summaryrefslogtreecommitdiffstats
path: root/src/network/ssl
Commit message (Collapse)AuthorAgeFilesLines
...
* | | | Ssl: Windows: Don't load Crypt32 symbols on runtimeMårten Nordheim2018-11-164-65/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have linked against Crypt32 for a while. Change-Id: I7ec9401a63d7405e4b5357d6589501e997e31aca Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | | Merge remote-tracking branch 'origin/5.12' into devQt Forward Merge Bot2018-11-063-4/+9
|\| | | | | | | | | | | | | | | Change-Id: Id1e4664d3c942226b76e2c3b338df3116ff89297
| * | | Fix supportsSsl() to make it more consistentTimur Pocheptsov2018-11-023-4/+9
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Attempts to use QSslSocket and its OpenSSL 1.1 back-end with OpenSSL 1.1.1 in a very peculiar way (for some reason the reporter calls OPENSSL_no_config()) combined with a bug in OpenSSL 1.1.1 resulted in a QSslSocket dead-locking in initialization. This was happening because supportsSsl() first reported false (OpenSSL internally fails to initialize after OPENSSL_no_config()), but we have s_libraryLoaded set to true too early, thus the first supportsSsl() returns false, the second - true. Move setting of s_libraryLoaded later so that we don't claim to support OpenSSL when an earlier ensureLibraryLoaded() attempt failed. Task-number: QTBUG-70956 Task-number: QTBUG-71446 Change-Id: I8ad8763d357c84fc38c62e2ce914366367c2b445 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | doc: Let qdoc parse qdtls.h even without dtlsMartin Smith2018-10-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This update removes the requirement for dtls to be present when qdoc runs so that qdoc can parse qdtls.h. _#ifndef Q_CLANG_QDOC QT_REQUIRE_CONFIG(dtls); _#endif Change-Id: I69ba5e378bebe86f93830d14e3956eb0d677508e Reviewed-by: Martin Smith <martin.smith@qt.io>
* | | Merge remote-tracking branch 'origin/5.12' into devLiang Qi2018-10-253-17/+29
|\| | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/animation/qpropertyanimation.cpp src/gui/image/qicon.cpp tests/auto/widgets/itemviews/qtableview/tst_qtableview.cpp Change-Id: I3698172b7b44ebb487cb38f50fd2c4a9f8a35b21
| * | Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-10-211-0/+23
| |\| | | | | | | | | | Change-Id: Iaf28977e7ecf566b28b9406dcb005d48621169c2
| | * OpenSSL: force the "1.0.0" soname when loading OpenSSL 1.0Giuseppe D'Angelo2018-10-191-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some Linux distributions patch OpenSSL's soname, making builds on such distributions not deployable elsewhere. The problem is that the code loading OpenSSL symbols would attempt to use the soname of the build machine, and therefore not finding the OpenSSL libraries on the deploy system. The binary builds of Qt for Linux are affected by this problem, as they build under RHEL7.4 which changes to soname of OpenSSL to a non-standard string. This makes the binary builds not pick up OpenSSL 1.0 from the machine where the build gets installed on. Given that in the pre-1.1 versions only the 1.0 series is supported, bump the minimum requirement of Qt to that. The 1.0.x releases (up to 1.0.2, at the time of this writing) have kept binary compatibility, and advertise a soname of "1.0.0", which is used by most distributions. So, if loading of OpenSSL with the build-time soname fails, try to load them with the "1.0.0" hardcoded soname. [ChangeLog][QtNetwork][SSL] OpenSSL >= 1.0 is now required to build Qt with OpenSSL support. Task-number: QTBUG-68156 Change-Id: Ieff1561a3c1d278b511f09fef06580f034f188c6 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
| * | Merge remote-tracking branch 'origin/5.11' into 5.12Liang Qi2018-10-171-0/+4
| |\| | | | | | | | | | | | | | | | | | | | | | Conflicts: src/plugins/platformthemes/platformthemes.pro src/printsupport/kernel/qplatformprintdevice.cpp Change-Id: Iac01729ad954bb1c7af5867d982eb243b2139ee6
| | * Ssl: Fix contrived crash when calling resumeMårten Nordheim2018-10-101-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you, directly after connecting, call "ignoreSslErrors()" followed by "resume()" then you will most likely crash. It is very contrived and there's no reason to do this. Change-Id: I949a303238f5012296d0e84eb76173764eb9de2e Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
| * | Doc: Move literal code block to a separate fileCristian Maureira-Fredes2018-10-151-17/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to override this snippet for the documentation we generate for Qt for Python, and it is easier to have it on a separate file. Task-number: PYSIDE-801 Task-number: PYSIDE-691 Change-Id: Ideb5b6af25024279f167137d3b65660bb9c96a7e Reviewed-by: Topi Reiniö <topi.reinio@qt.io>
* | | Ssl: move _q_makePkcs12 into shared fileMårten Nordheim2018-10-164-263/+315
|/ / | | | | | | | | | | | | | | | | | | It's needed to generate a pkcs12/pfx bundle from our certificate chains which are then imported into a certificate store in Schannel and then passed to various Schannel API. Change-Id: Idb88f42f2aa15eb91c52404ee6c57bf43e983379 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-10-081-0/+4
|\| | | | | | | | | | | | | Conflicts: src/corelib/tools/qtimezoneprivate.cpp Change-Id: Icbb5999d378711ce3786a4fe0aba176a45ac702c
| * Doc: Describe behavior of QSslConfiguration::caCertificates() on iOSLeena Miettinen2018-10-041-0/+4
| | | | | | | | | | | | | | | | | | | | In iOS, the system certificates cannot be accessed, so this function will return an empty list for the default configuration. Task-number: QTBUG-60407 Change-Id: I0d691a0dd5e6367594e71c7ebccfbdc866d4a3f0 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Andy Shaw <andy.shaw@qt.io>
* | Merge remote-tracking branch 'origin/5.11' into 5.12Qt Forward Merge Bot2018-09-301-1/+6
|\| | | | | | | Change-Id: Iaa438d14357be1bf75bb645cb8d3245947c055b8
| * SSL: Don't write to closed socket or write to deallocated bufferMårten Nordheim2018-09-281-1/+6
| | | | | | | | | | | | Change-Id: I061848ae570b382d640f8e46a1c54aeaeddbd77d Fixes: QTBUG-61307 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | wasm: enable Network for nothreadLorn Potter2018-09-282-1/+22
| | | | | | | | | | | | | | Task-number: QTBUG-70208 Change-Id: Ib73ca0d3c0736336bf517ffb968cbdbab4610319 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
* | Merge "Merge remote-tracking branch 'origin/5.11' into 5.12" into ↵Liang Qi2018-09-273-5/+7
|\ \ | | | | | | | | | refs/staging/5.12
| * | Merge remote-tracking branch 'origin/5.11' into 5.12Liang Qi2018-09-273-5/+7
| |\| | | | | | | | | | | | | | | | | | | | | | Conflicts: src/corelib/global/qconfig-bootstrapped.h src/widgets/util/qcompleter.cpp Change-Id: I4f44f0f074982530f2f2e750ce696230b2754cf3
| | * Add QT_REQUIRE_CONFIG(ssl) to pre-shared key authenticatorTimur Pocheptsov2018-09-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | As it's done (albeit in old-style there) in other public QSsl-classes. Task-number: QTBUG-70604 Change-Id: If3cd9da0e8f8378fd29a80215cd889e459aa7bce Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
| | * Modernize the "datestring" featureLiang Qi2018-09-241-1/+1
| | | | | | | | | | | | | | | | | | Change-Id: I2236a456fe3758d9054b22e36fe6316f3522d533 Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
| | * QSslContext: Use 0 instead of TLS_MAX_VERSIONDmitry Shachnev2018-09-241-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the SSL_CTX_set_max_proto_version manpage [1]: > Setting the minimum or maximum version to 0, will enable protocol > versions down to the lowest version, or up to the highest version > supported by the library, respectively. This should make it possible to use Qt Network with older versions of libssl than it was compiled against. In particular, use with 1.1.0 when compiled against 1.1.1. Also, one of OpenSSL developers is suggesting to remove TLS_MAX_VERSION from the public header in the future [2]. [1] https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_max_proto_version.html#DESCRIPTION [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908567#59 Change-Id: Ie76054b917daa8e54d5c0156e848dbaca7bb8a82 Reviewed-by: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | | SecureTransport - require the latest SDK 10.13.4Timur Pocheptsov2018-09-271-2/+2
|/ / | | | | | | | | | | | | | | | | | | | | Testing barely 10.13 seems to be insuficcient: we have developers working on macOS 10.12 with SDK 10.13, but apparently they cannot update to the latest SDK 10.13. We can try to be more specific and use __MAC_10_13_4. Task-number: QTBUG-70757 Change-Id: I083d51f1a945f63f0413792387475341ecb96118 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Andy Maloney <asmaloney@gmail.com>
* | QDtls and QDtlsClientVerifier - add destructorsTimur Pocheptsov2018-09-102-0/+16
| | | | | | | | | | | | | | | | | | | | | | While these destructors are essentially trivial and contain no code, the classes inherit QObject and thus have virtual tables. For such classes -Wweak-vtable generates a warning: "'Class' has no out-of-line virtual method definitions; its vtable will be emitted in every translation unit." Noticed this after updating QtCreator to the latest version. Change-Id: Iacb5d0cd49353bd35260aff736652542bb1ef197 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Add displayName getters to QSslCertificateAllan Sandfeld Jensen2018-08-172-2/+55
| | | | | | | | | | | | | | | | | | | | Provides two convenient getter for a display name of the subject and issuer. This simplifies cases where you just want a simple string describing either of the two. Change-Id: Ia5d0e058f14dae067b13ac7360e7fec4edd9ec53 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | Modernize the "thread" featureUlf Hermann2018-08-171-2/+0
| | | | | | | | | | | | | | | | | | | | Add it to configure.json and replace all occurrences of QT_NO_THREAD with QT_CONFIG(thread). Add conditions for other features that depend on thread support. Remove conditions where we can use the QMutex and QThreadStorage stubs. Change-Id: I284e5d794fda9a4c6f4a1ab29e55aa686272a0eb Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
* | DTLS: load roots from system stores only if allowedTimur Pocheptsov2018-08-152-3/+2
| | | | | | | | | | | | | | | | Respect allowRootCertOnDemandLoading, as it's done in QSslSocket (well, almost as in QSslSocket). Change-Id: Ic6cbb24a91e92cdb20f5f749553f15a62aae8b02 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | QDtsl::abortHandshake() - generalize the notion of 'abort'Timur Pocheptsov2018-08-152-8/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the function had a different name that made its purpose clear - "abort after peer verification error was encoutered". Since now it's just 'abort handshake', it also should abort an ongoing handshake, even if no peer verification error found so that we now have an API that can reset a QDtls object to its initial 'nothing done yet' state. Change-Id: Idadfec6f82d65c8f07d1c2afa4467c921c7e85c4 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | qdoc: Fix qdoc warnings from changes to QDtlsMartin Smith2018-08-153-23/+37
| | | | | | | | | | | | | | | | This update corrects several minor documentation errors that were introduced by a recent change to QDtls. Change-Id: I6ee6b0bf74c82dca86ba8d5f39acbd642829ec44 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* | qdoc: Fix several minor errors to reduce qdoc warningsMartin Smith2018-08-141-1/+1
| | | | | | | | | | | | | | | | | | | | This update corrects several minor documentation errors that cause qdoc warnings. These include incorrect or missing \fn commands, incorrect uses of \e and \a commands together, incorrect spellings, etc. Change-Id: Ib26edef541fa3440025490bcf79cc101623e7f7b Reviewed-by: Martin Smith <martin.smith@qt.io>
* | QDtls: delay protocol version verificationTimur Pocheptsov2018-08-103-22/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A weird behavior of the DTLS server example, when linked with 1.0.2, exposed that client code, requesting an invalid protocol (for example, SSLv3) can end-up with connection encrypted with DTLS 1.2 (which is not that bad, but totally surprising). When we check the protocol version early in setDtlsConfiguration() and find a wrong version, we leave our previous configuration intact and we will use it later during the handshake. This is wrong. So now we let our user set whatever wrong configuration they have and later fail in TLS initialization, saying - 'Unsupported protocol, DTLS was expected'. Auto-test was reduced - the follow-up patch will introduce a new 'invalidConfiguration' auto-test. Change-Id: I9be054c6112eea11b7801a1595aaf1d34329e1d2 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Ssl: clang-tidy modernize-use-nullptrMårten Nordheim2018-08-0914-182/+188
| | | | | | | | | | | | | | | | And reflow the text where it exceeds the 100 column limit. Change-Id: I0d270c6a74a4c6ecba30e4e4d38a5d8f2cf81040 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | SecureTransport: clean the code a bitTimur Pocheptsov2018-08-091-9/+6
| | | | | | | | | | | | | | | | | | As discussed/proposed previously: remove the duplicated code when converting the native certificate representation into QSslCertificate (configuration.peerCertificate). Also, use the correct integer type when iterating - CFIndex is actually long, not int. Change-Id: Ia6f43172e21b5153a93f1ef2589980d68ec2b39f Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Document the DTLS APITimur Pocheptsov2018-08-092-16/+592
| | | | | | | | | | | | | | Task-number: QTBUG-68070 Change-Id: Ifd08ecb7c2c1a6dc352952a10ad56259bd1ecf10 Reviewed-by: Paul Wicking <paul.wicking@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Merge "Merge remote-tracking branch 'origin/5.11' into dev" into ↵Liang Qi2018-08-071-0/+11
|\ \ | | | | | | | | | refs/staging/dev
| * | Merge remote-tracking branch 'origin/5.11' into devQt Forward Merge Bot2018-08-071-0/+11
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: .qmake.conf src/corelib/doc/src/objectmodel/signalsandslots.qdoc src/plugins/platforms/cocoa/qcocoamenuloader.mm src/plugins/platforms/xcb/qxcbconnection.cpp src/plugins/platforms/xcb/qxcbconnection.h src/plugins/platforms/xcb/qxcbconnection_xi2.cpp src/plugins/platforms/xcb/qxcbwindow.cpp tests/auto/gui/image/qimage/tst_qimage.cpp Done-with: Gatis Paeglis <gatis.paeglis@qt.io> Change-Id: I9bd24ee9b00d4f26c8f344ce3970aa6e93935ff5
| | * SecureTransport - disable lock on sleep for the custom keychainTimur Pocheptsov2018-08-021-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It appears that by default our keychain auto-locks when the system sleeps. This makes the keychain totally useless, since its password is a random 256 bytes our user never has a chance to know. Thanks to Mårten for the hint about SecKeychainSetSettings, the way to properly fix it. Task-number: QTBUG-69677 Change-Id: I2603c26b8422a1bcace3336e9b4ebe0381c952d7 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | | SecureTransport - fix verifyPeerTrust for the renegotiation caseTimur Pocheptsov2018-08-071-22/+23
|/ / | | | | | | | | | | | | | | | | | | | | Also remove unneeded and now wrong check (was marked with TODO) which was a copy and paste from OpenSSL counterpart. There, testing if peerCertificateChain.isEmpty() makes sense, since there we potentially call storePeerCertificates() twice during the handshake. Change-Id: I946e6876adb3f9504e93c06ac90ff36dd44aca4c Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | QDtls: respect pre-set verification errorsTimur Pocheptsov2018-07-311-1/+1
| | | | | | | | | | | | | | | | | | | | That's actually how ignoreVerificationErrors (and QSslSocket::ignoreSslErrors) are used to set the expected/known verification errors before handshake. Auto-test updated too. Change-Id: I9c700302d81ddb383a4a750fafd594373fb38ace Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Remove redundant #if-eryTimur Pocheptsov2018-07-301-8/+1
| | | | | | | | | | | | | | | | | | As now the feature 'dtls' depends on the feature 'openssl' - ifdefs are redundant, this code is always 'openssl-only'. Change-Id: I6a7fe9e3a00ae05656af1626e7de74e813df5d32 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | DTLS - treat QSslSocket::UnencryptedMode as invalidTimur Pocheptsov2018-07-281-0/+6
| | | | | | | | | | | | | | | | | | Unfortunately, this enum is not 'binary', it also has 'UnencryptedMode' and as a result we can end up with server-side method/context. Change-Id: If2da4c1b9f7e9ff916d933c9517c00a632aea324 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | QDtls - use conventional namesTimur Pocheptsov2018-07-272-10/+10
| | | | | | | | | | | | | | | | More Qt-style and more natural, also, shorter names. Change-Id: I97bd68a8614126d518a3853027661435dc4e080d Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | SecureTransport - implement renegotiationsTimur Pocheptsov2018-07-272-11/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After a handshake was completed, TLS socket is in 'connectionEncrypted' state. So on a read notification, in 'transmit', we call 'SSLRead' to read supposedly encrypted application data or TLS internal messages. In case SSLRead finds either ClientHello or HelloRequest from a server, it attempts in a rather sneaky manner to renegotiate. And as it happens here and there with SecureTransport, SSLRead fails and the work is only half-done, since we have kSSLSessionOptionBreakOnServerAuth and kSSLSessionOptionBreakOnCertRequested options set to 'true'. We end up with completely unexpected errors like errSSLClientCertRequested or errSSLPeerAuthCompleted (yes, this is so normal and totally expected for 'SSLRead' function to verify certificates and WRITE messages, no need to document this at all!). If SecureTransport is sneaky, so can be us: - in a read callback SecureTransport is probing the type of record and we can notice a sudden session state change - it goes from kSSLConnected (which is set upon handshake completion) to kSSLHandshake (which means a (re)handshake is ongoing); - if this is the case - we lie to SecureTransport about the amount of data available (0 bytes), set 'renegotiating' to 'true', return errSSLWouldBlock; - in 'transmit', if SSLRead returns errSSLWouldBlock and 'renegotiating' was set, we call 'startHandshake' until isHandshakeComplete() == true or some error encountered. [ChangeLog][QtNetwork][QSslSocket] Implement renegotiation for SecureTransport backend Task-number: QTBUG-69420 Change-Id: Iaab1336aa3abf3f6ac94b358f3142d2738a18ee9 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | QDtls - refactorTimur Pocheptsov2018-07-262-10/+10
| | | | | | | | | | | | | | | | | | This patch renames rather awkward 'remote' into more conventional 'peer' (similar to what we have in QAbstractSocket). Change-Id: Ifc45e538b8adf9cc076bd7aee693277829fd94dc Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | SecureTransport - enable ALPN on macOSTimur Pocheptsov2018-07-171-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Initially macOS SDK 10.13 had a missing symbol (only a function declaration in a header), while iOS, tvOS and watchOS SDKs all had the required symbol. Now it appears more recent SDK for macOS also has the function we need and thus we enable ALPN on macOS (as a result 'h2' protocol can now be negotiated as required by RFC 7540). [ChangeLog][QtNetwork][QSslSocket] Enable ALPN (and thus HTTP/2 negotiation) in SecureTransport backend (macOS). Change-Id: I65bd8262a9571a5495d11f7f5a29d150334cd09c Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | SecureTransport - cleanup the code a bitTimur Pocheptsov2018-07-141-35/+30
| | | | | | | | | | | | | | | | | | | | No need in ugly macro ioErr and if-ery, no need in generic noErr. SecureTransport has its own, more specific error codes: errSecIO and errSecSuccess (which have the equivalent values). Change-Id: Ifd99fbcbee290fe27caa0c258923f4527c047ba8 Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | Extend the feature 'dtls' to handle missing DTLS support in OpenSSLTimur Pocheptsov2018-07-1312-29/+102
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL has 'no-dtls' configure option (or can be too ancient to properly support it), we shall respect such builds. This patch extends configure.json with a 'dtls' test and adds protection against linkage/compile-time issues in the QtNetwork's code. Change-Id: I0c0dd94f5c226115cee4285b82c83aa546555aea Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io> Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | OpenSSL: remove unused symbols/declarationsTimur Pocheptsov2018-07-133-15/+0
| | | | | | | | | | | | | | | | | | | | These are leftovers from the prototype version of DTLS connection and no code is using them now. Change-Id: I3970a56303a59ce95e9c22344fac89e89f6559c8 Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | QSslSocketBackendPrivate - avoid recursion while handing errorsTimur Pocheptsov2018-07-122-7/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logic seems to be simple - if client code on error signal tries to close TLS socket and this socket has buffered data, it calls 'flush' and 'transmit' or even 'startHandshake' as a result, which in turn will set and emit error again. To auto- test this, we initiate a handshake with pre-shared key hint on a server side and both client/server sockets incorrectly configured (missing PSK signals). We also do early write into the client socket to make sure it has some data buffered by the moment we call 'close'. Task-number: QTBUG-68089 Task-number: QTBUG-56476 Change-Id: I6ba6435bd572ad85d9209c4c81774a397081b34f Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* | Provide access to QSslCertificate on OpenSSL free Windows buildsAllan Sandfeld Jensen2018-07-066-28/+46
| | | | | | | | | | | | | | | | | | | | | | The QSslCertificate class can parse and provide details about SSL certificates without a proper backend, this can for instance be used by QtWebEngine to provide metadata about certificates, even on Windows builds without OpenSSL, as QtWebEngine does not use Qt's SSL stack. Change-Id: Ib48f1ed7315c5bc66721ec87ee651d8372f07f71 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* | QDtls - handle server-side timeoutsTimur Pocheptsov2018-07-052-16/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | According to RFC 6347 a DTLS server also must retransmit buffered message(s) if timeouts happen during the handshake phase (so it's not a client only as I initially understood it). Conveniently so an auto-test is already in place and needs just a tiny adjustment - handshakeWithRetransmission covers both sides. Change-Id: If914ec3052e28ef5bf12a40e5eede45bbc53e8e0 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-23 10:03:39 +0000