From 92cda9474245c79b635c21cd140c5d0a3a6d2e5b Mon Sep 17 00:00:00 2001 From: Giuseppe D'Angelo Date: Mon, 8 Jun 2015 11:55:10 +0200 Subject: QSslSocket: move default cipher, EC and default CA APIs to QSslConfiguration QSslConfiguration is better suited for these APIs. The ones in QSslSocket that already have a counterpart have been deprecated. [ChangeLog][QtNetwork][SSL/TLS Support] Most of the QSslSocket functions to deal with ciphersuites, certification authorities as well as elliptic curves have been deprecated in favor of the corresponding counterparts in QSslConfiguration. Task-number: QTBUG-46558 Change-Id: I1de03379efcbcab931c20e876e252769fe4279e0 Reviewed-by: Liang Qi Reviewed-by: Richard J. Moore Reviewed-by: Jani Heikkinen --- src/network/ssl/qsslcipher.cpp | 5 +- src/network/ssl/qsslconfiguration.cpp | 45 +++++++++ src/network/ssl/qsslconfiguration.h | 3 + src/network/ssl/qsslsocket.cpp | 178 ++++++++------------------------- src/network/ssl/qsslsocket.h | 35 ++++--- src/network/ssl/qsslsocket_openssl.cpp | 2 +- src/network/ssl/qsslsocket_p.h | 2 - 7 files changed, 113 insertions(+), 157 deletions(-) (limited to 'src/network/ssl') diff --git a/src/network/ssl/qsslcipher.cpp b/src/network/ssl/qsslcipher.cpp index 8f2b8b54ad..c480b79371 100644 --- a/src/network/ssl/qsslcipher.cpp +++ b/src/network/ssl/qsslcipher.cpp @@ -54,6 +54,7 @@ #include "qsslcipher.h" #include "qsslcipher_p.h" #include "qsslsocket.h" +#include "qsslconfiguration.h" #ifndef QT_NO_DEBUG_STREAM #include @@ -81,7 +82,7 @@ QSslCipher::QSslCipher() QSslCipher::QSslCipher(const QString &name) : d(new QSslCipherPrivate) { - foreach (const QSslCipher &cipher, QSslSocket::supportedCiphers()) { + foreach (const QSslCipher &cipher, QSslConfiguration::supportedCiphers()) { if (cipher.name() == name) { *this = cipher; return; @@ -102,7 +103,7 @@ QSslCipher::QSslCipher(const QString &name) QSslCipher::QSslCipher(const QString &name, QSsl::SslProtocol protocol) : d(new QSslCipherPrivate) { - foreach (const QSslCipher &cipher, QSslSocket::supportedCiphers()) { + foreach (const QSslCipher &cipher, QSslConfiguration::supportedCiphers()) { if (cipher.name() == name && cipher.protocol() == protocol) { *this = cipher; return; diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp index 5c95c9f544..4803e47224 100644 --- a/src/network/ssl/qsslconfiguration.cpp +++ b/src/network/ssl/qsslconfiguration.cpp @@ -36,6 +36,7 @@ #include "qsslconfiguration.h" #include "qsslconfiguration_p.h" #include "qsslsocket.h" +#include "qsslsocket_p.h" #include "qmutex.h" #include "qdebug.h" @@ -589,6 +590,20 @@ void QSslConfiguration::setCiphers(const QList &ciphers) d->ciphers = ciphers; } +/*! + \since 5.5 + + Returns the list of cryptographic ciphers supported by this + system. This list is set by the system's SSL libraries and may + vary from system to system. + + \sa ciphers(), setCiphers() +*/ +QList QSslConfiguration::supportedCiphers() +{ + return QSslSocketPrivate::supportedCiphers(); +} + /*! Returns this connection's CA certificate database. The CA certificate database is used by the socket during the handshake phase to @@ -618,6 +633,22 @@ void QSslConfiguration::setCaCertificates(const QList &certific d->allowRootCertOnDemandLoading = false; } +/*! + \since 5.5 + + This function provides the CA certificate database + provided by the operating system. The CA certificate database + returned by this function is used to initialize the database + returned by caCertificates() on the default QSslConfiguration. + + \sa caCertificates(), setCaCertificates(), defaultConfiguration() +*/ +QList QSslConfiguration::systemCaCertificates() +{ + // we are calling ensureInitialized() in the method below + return QSslSocketPrivate::systemCaCertificates(); +} + /*! Enables or disables an SSL compatibility \a option. If \a on is true, the \a option is enabled. If \a on is false, the @@ -743,6 +774,20 @@ void QSslConfiguration::setEllipticCurves(const QVector &curv d->ellipticCurves = curves; } +/*! + \since 5.5 + + Returns the list of elliptic curves supported by this + system. This list is set by the system's SSL libraries and may + vary from system to system. + + \sa ellipticCurves(), setEllipticCurves() +*/ +QVector QSslConfiguration::supportedEllipticCurves() +{ + return QSslSocketPrivate::supportedEllipticCurves(); +} + /*! \since 5.3 diff --git a/src/network/ssl/qsslconfiguration.h b/src/network/ssl/qsslconfiguration.h index c5a1c6e6d4..960aec60ce 100644 --- a/src/network/ssl/qsslconfiguration.h +++ b/src/network/ssl/qsslconfiguration.h @@ -111,10 +111,12 @@ public: // Cipher settings QList ciphers() const; void setCiphers(const QList &ciphers); + static QList supportedCiphers(); // Certificate Authority (CA) settings QList caCertificates() const; void setCaCertificates(const QList &certificates); + static QList systemCaCertificates(); void setSslOption(QSsl::SslOption option, bool on); bool testSslOption(QSsl::SslOption option) const; @@ -126,6 +128,7 @@ public: // EC settings QVector ellipticCurves() const; void setEllipticCurves(const QVector &curves); + static QVector supportedEllipticCurves(); static QSslConfiguration defaultConfiguration(); static void setDefaultConfiguration(const QSslConfiguration &configuration); diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp index 513cc51620..07c0cd4bf8 100644 --- a/src/network/ssl/qsslsocket.cpp +++ b/src/network/ssl/qsslsocket.cpp @@ -1166,6 +1166,10 @@ QSslKey QSslSocket::privateKey() const } /*! + \deprecated + + Use QSslConfiguration::ciphers() instead. + Returns this socket's current cryptographic cipher suite. This list is used during the socket's handshake phase for choosing a session cipher. The returned list of ciphers is ordered by @@ -1197,6 +1201,10 @@ QList QSslSocket::ciphers() const } /*! + \deprecated + + USe QSslConfiguration::setCiphers() instead. + Sets the cryptographic cipher suite for this socket to \a ciphers, which must contain a subset of the ciphers in the list returned by supportedCiphers(). @@ -1213,6 +1221,10 @@ void QSslSocket::setCiphers(const QList &ciphers) } /*! + \deprecated + + Use QSslConfiguration::setCiphers() instead. + Sets the cryptographic cipher suite for this socket to \a ciphers, which is a colon-separated list of cipher suite names. The ciphers are listed in order of preference, starting with the most preferred cipher. For example: @@ -1238,6 +1250,10 @@ void QSslSocket::setCiphers(const QString &ciphers) } /*! + \deprecated + + Use QSslConfiguration::setCiphers() on the default QSslConfiguration instead. + Sets the default cryptographic cipher suite for all sockets in this application to \a ciphers, which must contain a subset of the ciphers in the list returned by supportedCiphers(). @@ -1254,6 +1270,10 @@ void QSslSocket::setDefaultCiphers(const QList &ciphers) } /*! + \deprecated + + Use QSslConfiguration::ciphers() on the default QSslConfiguration instead. + Returns the default cryptographic cipher suite for all sockets in this application. This list is used during the socket's handshake phase when negotiating with the peer to choose a session cipher. @@ -1273,6 +1293,10 @@ QList QSslSocket::defaultCiphers() } /*! + \deprecated + + Use QSslConfiguration::supportedCiphers() instead. + Returns the list of cryptographic ciphers supported by this system. This list is set by the system's SSL libraries and may vary from system to system. @@ -1284,120 +1308,6 @@ QList QSslSocket::supportedCiphers() return QSslSocketPrivate::supportedCiphers(); } -/*! - \since 5.5 - - Returns this socket's current list of elliptic curves. This - list is used during the socket's handshake phase for choosing an - elliptic curve (when using an elliptic curve cipher). - The returned list of curves is ordered by descending preference - (i.e., the first curve in the list is the most preferred one). - - By default, this list is empty. An empty default list means that the - handshake phase can choose any of the curves supported by this system's SSL - libraries (which may vary from system to system). The list of curves - supported by this system's SSL libraries is returned by - supportedEllipticCurves(). - - You can restrict the list of curves used for choosing the session cipher - for this socket by calling setEllipticCurves() with a subset of the - supported ciphers. You can revert to using the entire set by calling - setEllipticCurves() with the list returned by supportedEllipticCurves(). - - \sa setEllipticCurves(), defaultEllipticCurves(), setDefaultEllipticCurves(), supportedEllipticCurves() -*/ -QVector QSslSocket::ellipticCurves() const -{ - Q_D(const QSslSocket); - return d->configuration.ellipticCurves; -} - -/*! - \since 5.5 - - Sets the list of elliptic curves to be used by this socket to \a curves, - which must contain a subset of the curves in the list returned by - supportedEllipticCurves(). - - Restricting the elliptic curves must be done before the handshake - phase, where the session cipher is chosen. - - If an empty list is set, then the handshake phase can choose any of the - curves supported by this system's SSL libraries (which may vary from system - to system). The list of curves supported by this system's SSL libraries is - returned by supportedEllipticCurves(). - - Use setCipher() in order to disable the usage of elliptic curve ciphers. - - \sa ellipticCurves(), setDefaultEllipticCurves(), supportedEllipticCurves() -*/ -void QSslSocket::setEllipticCurves(const QVector &curves) -{ - Q_D(QSslSocket); - d->configuration.ellipticCurves = curves; -} - -/*! - \since 5.5 - - Sets the list of elliptic curves to be used by all sockets in this - application to \a curves, which must contain a subset of the curves in the - list returned by supportedEllipticCurves(). - - Restricting the default elliptic curves only affects SSL sockets - that perform their handshake phase after the default list has been changed. - - If an empty list is set, then the handshake phase can choose any of the - curves supported by this system's SSL libraries (which may vary from system - to system). The list of curves supported by this system's SSL libraries is - returned by supportedEllipticCurves(). - - Use setDefaultCiphers() in order to disable the usage of elliptic curve ciphers. - - \sa setEllipticCurves(), defaultEllipticCurves(), supportedEllipticCurves() -*/ -void QSslSocket::setDefaultEllipticCurves(const QVector &curves) -{ - QSslSocketPrivate::setDefaultEllipticCurves(curves); -} - - -/*! - \since 5.5 - - Returns the default elliptic curves list for all sockets in - this application. This list is used during the socket's handshake - phase when negotiating with the peer to choose a session cipher. - The list is ordered by preference (i.e., the first curve in the - list is the most preferred one). - - By default, this list is empty. An empty default list means that the - handshake phase can choose any of the curves supported by this system's SSL - libraries (which may vary from system to system). The list of curves - supported by this system's SSL libraries is returned by - supportedEllipticCurves(). - - \sa setDefaultEllipticCurves(), supportedEllipticCurves() -*/ -QVector QSslSocket::defaultEllipticCurves() -{ - return QSslSocketPrivate::defaultEllipticCurves(); -} - -/*! - \since 5.5 - - Returns the list of elliptic curves supported by this - system. This list is set by the system's SSL libraries and may - vary from system to system. - - \sa ellipticCurves(), setEllipticCurves(), defaultEllipticCurves() -*/ -QVector QSslSocket::supportedEllipticCurves() -{ - return QSslSocketPrivate::supportedEllipticCurves(); -} - /*! Searches all files in the \a path for certificates encoded in the specified \a format and adds them to this socket's CA certificate @@ -1456,6 +1366,10 @@ void QSslSocket::addCaCertificates(const QList &certificates) } /*! + \deprecated + + Use QSslConfiguration::setCaCertificates() instead. + Sets this socket's CA certificate database to be \a certificates. The certificate database must be set prior to the SSL handshake. The CA certificate database is used by the socket during the @@ -1475,6 +1389,10 @@ void QSslSocket::setCaCertificates(const QList &certificates) } /*! + \deprecated + + Use QSslConfiguration::caCertificates() instead. + Returns this socket's CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer's certificate. It can be moodified prior to the @@ -1535,6 +1453,10 @@ void QSslSocket::addDefaultCaCertificates(const QList &certific } /*! + \deprecated + + Use QSslConfiguration::setCaCertificates() on the default QSslConfiguration instead. + Sets the default CA certificate database to \a certificates. The default CA certificate database is originally set to your system's default CA certificate database. You can override the default CA @@ -1552,6 +1474,10 @@ void QSslSocket::setDefaultCaCertificates(const QList &certific } /*! + \deprecated + + Use QSslConfiguration::caCertificates() on the default QSslConfiguration instead. + Returns the current default CA certificate database. This database is originally set to your system's default CA certificate database. If no system default database is found, an empty database will be @@ -1572,6 +1498,10 @@ QList QSslSocket::defaultCaCertificates() } /*! + \deprecated + + Use QSslConfiguration::systemDefaultCaCertificates instead. + This function provides the CA certificate database provided by the operating system. The CA certificate database returned by this function is used to initialize the database @@ -2163,16 +2093,6 @@ void QSslSocketPrivate::setDefaultSupportedCiphers(const QList &ciph globalData()->supportedCiphers = ciphers; } -/*! - \internal -*/ -QVector QSslSocketPrivate::defaultEllipticCurves() -{ - QSslSocketPrivate::ensureInitialized(); - const QMutexLocker locker(&globalData()->mutex); - return globalData()->config->ellipticCurves; -} - /*! \internal */ @@ -2183,16 +2103,6 @@ QVector QSslSocketPrivate::supportedEllipticCurves() return globalData()->supportedEllipticCurves; } -/*! - \internal -*/ -void QSslSocketPrivate::setDefaultEllipticCurves(const QVector &curves) -{ - const QMutexLocker locker(&globalData()->mutex); - globalData()->config.detach(); - globalData()->config->ellipticCurves = curves; -} - /*! \internal */ diff --git a/src/network/ssl/qsslsocket.h b/src/network/ssl/qsslsocket.h index 8ad6d033a7..4124f5b7e5 100644 --- a/src/network/ssl/qsslsocket.h +++ b/src/network/ssl/qsslsocket.h @@ -144,34 +144,33 @@ public: QSslKey privateKey() const; // Cipher settings. - QList ciphers() const; - void setCiphers(const QList &ciphers); - void setCiphers(const QString &ciphers); - static void setDefaultCiphers(const QList &ciphers); - static QList defaultCiphers(); - static QList supportedCiphers(); - - // EC settings. - QVector ellipticCurves() const; - void setEllipticCurves(const QVector &curves); - static void setDefaultEllipticCurves(const QVector &curves); - static QVector defaultEllipticCurves(); - static QVector supportedEllipticCurves(); +#if QT_DEPRECATED_SINCE(5, 5) + QT_DEPRECATED_X("Use QSslConfiguration::ciphers()") QList ciphers() const; + QT_DEPRECATED_X("Use QSslConfiguration::setCiphers()") void setCiphers(const QList &ciphers); + QT_DEPRECATED void setCiphers(const QString &ciphers); + QT_DEPRECATED static void setDefaultCiphers(const QList &ciphers); + QT_DEPRECATED static QList defaultCiphers(); + QT_DEPRECATED_X("Use QSslConfiguration::supportedCiphers()") static QList supportedCiphers(); +#endif // QT_DEPRECATED_SINCE(5, 5) // CA settings. bool addCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, QRegExp::PatternSyntax syntax = QRegExp::FixedString); void addCaCertificate(const QSslCertificate &certificate); void addCaCertificates(const QList &certificates); - void setCaCertificates(const QList &certificates); - QList caCertificates() const; +#if QT_DEPRECATED_SINCE(5, 5) + QT_DEPRECATED_X("Use QSslConfiguration::setCaCertificates()") void setCaCertificates(const QList &certificates); + QT_DEPRECATED_X("Use QSslConfiguration::caCertificates()") QList caCertificates() const; +#endif // QT_DEPRECATED_SINCE(5, 5) static bool addDefaultCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem, QRegExp::PatternSyntax syntax = QRegExp::FixedString); static void addDefaultCaCertificate(const QSslCertificate &certificate); static void addDefaultCaCertificates(const QList &certificates); - static void setDefaultCaCertificates(const QList &certificates); - static QList defaultCaCertificates(); - static QList systemCaCertificates(); +#if QT_DEPRECATED_SINCE(5, 5) + QT_DEPRECATED static void setDefaultCaCertificates(const QList &certificates); + QT_DEPRECATED static QList defaultCaCertificates(); + QT_DEPRECATED_X("Use QSslConfiguration::systemCaCertificates()") static QList systemCaCertificates(); +#endif // QT_DEPRECATED_SINCE(5, 5) bool waitForConnected(int msecs = 30000) Q_DECL_OVERRIDE; bool waitForEncrypted(int msecs = 30000); diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp index 19848a73f0..049666b70b 100644 --- a/src/network/ssl/qsslsocket_openssl.cpp +++ b/src/network/ssl/qsslsocket_openssl.cpp @@ -1685,7 +1685,7 @@ QList QSslSocketBackendPrivate::verify(const QList & setDefaultCaCertificates(defaultCaCertificates() + systemCaCertificates()); } - foreach (const QSslCertificate &caCertificate, QSslSocket::defaultCaCertificates()) { + foreach (const QSslCertificate &caCertificate, QSslConfiguration::defaultConfiguration().caCertificates()) { // From https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html: // // If several CA certificates matching the name, key identifier, and diff --git a/src/network/ssl/qsslsocket_p.h b/src/network/ssl/qsslsocket_p.h index 5f726f2371..d6519718d9 100644 --- a/src/network/ssl/qsslsocket_p.h +++ b/src/network/ssl/qsslsocket_p.h @@ -137,9 +137,7 @@ public: static void setDefaultSupportedCiphers(const QList &ciphers); static void resetDefaultCiphers(); - static QVector defaultEllipticCurves(); static QVector supportedEllipticCurves(); - static void setDefaultEllipticCurves(const QVector &curves); static void setDefaultSupportedEllipticCurves(const QVector &curves); static void resetDefaultEllipticCurves(); -- cgit v1.2.3