece462864e5e30c76184af8c Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devQt Forward Merge Bot2018-11-271-0/+2
|\| | | | | | | | | | | Change-Id: I04afffdce6b78856d0301eb583f21d334c7466b0
| * | Fix build errors in OpenSSL 1.1 backendTimur Pocheptsov2018-11-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | SSL_CTX_set_ciphers is new in 1.1.1. Task-number: QTBUG-71983 Change-Id: If0ae9f95dcc867c62ed0d3a6a60c22c7f5e1cc9f Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | Add support for Diffie-Hellman keys to QSslKeyLars Schmertmann2018-11-231-0/+8
|/ / | | | | | | | | | | | | | | | | | | | | | | This is necessary to provide details for the key too, when the server is using DHE-RSA-AESxxx-SHAxxx. Amends 7f77dc84fb434f33ffe96f6633792706b80fb0a3. Change-Id: I8ab15b6987c17c857f54bc368df3c6c1818f428c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Add missing protocol enumerators, report TLS 1.3 if negotiatedTimur Pocheptsov2018-11-071-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Remove the conditional inclusion of DTLS versions, they made difficult and unnecessary ugly adding new protocols (something like TlsV1_2OrLater + 4). 2. OpenSSL 1.1.1 first introduced TLS 1.3 support. OpenSSL 1.1 back-end is compatible with OpenSSL 1.1.1, but would fail to extract/report protocol versions and set versions like 'TLS 1.3 only' or 'TLS 1.3 or better' on a new context. Given 1.1.1 is deployed/adapted fast by different distros, and 5.12 is LTS, we fix this issue by introducing QSsl::Tls1_3 and QSsl::Tls1_3OrLater. SecureTransport, WinRT and OpenSSL below 1.1.1 will report an error in case the application requests this protocol (SecureTransport in future will probably enable TLS 1.3). Saying all that, TLS 1.3 support is experimental in QSslSocket. Done-by: Albert Astals Cid <albert.astals.cid@kdab.com> Done-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Change-Id: I4a97cc789b62763763cf41c44157ef0a9fd6cbec Reviewed-by: Lars Knoll <lars.knoll@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-10-211-0/+23
|\| | | | | | | Change-Id: Iaf28977e7ecf566b28b9406dcb005d48621169c2
| * OpenSSL: force the "1.0.0" soname when loading OpenSSL 1.0Giuseppe D'Angelo2018-10-191-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some Linux distributions patch OpenSSL's soname, making builds on such distributions not deployable elsewhere. The problem is that the code loading OpenSSL symbols would attempt to use the soname of the build machine, and therefore not finding the OpenSSL libraries on the deploy system. The binary builds of Qt for Linux are affected by this problem, as they build under RHEL7.4 which changes to soname of OpenSSL to a non-standard string. This makes the binary builds not pick up OpenSSL 1.0 from the machine where the build gets installed on. Given that in the pre-1.1 versions only the 1.0 series is supported, bump the minimum requirement of Qt to that. The 1.0.x releases (up to 1.0.2, at the time of this writing) have kept binary compatibility, and advertise a soname of "1.0.0", which is used by most distributions. So, if loading of OpenSSL with the build-time soname fails, try to load them with the "1.0.0" hardcoded soname. [ChangeLog][QtNetwork][SSL] OpenSSL >= 1.0 is now required to build Qt with OpenSSL support. Task-number: QTBUG-68156 Change-Id: Ieff1561a3c1d278b511f09fef06580f034f188c6 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | wasm: enable Network for nothreadLorn Potter2018-09-281-0/+4
| | | | | | | | | | | | | | Task-number: QTBUG-70208 Change-Id: Ib73ca0d3c0736336bf517ffb968cbdbab4610319 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
* | Modernize the "thread" featureUlf Hermann2018-08-171-2/+0
| | | | | | | | | | | | | | | | | | | | Add it to configure.json and replace all occurrences of QT_NO_THREAD with QT_CONFIG(thread). Add conditions for other features that depend on thread support. Remove conditions where we can use the QMutex and QThreadStorage stubs. Change-Id: I284e5d794fda9a4c6f4a1ab29e55aa686272a0eb Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-01 21:16:13 +0000