summaryrefslogtreecommitdiffstats
path: root/src/plugins/tls/openssl/qtls_openssl.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Revert "OpenSSL: remove support for 1.1"Marianne Yrjänä2023-12-081-0/+3
| | | | | | | | | | This reverts commit d201c0a2184881a226bce76528047707e9062856. Reason for revert: QNX have support only for OpenSSL1.1. QNX will start supporting OpenSSL3 with upcoming QNX8.0 but as long as we want to support QNX7.1 (and even QNX7.0) removing OpenSSL1.1 support from Qt is not an option. Change-Id: Ia2083eda318779968eb6ee84fff2f56ebe3dadf7 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* OpenSSL: remove support for 1.1Giuseppe D'Angelo2023-11-241-3/+0
| | | | | | | | | | | | | | | | | | | | OpenSSL 1.1 reached EOL last September [1]. We will only support OpenSSL 3. Cherry-picking aggressively, as there's no purpose at keeping maintained Qt versions work with an unmaintained library given the security implications. [1] https://www.openssl.org/blog/blog/2023/09/11/eol-111/ [ChangeLog][QtNetwork][SSL] Support for OpenSSL 1.1 has been dropped. Qt now only supports OpenSSL 3. Change-Id: I51a231a9ca17804739acbd2f22c478d2a8ff9b3b Fixes: QTBUG-119330 Pick-to: 6.6 6.5 6.2 5.15 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
* tls: use string view types moreAnton Kudryavtsev2023-08-171-1/+1
| | | | | | | Prefer QStringView overloads Change-Id: Icc928a91056d661f9e7f187f42592f05ad081a84 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* TLS[openssl]: Use optional<> for CA cert we are fetchingMårten Nordheim2023-02-171-3/+3
| | | | | | | | | | | | | The QSslCertificate ctor is somewhat expensive, especially when we are shutting down. By using optional<> we simply reset() it and no longer need to create a new, valid, certificate. Pick-to: 6.5 6.4 6.2 Task-number: QTBUG-102474 Change-Id: I514433b0d380dd3ceabbed3a6164f7e3efc490c7 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Konrad Kujawa <konrad.kujawa@qt.io>
* Port from qAsConst() to std::as_const()Marc Mutz2022-10-111-2/+2
| | | | | | | | | | | | | | | | We've been requiring C++17 since Qt 6.0, and our qAsConst use finally starts to bother us (QTBUG-99313), so time to port away from it now. Since qAsConst has exactly the same semantics as std::as_const (down to rvalue treatment, constexpr'ness and noexcept'ness), there's really nothing more to it than a global search-and-replace, with manual unstaging of the actual definition and documentation in dist/, src/corelib/doc/ and src/corelib/global/. Task-number: QTBUG-99313 Change-Id: I4c7114444a325ad4e62d0fcbfd347d2bbfb21541 Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
* Port from container.count()/length() to size()Marc Mutz2022-10-041-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is semantic patch using ClangTidyTransformator: auto QtContainerClass = expr(hasType(namedDecl(hasAnyName(<classes>)))).bind(o) makeRule(cxxMemberCallExpr(on(QtContainerClass), callee(cxxMethodDecl(hasAnyName({"count", "length"), parameterCountIs(0))))), changeTo(cat(access(o, cat("size"), "()"))), cat("use 'size()' instead of 'count()/length()'")) a.k.a qt-port-to-std-compatible-api with config Scope: 'Container'. <classes> are: // sequential: "QByteArray", "QList", "QQueue", "QStack", "QString", "QVarLengthArray", "QVector", // associative: "QHash", "QMultiHash", "QMap", "QMultiMap", "QSet", // Qt has no QMultiSet Change-Id: Ibe8837be96e8d30d1846881ecd65180c1bc459af Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
* Use SPDX license identifiersLucie Gérard2022-05-161-38/+2
| | | | | | | | | | | | | Replace the current license disclaimer in files by a SPDX-License-Identifier. Files that have to be modified by hand are modified. License files are organized under LICENSES directory. Task-number: QTBUG-67283 Change-Id: Id880c92784c40f3bbde861c0d93f58151c18b9f1 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: Jörg Bornemann <joerg.bornemann@qt.io>
* QtNetwork: replace remaining uses of QLatin1String by QLatin1StringViewSona Kurazyan2022-04-211-1/+1
| | | | | | | Task-number: QTBUG-98434 Change-Id: I0bb9d534ee42ccbf7d353e251ef58901a86923b4 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* QtNetwork: use _L1 for for creating Latin-1 string literalsSona Kurazyan2022-04-211-2/+4
| | | | | | Task-number: QTBUG-98434 Change-Id: Ic235b92377203f7a1429ae7fd784c4a1fa893e9f Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* OpenSSL: handle renegotiate errors by comparing certsMårten Nordheim2021-12-021-2/+46
| | | | | | | | | | | | If the certificate didn't change then our trust in it didn't either. Sadly, cannot have an autotest because we don't have any way to facilitate a renegotiation at the moment and with TLS 1.3 not having them at all it's unlikely we ever will. Pick-to: 6.2 5.15 Task-number: QTBUG-92231 Change-Id: Ibaa9b2f627daca05021c574e69526710aacdadae Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
* Openssl backend: reinsert a missing C in qCDebugMårten Nordheim2021-12-011-1/+1
| | | | | | Pick-to: 6.2 5.15 Change-Id: I2b13d2f88517abea7e015bfba4fe71dcbada86c0 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* tls: Fix typos in source code commentsJonas Kvinge2021-10-121-1/+1
| | | | | | Change-Id: Iec42e4d0f3476bd421861a0139731ff89788ee23 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* OpenSSL: Let people opt-in to use TLS 1.3 PSK callbackMårten Nordheim2021-09-081-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's a workaround for the workaround... If TLS 1.3 was explicitly chosen and the PSK callback is set then without this patch the callback is never called since, with TLS 1.3, PSK would only be queried once at the start of a connection. It can now be re-enabled with an environment variable. A new API should be added to address the new requirements of PSK with TLS 1.3: For session resumption the connection MUST use the same hash algorithm as in the original session. For new sessions the hash algorithm must be decided ahead of time, or a default will be used (as defined by the standard). A user can also pass along multiple identity+key pairs and the server will pick one it recognizes. This is not something we can currently do with the preSharedKeyAuthenticationRequired callback. [ChangeLog][Network][QSslSocket][OpenSSL] When using TLS 1.3 we suppress the first callback from OpenSSL about pre-shared keys, as it doesn't conform to the past behavior which preSharedKeyAuthenticationRequired provided. With this update you can opt-out of that workaround by setting the QT_USE_TLS_1_3_PSK environment variable Pick-to: 6.2 6.1 5.15 Task-number: QTBUG-95670 Change-Id: Ia7454bbbf394cbcb859de333b371d0890b42a1c3 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Hold QSslContext in shared_ptrMarc Mutz2021-07-181-2/+2
| | | | | | | | | | | ... instead of QSharedPointer. QSharedPointer performs twice as many atomic operations per pointer copy as std::shared_ptr, and this is private API, we're not bound by BC constraints, so we can port to the more efficient version. Change-Id: I2e2a02493565a7ca51c86ec0ed66b6ce7c763e41 Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* SSL: port QSharedPointer<QSslContext> uses to std-compatible API subsetMarc Mutz2021-07-161-5/+5
| | | | | | | | | | | In preparation of porting to shared_ptr. Add a few strategic moves and remove a rather pointless comment stating the obvious. Change-Id: Ie1c0f3431af79bdb204e00d99323bf9f2d100d0d Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
* TLS: Mark TLS 1.0, 1.1 and DTLS 1.0 deprecatedMårten Nordheim2021-06-251-0/+3
| | | | | | | | | | | | As per the best practice laid forth in RFC-8996. TLS 1.2 was recommended from 2008 until TLS 1.3 was released in 2018. [ChangeLog][QtNetwork][QSslSocket] TLS 1.0, 1.1 and DTLS 1.0 are now deprecated, as recommended by RFC-8996. Fixes: QTBUG-92880 Change-Id: I90cebcfb07cfce623af7ac9f2b66ce9d02586b54 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* QSslSocket: Set isEncrypted to false on disconnectMårten Nordheim2021-06-251-0/+1
| | | | | | | | | Since we're no longer connected, much less encrypted. Was done in schannel backend, but not in ST or OpenSSL Pick-to: 6.2 Change-Id: Ia49387be0088f899a0c89091f7e468dba1c0eee6 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
* Move plugin code from QtNetwork to qtbase/pluginsTimur Pocheptsov2021-04-221-0/+1839
All TLS (and non-TLS) backends that QSsl classes rely on are now in plugins/tls (as openssl, securetransport, schannel and certonly plugins). For now, I have to disable some tests that were using OpenSSL calls - this to be refactored/re-thought. These include: qsslsocket auto-test (test-case where we work with private keys), qsslkey auto-test (similar to qsslsocket - test-case working with keys using OpenSSL calls). qasn1element moved to plugins too, so its auto-test have to be re-thought. Since now we can have more than one working TLS-backend on a given platform, the presence of OpenSSL also means I force this backend as active before running tests, to make sure features implemented only in OpenSSL-backend are tested. OCSP auto test is disabled for now, since it heavily relies on OpenSSL symbols (to be refactored). [ChangeLog][QtNetwork][QSslSocket] QSslSocket by default prefers 'openssl' backend if it is available. [ChangeLog][QtNetwork][QSslSocket] TLS-backends are not mutually exclusive anymore, depending on a platform, more than one TLS backend can be built. E.g., configuring Qt with -openssl does not prevent SecureTransport or Schannel plugin from being built. Fixes: QTBUG-91928 Change-Id: I4c05e32f10179066bee3a518bdfdd6c4b15320c3 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Edward Welbourne <edward.welbourne@qt.io> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-11 02:26:06 +0000