summaryrefslogtreecommitdiffstats
path: root/src/network/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Fix QT_NO_DEBUG_STREAM buildRichard Moore2012-03-201-2/+1
| | | | | Change-Id: I640f93750583d36284f189fa12bac6440664a7a2 Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Use SSL_MODE_RELEASE_BUFFERS in QSslSocketMartin Petersson2012-03-092-0/+8
| | | | | | | | | | | | If SSL_MODE_RELEASE_BUFFERS is available we should tell OpenSSL to release memory early. http://www.openssl.org/docs/ssl/SSL_CTX_set_mode.html Task-number: QTBUG-14985 Change-Id: Ib6656ebb3c4d67ca868b317ee83ddbf0983953f9 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Shane Kearns <shane.kearns@accenture.com> Reviewed-by: Markus Goetz <markus@woboq.com>
* QtNetwork: blacklist two more certificatesMartin Petersson2012-03-081-0/+2
| | | | | | | | | | | The comodogate 72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0 certificate is a test certificate and the MD5 Collisions was created as a proof of concept deliberately made to be expired at the time of it's creation. Task-number: QTBUG-24654 Change-Id: Ic8eb417363569fe50bf19cd229658f5e371862f7 Reviewed-by: Richard J. Moore <rich@kde.org>
* QSslCertificate - make lazy initialisation thread safeShane Kearns2012-03-061-0/+9
| | | | | | | | | | | | | | | | | | | QSslCertificate can be copied around into multiple threads, without detaching. For example, the https worker threads inside QNetworkAccessManager. There are const methods, which lazily initialise members of the private class without detaching (i.e. caching results of expensive function calls) These functions now lock the d pointer using QMutexPool to avoid concurrency related crashes. autotest crashes 20% of the time in release builds without the fix, passes 100 times in a row with the fix. Task-number: QTBUG-20452 Change-Id: I64a01af8159216f2dd6215a08669890f6c029ca8 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Remove the usage of deprecated qdoc macros.Casper van Donderen2012-03-023-42/+42
| | | | | | | | | | | QDoc now has support for Doxygen style commands for italics, bold and list items. This change applies that change in QDoc to the actual documentation. Task-number: QTBUG-24578 Change-Id: I519bf9c29b14092e3ab6067612f42bf749eeedf5 Reviewed-by: Shane Kearns <shane.kearns@accenture.com> Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* QSslError: fix wrong #endif placementMarc Mutz2012-02-251-1/+1
| | | | | | | | This would break a namespaced Qt when QT_NO_DEBUG_STREAM was in effect. Unlikely to hit, but nevertheless fixworthy. Change-Id: Ie2a4cf4334a6a610c84233ab1ca89b928386c91a Reviewed-by: Richard J. Moore <rich@kde.org>
* QSslSocket::verify certificates when on-demand loading is usedMartin Petersson2012-02-231-0/+4
| | | | | | Task-number: QTBUG-24350 Change-Id: I5a328efe6606f5d438bb4787a5c02a425ce42aca Reviewed-by: Richard J. Moore <rich@kde.org>
* Test for QT_NO_SSL instead of QT_NO_OPENSSLShane Kearns2012-02-211-1/+1
| | | | | | | | Change the ifdefs in our own code (except openssl backend) to use the new configure flag. Change-Id: I8774734771c66b22164b5fae8fdb27814ac3df7b Reviewed-by: Richard J. Moore <rich@kde.org>
* Trivial doc fixRichard Moore2012-02-181-1/+1
| | | | | Change-Id: I9b63e0b63f225b245eec68ea4211cb0f2ccf9bb5 Reviewed-by: Sergio Ahumada <sergio.ahumada@nokia.com>
* Make sure to print short text for QSslCertifictaeExtension.Casper van Donderen2012-02-171-1/+2
| | | | | | Change-Id: If2471bea27f095352ae8c28604e104b896fd97c7 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Remove needless line "#define d d_ptr"Kent Hansen2012-02-151-2/+0
| | | | | | | | | | | | | | | | | | | There was a time when qsslsocket.h declared its private slots as Q_PRIVATE_SLOT(d, void _q_connectedSlot()) But now they are correctly declared as Q_PRIVATE_SLOT(d_func(), void _q_connectedSlot()) so the "#define d d_ptr" hack isn't needed. Specifically, the define would break moc-generated code that refers to the member d of a structure (which a future moc revision does, namely QByteArrayData::d). Change-Id: Ic94fa4d523fb17e8088973cfc0d090d5cce97267 Reviewed-by: Jonas Gastal <jgastal@profusion.mobi> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Fix unintended source compatiblity break in QSslSocketShane Kearns2012-02-021-0/+1
| | | | | | | | | | | QSslSocket overrides one version of QAbstractSocket::connectToHost. Since these functions were made virtual, this now hides the other overloads. Added a using statement to make the other overloads visible. Change-Id: Ia48fdc9bd67936c75c25bb24dabd26a723bb7a05 Reviewed-by: Stephen Kelly <stephen.kelly@kdab.com> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Don't include config.tests/unix/openssl/openssl.priBradley T. Hughes2012-02-021-4/+0
| | | | | | | This file was removed in commit ba9302b8a9b6b50f37987261c1ade9af2ade2d3c Change-Id: Ib3a70877f6f6848c8cf072faf13da93abbe186f2 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Prevent data loss when an ssl socket is closed by remoteShane Kearns2012-02-012-12/+22
| | | | | | | | | | | | SSL context was destroyed on disconnect. This makes it impossible to decrypt buffered encrypted data. So if there is encrypted data in the receive buffers, then don't destroy the ssl context until the socket is destroyed. Task-Number: QTBUG-23607 Change-Id: I16a7b4fa006647ec73049c90cdbc72686696850f Reviewed-by: Jonas Gastal <jgastal@profusion.mobi> Reviewed-by: Richard J. Moore <rich@kde.org>
* Windows: Fix inclusion of <windows.h>Friedemann Kleint2012-02-011-1/+1
| | | | | | | | | | | | | - Always use <qt_windows.h> as the last file to be included. - Remove it from some headers, use Qt::HANDLE instead of HANDLE. - Clean up #ifdef, use Q_OS_WIN for Windows/Windows CE. - Add NOMINMAX to qt_windows.h to avoid problems with the min/max macros. - Remove <windows.h> from qplatformdefs.h (VS2005) Change-Id: Ic44e2cb3eafce38e1ad645c3bf85745439398e50 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Joerg Bornemann <joerg.bornemann@nokia.com>
* Emit QSslSocket::error in case of openssl gives an error.Jonas M. Gastal2012-02-011-25/+32
| | | | | | | | | | | Create new QAbstractSocket::SocketError value that denotes a error in the SSL library: SslInternalError Create QAbstractSocket::SocketError value that denotes a error in data provided by user cauding an SSL library error: SslInvalidUserDataError Change-Id: I466a9389d9d7052efd8eddd1a2d6067ba26dfddb Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Shane Kearns <ext-shane.2.kearns@nokia.com>
* Removing bad ###Qt5 note.Jonas M. Gastal2012-01-311-1/+0
| | | | | | | | | Implementating this would cause massive SC breakage and give little gain. Change-Id: I56a6d302fdd0e8b53d1f9154f3eaf9e1ee429f9d Reviewed-by: Giuseppe D'Angelo <dangelog@gmail.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Make the pause modes a QFlags.Richard Moore2012-01-301-1/+1
| | | | | | | | | | | The intention is to add additional pause modes over time, this will be easier if we can just test if a particular reason for pausing is turned on. If we don't do this we'll end up having to check for each enum value every time we check what is enabled. Change-Id: I6b08f0e819b5593e3f6463c3dd175eff8625e155 Reviewed-by: Frederik Gladhorn <frederik.gladhorn@nokia.com> Reviewed-by: Shane Kearns <ext-shane.2.kearns@nokia.com>
* Remove "All rights reserved" line from license headers.Jason McDonald2012-01-3026-26/+26
| | | | | | | | | | As in the past, to avoid rewriting various autotests that contain line-number information, an extra blank line has been inserted at the end of the license text to ensure that this commit does not change the total number of lines in the license header. Change-Id: I311e001373776812699d6efc045b5f742890c689 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Making socketOption/setSocketOption virtual on QSslSocket.Jonas M. Gastal2012-01-281-3/+2
| | | | | | | | Per ### Qt5 comment and the fact that it was already virtual on QAbstractSocket. Change-Id: If2d2b2f9cdec1ef4c5bf625e3ce0d6f2d9a7bdfd Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Style fix for QSslCertificate constructor.Jonas M. Gastal2012-01-271-2/+1
| | | | | Change-Id: I1f128eb9f99ef4d25590bd034762cb8a0e68b075 Reviewed-by: Richard J. Moore <rich@kde.org>
* Removing ### that would cause needless SC brekage.Jonas M. Gastal2012-01-271-1/+1
| | | | | Change-Id: Iaa9cfd709c0ca4192760117ba5ec6d3992804d6a Reviewed-by: Richard J. Moore <rich@kde.org>
* QAbstractSocket / QSslSocket: add API to pause and resumePeter Hartmann2012-01-255-32/+111
| | | | | | | | | | | | | | | pause and resume is currently only supported upon emitting the QSslSocket::sslErrors() signal. The API was added in QAbstractSocket to also support QAbstractSocket::proxyAuthenticationRequired() in the future. This is the first patch to support that feature on the socket level, another patch will follow to support sslErrors() and authenticationRequired() in QNetworkAccessManager / QNetworkReply. Task-number: QTBUG-19032 Change-Id: Ide2918268590ab9a01454ab26cb7fdca3dc840ab Reviewed-by: Shane Kearns <ext-shane.2.kearns@nokia.com>
* Remove use of QT_MODULE from libraryGunnar Sletta2012-01-258-8/+0
| | | | | | | | | | These defines were there to aid in the commercial licensing scheme we used long ago, and are no longer needed. Keep a QT_MODULE(x) define so other modules continue compiling. Change-Id: I8fd76cd5270df8f14aee746b6cf32ebf7c23fec7 Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* Update contact information in license headers.Jason McDonald2012-01-2326-26/+26
| | | | | | | Replace Nokia contact email address with Qt Project website. Change-Id: I431bbbf76d7c27d8b502f87947675c116994c415 Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Remove unused QT_NO_TEXTSTREAM.David Faure2012-01-111-1/+1
| | | | | | | | It was checked in a few places, but it didn't actually remove QTextStream, so it was pretty useless. Change-Id: I8eaf28893cd6c7acbe1c0b69d58de90742aee755 Reviewed-by: João Abecasis <joao.abecasis@nokia.com>
* SSL - dump failed certificate chains when debug logging is enabledShane Kearns2012-01-091-0/+21
| | | | | | | | | | This is to help us debug problems with CA certificates. Code is not compiled by default, only when QtNetwork is built with QSSLSOCKET_DEBUG defined Change-Id: I404c36bf4c6bf1190f480196038197be30b4b5f9 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Make (dis)connectTo(From)Host virtual in QAbstractSocket.Jonas M. Gastal2012-01-092-10/+8
| | | | | Change-Id: Ib1dfae4031f00fb331108152a259f6a2756381c9 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Fix renewed SSL certificates being incorrectly reported as expiredShane Kearns2012-01-061-2/+2
| | | | | | | | | | | | | | | | OpenSSL tries certificates in the order they are added to the store. There was logic to add the expired certificates after the valid ones to ensure the valid certificate is checked first if the OS cert store contains both the expired and renewed version of the same cert (e.g. the verisign class 3 cert on windows) However due to a coding error, the ordering was reversed, ensuring the problem is always encountered instead of always avoided. Task-number: QTBUG-20012 Change-Id: I7c8dba8a09842540a22b44d33c7dcb22bbbc6a58 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Add a new QT_NO_SSL feature macro.Richard Moore2012-01-067-15/+15
| | | | | | | | | | | | | | | | | At the moment users of Qt must detect if it was compiled with SSL support by testing for QT_NO_OPENSSL. This means that any code that is conditionally compiled this way is tied to the presence of the openssl backend. This commit makes it possible to implement new SSL backends during the Qt5 lifetime without breaking this code. People can still test for QT_NO_OPENSSL if they really need openssl, but if they simply want to know if there's SSL support at all they should use this define instead. In addition, this commit changes the public API headers to use the new define. Change-Id: Ib57a71aa65836ac9351f120a487bfeb8009d9515 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* Make socket descriptors qintptr.Jonas M. Gastal2012-01-052-2/+2
| | | | | | | | | | Windows x64 uses 64 bits integer for sockets, to ensure compatibility we should use ptr sized integers for our socket descriptors. Task-number: QTBUG-19004 Change-Id: I4b56023874a4f1bad107c66c054fecfedde33d88 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
* Update copyright year in license headers.Jason McDonald2012-01-0523-23/+23
| | | | | Change-Id: I02f2c620296fcd91d4967d58767ea33fc4e1e7dc Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* Always load the openssl configuration.Richard Moore2012-01-031-4/+0
| | | | | | | | | | | | This change makes Qt load the default openssl config always, not just when compiled with OPENSSL_LOAD_CONF. This means that facilities like openssl engines (and their configuration) are usable. An alternative would be to call OPENSSL_config(NULL) ourselves, but that's exactly what the OPENSSL_add_all_algorithms_conf does for us. Task-number: QTBUG-16018 Change-Id: I4cda701f82627e0541b6225009f4e1249aec9d47 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Handle plain socket write errors in SSLShane Kearns2011-12-221-2/+9
| | | | | | | | | | | | | | When an ssl socket is closed during connecting, and it is using a proxy then it is possible for the plain socket to be in pending close state when transmit() is called. As errors were not handled, this caused the socket (and https request) to "hang". It now propagates the error from plain socket. Change-Id: I6fb86815a2a63e197cea582f4b153e487543477c Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* SSL: fix build with -openssl-linked for OpenSSL 0.9.8*Peter Hartmann2011-12-223-12/+0
| | | | | | | | | | | | | | | OpenSSL's SSL_ctrl() always took a "void *" argument as 4th parameter, since at least version 0.9.7. I have no idea why we had "const void *" in there. Reviewed-by: Richard J. Moore <rich@kde.org> Task-number: QTBUG-23132 (cherry picked from commit 4db91cbd6147e40f543342f22c05b7baddc52e5a) Change-Id: Ie570e1cc59b72f13d3e6f3ed6fc1892444a63743 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Robin Burchell <robin+qt@viroteck.net> Reviewed-by: Martin Petersson <Martin.Petersson@nokia.com>
* Remove unused member variables from private class.Richard Moore2011-12-121-2/+0
| | | | | | | These aren't used, and so they shouldn't be there. Change-Id: Id4a08d90836c45c140d811b8eca07756e14c56e5 Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Check we're connected before startClientEncryption()Richard Moore2011-12-071-0/+4
| | | | | | | | | The docs say this is required, but we don't check it and instead segfault right now. Change-Id: I825b00a312a481c5383af127333c0c4698188348 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* Make the default ssloptions testable.Richard Moore2011-11-292-2/+7
| | | | | | | | | Centralise the specification of the default ssloptions to make the code clearer and more testable. Change-Id: I4f4bae72736dd063ee4cd64c6375e82d0600a105 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* SSL certificate blacklist: reformat serial numbers to hexadecimalPeter Hartmann2011-11-251-10/+10
| | | | | | | | | | Since recently QSslCertificate::serialNumber() always returns the hexadecimal format, so we need to adapt to that when checking the serial numbers for the blacklisted certificates. Change-Id: I43bdb1be77faad7ad79a835c896fc39477452e75 Reviewed-by: Shane Kearns <shane.kearns@accenture.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* SSL: fix build when compiled with -openssl-linkedPeter Hartmann2011-11-252-0/+12
| | | | | | | | | ... and only resolve the functions when the methods are available. SSL 2 functionality is not always available in OpenSSL anymore. Change-Id: Ia3178685b26c67ac55447476789e06710b596181 Reviewed-by: Richard J. Moore <rich@kde.org> Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Removing unnecessary hidden property "_q_user-agent".Jonas M. Gastal2011-11-241-2/+0
| | | | | | | | | This property is no longer necessary because we can now set the user agent directly on the proxy. Task-number: QTBUG-17223 Change-Id: I27cb126dd401f02525290d2317650f55cae9f4ef Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
* Don't forward declare types form openssl in public headersLars Knoll2011-11-241-2/+0
| | | | | | | | | | There's no real reason for the typedef here, QtNetwork will compile without it and it might conflict with openssl. Change-Id: Id352ccc98d84ca9ee9ea3c7b4a942382882173f1 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com> Reviewed-by: Richard J. Moore <rich@kde.org>
* Improve the testability of QSslOptions.Richard Moore2011-11-172-29/+36
| | | | | | | | | | The handling of QSslOptions is complicated not only by the subject, but also by the fact that some of the openssl directives are negatives. This commit tries to separate the inherent complexity from the complexity of the api by allowing us to test them independently. Change-Id: Ieb9386c69dd9b0b49dc42e26b2878a301f26ded1 Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* SSL: fix compilation warning with gcc 4.6.1Peter Hartmann2011-11-161-1/+1
| | | | | | | | "qsslconfiguration.cpp:204:73: warning: suggest parentheses around comparison in operand of ‘|’ [-Wparentheses]" Change-Id: I887ffdf3ef8263c35a8f391b3fc97faee41b7dab Reviewed-by: Martin Petersson <Martin.Petersson@nokia.com>
* Fix Qt namespace compilation.Toby Tomkins2011-11-161-0/+2
| | | | | Change-Id: I259b5fde8e4d75d28def8650c4c9208accdf0bbe Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
* SSL namespace: rename TlsV1 to TlsV1_0Peter Hartmann2011-11-165-11/+14
| | | | | | | | | | | | This is a source-incompatible change. TlsV1 is ambiguous; what is actually meant is TLS version 1.0. There are also TLS versions 1.1 and 1.2; we might want to add options for these once OpenSSL supports them (apparently they will be with OpenSSL version 1.0.1). Change-Id: I940d020b181b5fa528788ef0c3c47e8ef873796a Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* Add the ability to do unsafe SSL renegotiation as a fallback.Richard Moore2011-11-155-4/+20
| | | | | | | | | | | This commit adds the ability to perform legacy SSL renegotiation as a fallback via QSsl::SslOptions. This is something that used to work, but has been disabled by default in newer versions of openssl. The need for this has been reported by users (eg. in QTBUG-14983). Change-Id: I5b80f3ffd07e0c5faddc469f6a8f857bac5740f7 Reviewed-by: Corentin Chary <corentin.chary@gmail.com> Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* Always use the hex format for certificate serial numbers.Richard Moore2011-11-151-16/+8
| | | | | | | | | In Qt 4.x the serial number is reported by a mixture of the hex value and the number, The hex is what is used by other tools, and we should do the same. Change-Id: Ia0361d43fb5b920d053c95e932e0c8a012436e5e Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
* network: remove Symbian specific codePeter Hartmann2011-11-145-433/+5
| | | | | | | | removes several files and cleans up the code, removing all Symbian specific #ifdef's etc. Change-Id: Ie457e54cb4b3a992f251383320d47822259c38f1 Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
* Deprecate QSslCertificate::isValid() replace with isBlacklisted()Richard Moore2011-11-143-14/+30
| | | | | | | | | | | Currently isValid wrongly gives the impression it checks a certificate for validity - it doesn't. It merely checks if the certificate dates are valid and if the certificate is blacklisted. Since it's already easy for users to check the dates, let's just give them access to the ability to check for blacklisting. Change-Id: I25be3bde6a01063034702a9574b28469bf4882cd Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-14 09:50:15 +0000