whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use SSL_CTX_set_dh_auto if DHparam is empty 

[ChangeLog][QtNetwork][QSslDiffieHellmanParameters] An empty
Diffie-Hellmann parameter enables auto selection of openssl
backend.

Fixes: QTBUG-117666
Change-Id: Ic2e0529d48542752ca801bcb4d609988e5ddff25
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
bb10
André Klitzing 2023-09-29 08:21:21 +02:00
parent 5628600a07
commit fd9c567156
4 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/network/ssl/qsslconfiguration.cpp
View File

@ -939,6 +939,9 @@ QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const
If no Diffie-Hellman parameters have been set, the QSslConfiguration object
defaults to using the 2048-bit MODP group from RFC 3526.
Since 6.7 you can provide an empty Diffie-Hellman parameter to use auto selection
(see SSL_CTX_set_dh_auto of openssl) if the tls backend supports it.
\note The default parameters may change in future Qt versions.
Please check the documentation of the \e{exact Qt version} that you
are using in order to know what defaults that version uses.

4
src/plugins/tls/openssl/qsslcontext_openssl.cpp
View File

@ -697,7 +697,9 @@ QT_WARNING_POP
return;
}
if (!dhparams.isEmpty()) {
if (dhparams.isEmpty()) {
q_SSL_CTX_set_dh_auto(sslContext->ctx, 1);
} else {
#ifndef OPENSSL_NO_DEPRECATED_3_0
const QByteArray &params = dhparams.d->derData;
const char *ptr = params.constData();

1
src/plugins/tls/openssl/qsslsocket_openssl_symbols_p.h
View File

@ -516,6 +516,7 @@ DH *q_PEM_read_bio_DHparams(BIO *a, DH **b, pem_password_cb *c, void *d);
BIGNUM *q_BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret);
#define q_SSL_CTX_set_tmp_dh(ctx, dh) q_SSL_CTX_ctrl((ctx), SSL_CTRL_SET_TMP_DH, 0, (char *)dh)
#define q_SSL_CTX_set_dh_auto(ctx, onoff) q_SSL_CTX_ctrl(ctx,SSL_CTRL_SET_DH_AUTO,onoff,NULL)
#ifndef OPENSSL_NO_EC
// EC Diffie-Hellman support

16
tests/auto/network/ssl/qsslsocket/tst_qsslsocket.cpp
View File

@ -3510,9 +3510,10 @@ void tst_QSslSocket::dhServerCustomParamsNull()
if (setProxy)
return;
const QSslCipher cipherWithDH("DHE-RSA-AES256-SHA256");
SslServer server;
server.ciphers = {QSslCipher("DHE-RSA-AES256-SHA"), QSslCipher("DHE-DSS-AES256-SHA")};
server.protocol = Test::TlsV1_0;
server.ciphers = {cipherWithDH};
server.protocol = QSsl::TlsV1_2;
QSslConfiguration cfg = server.config;
cfg.setDiffieHellmanParameters(QSslDiffieHellmanParameters());
@ -3525,7 +3526,6 @@ void tst_QSslSocket::dhServerCustomParamsNull()
QSslSocket client;
QSslConfiguration config = client.sslConfiguration();
config.setProtocol(Test::TlsV1_0);
client.setSslConfiguration(config);
socket = &client;
connect(socket, SIGNAL(errorOccurred(QAbstractSocket::SocketError)), &loop, SLOT(quit()));
@ -3536,7 +3536,8 @@ void tst_QSslSocket::dhServerCustomParamsNull()
loop.exec();
QVERIFY(client.state() != QAbstractSocket::ConnectedState);
QCOMPARE(client.state(), QAbstractSocket::ConnectedState);
QCOMPARE(client.sessionCipher(), cipherWithDH);
}
void tst_QSslSocket::dhServerCustomParams()
@ -3551,7 +3552,9 @@ void tst_QSslSocket::dhServerCustomParams()
return;
SslServer server;
server.ciphers = {QSslCipher("DHE-RSA-AES256-SHA"), QSslCipher("DHE-DSS-AES256-SHA")};
const QSslCipher cipherWithDH("DHE-RSA-AES256-SHA256");
server.ciphers = {cipherWithDH};
server.protocol = QSsl::TlsV1_2;
QSslConfiguration cfg = server.config;
@ -3581,7 +3584,8 @@ void tst_QSslSocket::dhServerCustomParams()
loop.exec();
QVERIFY(client.state() == QAbstractSocket::ConnectedState);
QCOMPARE(client.state(), QAbstractSocket::ConnectedState);
QCOMPARE(client.sessionCipher(), cipherWithDH);
}
#endif // QT_CONFIG(openssl)