Replace 0 with \nullptr in the documentation.
As a drive-by also replace some 0 with nullptr in the corresponding
code.
Change-Id: I914b6b2151554c06acc2d244eff004524cbb9a82
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
Configure is unable to find header files that are located in
frameworks. Work around that by specifying "include" on "test" level
instead of "headers" on "corewlan" level.
This amends commit 10adbc4f0f.
Change-Id: I0650585eb9a4e881dc2e3733d8db40c6e50cf1f3
Fixes: QTBUG-72964
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>
This is similar to a change we approved recently in OpenSSL back-end.
Similar to OpenSSL, not setting the upper limit on protocols allowed
to negotiate/use, neatly ends up with the highest available, which
is ... TLS 1.2 at the moment, but will silently switch to 1.3 etc.
This was also recommended by Apple's engineer who closed a related
bug report with 'Won't do' - "do not limit the max, you'll always
have the real max supported'. Also, while at the moment we do
not allow QSsl::TlsV1_3 and QSsl::TlsV1_3OrLater, if we managed
to negotiate it - report it properly, not as 'Unknown'.
Task-number: QTBUG-67463
Change-Id: I3f46ea525f06edca03259123809f3b7b1191b1ee
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
If later we try to introduce multiple ocsp support, the API returning
a single response will be somewhat broken and illogical/not clear
how to use at all. Let's return a vector of responses (for now it's
one, can change in future). This makes isNull() redundant on a
response, also, we now need 'subject' - a cert that response was for.
Change-Id: Ibbd9dec163b53906b2fd61fa31c43db7d08adc4d
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
While it's not common it still occurs, perhaps especially with 127.0.0.1
Can be tested by attempting to connect to https://1.1.1.1/ using Qt.
Change-Id: Idad56476597ab570b8347236ff700fa66ab5b1f4
Fixes: QTBUG-71828
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
about why a certificate was revoked (if it was) and the responder's
certificate, if we managed to verify a signature, as was previously
shortly discussed in the 'OCSP stapling' patch-set. Auto-test update
will be in a separate patch.
[ChangeLog][QtNetwork][Ssl] Added class QOcspResponse as a part of
OCSP stapling support.
Change-Id: I4e17fb6fc4c3dae0b8ad04ff2897a4823736d16e
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Adds support for Schannel, an SSL backend for Windows, as an
alternative to OpenSSL.
[ChangeLog][QtNetwork][Ssl] Added support for Schannel on Desktop
Windows. To build Qt with Schannel support use '-schannel' during
configure.
Task-number: QTBUG-62637
Change-Id: Ic4fb8ed3657dab994f9f4a4ac5cbddc7001a0a46
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Make it more like feature 'dtls' test.
Change-Id: I29f5e9337d99440015431a8cfb001f5fb28e1c5f
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Q_DECLARE_PRIVATE gets used in the declaration of the public class,
where the private class is typically visible only as a forward-decl,
with no knowledge of what it's based on; consequently, the macro is
obliged to use reinterpret_cast<>, which is subject to warnings when
the compiler *can* see both types and their alignments differ. The
same applies to Q_DECLARE_PRIVATE_D.
So suppress gcc's -Wcast-align around the d_func() return statements.
(If we get similar problems with other compilers we can add their
suppressions likewise; but, for now, we've only seen this on MIPS64,
where we use gcc.) This tripped over one use of Q_DECLARE_PRIVATE in
a private Q_SLOTS: section; for some reason, gcc didn't like the
semicolon on the friend declaration. Changing the context to plain
private fixed that.
Fixes: QTBUG-72885
Change-Id: I5edc11d46bd4eb820713adede79d53191a7e2736
Reviewed-by: Liang Qi <liang.qi@qt.io>
Reviewed-by: Ville Voutilainen <ville.voutilainen@qt.io>
Reviewed-by: Boxiang Sun <daetalusun@gmail.com>
Qt for Python users reading the documentation assume that int(0) can
be passed for pointer parameters. Use the newly introduced \nullptr to
disambiguate this.
In a follow-up step, the \nullptr macro can be defined as None
when generating the Qt for Python documentation.
Task-number: PYSIDE-903
Change-Id: I3a45f87175a0668ab5f3f95f0aff409f7e3ef027
Reviewed-by: Cristian Maureira-Fredes <cristian.maureira-fredes@qt.io>
Reviewed-by: Christian Tismer <tismer@stackless.com>
Reviewed-by: Venugopal Shivashankar <Venugopal.Shivashankar@qt.io>
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
Since it explains nothing and now, after some other bug was fixed
(see, for example, c89d0f9d53), we trigger this message on the
first request, which happens because:
- 'createSession()' indeed, creates a session, compares a previous
kwnon state (which happens to be 'Invalid') with a current state,
which is 'Connected' and then invokes '_q_networkSessionStateChanged'.
- '_q_networkSessionStateChanged()' on 'Connected' emits
'networkSessionConnected()' to which a newly-created QNetworkReplyHttpImpl
will respond with it's _q_startOperation().
- QHttpNetworkReplyImpl will also try to 'open' a session, its 'opened()'
signal will trigger, again, 'networkSessionConnected()' and ... the
next _q_startOperation().
Now, not to add even more twisted spaghetti if/conditions with some
unpredictable regressions, let's suppress a useless warning and
silently return. We, indeed, in 'Working' state, let's keep working.
Task-number: QTBUG-72463
Change-Id: I5282979920915ffded889c20b8ae740a46efef04
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
When setting dtls configuration, we should also copy
backendConfig, otherwise this setting will be ignored.
Change-Id: I4df53e8e6d8c2bd0eb7dddb9928b7883c401d60a
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Also blacklist tst_QRawFont::unsupportedWritingSystem() and
tst_QGlyphRun::mixedScripts() on windows for now.
Conflicts:
qmake/generators/makefile.cpp
src/corelib/itemmodels/qstringlistmodel.cpp
src/platformsupport/fontdatabases/windows/qwindowsfontengine_p.h
tests/auto/corelib/itemmodels/qstringlistmodel/tst_qstringlistmodel.cpp
tests/auto/gui/text/qglyphrun/BLACKLIST
tests/auto/gui/text/qrawfont/BLACKLIST
Task-number: QTBUG-72836
Change-Id: I10fea1493f0ae1a5708e1e48d0a4d7d6b76258b9
The macro disappeared.
qnetworkinterface_unix.cpp:467:14: error: use of undeclared identifier 'IFM_FDDI'; did you mean 'IFT_FDDI'?
Fixes: QTBUG-72775
Change-Id: I548dbfddb69b4fd6a0a3fffd1574e1ad4e670e5b
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
since we'll refuse to continue with a handshake, failing in initSslContext()
on a disabled protocol versions. Then, functions like waitForEncrypted,
connectToHostEncrypted, startServerEncryption and startClientEncryption
should either bail out early (who needs a TCP connection which we'll
abort anyway?) or bail out whenever we can, as soon as a disabled protocol
was found in a configuration. This change also makes the behavior
of different back-ends consistent, since it's a general code-path
that reports the same SslInvalidUserData error. Update auto-test to
... actually test what it claims it tests.
Task-number: QTBUG-72196
Task-number: QTBUG-72179
Change-Id: I548468993410f10c07ce5773b78f38132be8e3e0
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
there is no particular reason to exclude static builds from the default.
misses are cheap now, so it's fine if nothing is found.
this affects only the legacy pre-1.1 library names under windows.
Change-Id: I998b9f7bfcce42ec990a236bb44372c4d6b3f631
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
both the mingw and msvc build have a "lib" prefix on the libraries. this
makes the msvc build unconventional, so it needs an extra source. for
the mingw build, otoh, this is the expected setup, so the source used
for unix will work just fine.
this doesn't fix any actual bug, because mingw will apparently resolve
-llibfoo to libfoo.a even though only liblibfoo.a and libfoo.lib are
documented (on mingw.org). however, this mix of conventions is ugly and
should be avoided.
Change-Id: I32b1621e4ac15db1f071c08ced738bfdafdcc11b
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
don't run the openssl_headers test pointlessly when openssl-linked is
selected but its test fails. implementing this cleanly required creating
a separate openssl-runtime feature, including 'redirecting' the -openssl
option (which is just an alias for -openssl-runtime) to it.
simplify the openssl-linked conditions: while "anything but the value
that enables it" in the 'disable' field effectively means "don't
auto-detect it", it's better to be explicit about that.
Change-Id: I6b117cc50711bb64d090fcfdb89ff009c60ed86c
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
I think this may have been for some POST method form queries, but
obviously was missing something.
Task-number: QTBUG-72382
Change-Id: I59016776aeedf4b5599b3b44af70610babb0a61e
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
Reviewed-by: Ryan Chu <ryan.chu@qt.io>
in addition to the actual library resolution, also resolve the headers
belonging to the library, to validate the include path, and possibly
ensure that the right version of the library is present.
the "include" entries were moved out of the "test" objects, and renamed
to "headers". this cleanly permits libraries without compile tests.
the headers were not put into the sources, because the variance among
the includes is generally orthogonal to the variance among the
libraries.
note that this - like the library resolution - provides no support for
darwin frameworks. consequently, the opengl libraries are excluded from
the conversion on darwin.
similarly, wasm is excluded (centrally), because emcc is magic and would
need advanced wizardry to be dealt with.
Change-Id: Ib390c75371efa2badcfec9b74274047ce67c3e5a
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
Update references in documentation from the obsoleted/deprecated version
because it doesn't make sense here to refer to these versions.
Change-Id: I5e9bdf46191e3ba0c7d91855cb3ccc30097cd412
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
As per RFC 6176 (2011) and RFC 7568 (2015).
Code-wise, we're left with the decision of what to do with a few
enumerators in QSsl::Protocol; I've made TlsV1SslV3 act as TlsV1,
and adjusted the description of AnyProtocol.
A new test was introduced - deprecatedProtocol() - to test that
we, indeed, do not allow use of SSL v2 and v3. protocol() and
protocolServerSide() were reduced to exclude the (now) no-op
and meaningless tests - neither client nor server side can
start a handshake now, since we bail out early in initSslContext().
[ChangeLog][QtNetwork][SSL] Support for SSLv2 and SSLv3
sockets has been dropped, as per RFC 6176 (2011)
and RFC 7568 (2015).
Change-Id: I2fe4e8c3e82adf7aa10d4bdc9e3f7b8c299f77b6
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
The map can contain multiple entries for one key,
so a multi map is the correct data structure.
Change-Id: I852ba3548f46415d8078fd0e8fdd7953ec6c370b
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
When a PAC script is used on macOS, it will only allow connections for
http/https, although a proxy can be used for ws/wss. Therefore we need
to add a means of setting the protocol type for this sort of connection
so that we can pass on the necessary information to the PAC script.
Change-Id: I3fa29fa85a529bd88d9565daa58fe9d748b61a92
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
We filter out Content-Length from the cache metadata due to IIS
sending it bogusly on 304 responses; however, we were only doing this
if the cached response had a Content-Length header, which doesn't
happen when the original request was delivered chunked. Furthermore,
the filtering wasn't limited to the case of 304 responses. So skip
the "had it previously" requirement and only do this for 304s.
Fixes: QTBUG-72035
Change-Id: Ie5d858e0f0205bf68f0a13a9c9d4a6e844cb3568
Reviewed-by: Joni Poikelin <joni.poikelin@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
And having duplicated entries in the hash doesn't make any sense. So use
regular iteration and insert for streaming the data in and out.
Change-Id: Ic3983010bdb9e17b207c6038fdccf43659da0e23
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
This patch introduces a private 'API' to enable server-side OCSP responses
and implements a simple OCSP responder, tests OCSP status on a client
side (the test is pretty basic, but for now should suffice).
Change-Id: I4c6cacd4a1b949dd0ef5e6b59322fb0967d02120
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Usually we embed the private key for the leaf certificate, but in
Schannel _q_makePkcs12 is also used to create a certificate store for
our CA certificates, which we don't have any private key for.
So lift this restriction.
Change-Id: Ic86a2a6725f2c8272c951148eb97e18a964a36f2
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Remove braces for single-line bodies, space around binary operators
Change-Id: I958396772966428dcd9694279175fd61d6109b40
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This patch enables OCSP stapling in QSslSocket::SslClientMode (OpenSSL back-end
only). OCSP stapling is described by RFC6066 and based on the original OCSP as
defined by RFC2560. At the moment multiple certificate status protocol is not
supported (not implemented in OpenSSL). SecureTransport does not support OCSP
stapling at the moment.
[ChangeLog][QtNetwork][TLS] Added OCSP-stapling support for OpenSSL backend
Task-number: QTBUG-12812
Task-number: QTBUG-17158
Change-Id: Id2e0f4cc861311d1ece462864e5e30c76184af8c
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
this considerably speeds up failures, as no doomed build is attempted,
and produces more reliable results, as no second lookup (which would be
subject to environment changes) is done any more during the build.
in principle, this also opens up possibilities like selecting specific
variants of dependencies, automatically extracting rpaths, etc.
qt_helper_lib.prf also needs to create fully resolved library names now.
Change-Id: I65f13564b635433030e40fa017427bbc72d1c130
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
no need in duplicating DTLS-specific cases.
Change-Id: I475c6fb53daa44d60a5054bf3acc8474355b2186
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Turns out that also Debian patches OpenSSL 1.0, changing its soname to "1.0.2".
Therefore, try also to load that one.
Amends 2708c6c11d.
Task-number: QTBUG-68156
Change-Id: I37cc060e90422779a6c29a324ab900f0fb99cfa7
Reviewed-by: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
This is necessary to provide details for the key too,
when the server is using DHE-RSA-AESxxx-SHAxxx.
Amends 7f77dc84fb.
Change-Id: I8ab15b6987c17c857f54bc368df3c6c1818f428c
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
SSL_CTX_set_ciphers is new in 1.1.1.
Task-number: QTBUG-71983
Change-Id: If0ae9f95dcc867c62ed0d3a6a60c22c7f5e1cc9f
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
strlcpy is not available on some UNIX platforms, such as GNU/kFreeBSD.
qstrncpy is available everywhere and has similar semantics (in addition
it fills the rest of buffer size with NULL bytes, but that does not
cause extra work as our buffer sizes are small).
Change-Id: I76c5905eba248fd9fbc1f63f05e88e0617f8407a
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
We report two types of errors - those found by our code and errors
coming from the OS. setErrorString(), despite its name, does not just
set a string, but extracts a windows error code via GetLastError() and
then calls _q_winError(). This is wrong: some arbitrary error code (or
no error) can be reported when it was actually an error found by
Qt. Worse yet, string operations (allocations etc.) can potentially
clear the real error code. So remove setErrorString(), set errors
explicitly if it's the application code error or use _q_WinError
directly.
Task-number: QTBUG-71744
Change-Id: I67277d84006c4ad365f5636caf850e1f3ba4e1dc
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
We use std::vector and thus RAII instead of manual memory management.
std::vector (re)allocates only if needed, growing exponentially,
initializing only new elements. std::vector<>::resize also makes
initialization loop redundant
Task-number: QTBUG-71156
Change-Id: I253bb428c0fb641872f0f7f2dcfe1f9e89db0296
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Mikhail Svetkin <mikhail.svetkin@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
We have linked against Crypt32 for a while.
Change-Id: I7ec9401a63d7405e4b5357d6589501e997e31aca
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
When a TCP connection timed out a QAbstractSocket::NetworkError was set.
To enable a more precise error handling for timeouts
QAbstractSocket::SocketTimeoutError is now set instead.
Separated ETIMEDOUT from other errors in nativeRead() and take over
responsibility for setting the error, which was previously handled by read().
Change-Id: Iccd45bdbb3d944cd160ae50c257d3256e05b1ae5
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: David Faure <david.faure@kdab.com>
The function's documentation needlessly repeated parts of its first
line. The BindFlag enum it takes as a parameter confused readers by
saying an option is ignored on Windows, failing to make clear that it
is so because that option is what Windows does by default.
Tidied some phrasing and typos in the process.
Fixes: QTBUG-52364
Change-Id: Ia6510caff7ec80216eefccf41fb009b1357e4b2e
Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
The engine used to send a UDP datagram to the local address to check
the proxy setup, but the check fails in case of the proxy hosted in
WAN and the local address hidden behind a NAT. In other words the
check fails because a public proxy hosted somewhere in internet has
no access to local addresses such as 192.168.1.2.
Remove the check to fix the issue; we still have other means to
detect network errors.
Change-Id: Ib6df263c87ebd7d6e88a0b5e024e78a559995234
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
1. Remove the conditional inclusion of DTLS versions, they made difficult
and unnecessary ugly adding new protocols (something like TlsV1_2OrLater + 4).
2. OpenSSL 1.1.1 first introduced TLS 1.3 support. OpenSSL 1.1 back-end is
compatible with OpenSSL 1.1.1, but would fail to extract/report protocol
versions and set versions like 'TLS 1.3 only' or 'TLS 1.3 or better' on a
new context. Given 1.1.1 is deployed/adapted fast by different distros,
and 5.12 is LTS, we fix this issue by introducing QSsl::Tls1_3 and
QSsl::Tls1_3OrLater.
SecureTransport, WinRT and OpenSSL below 1.1.1 will report an error in case
the application requests this protocol (SecureTransport in future will
probably enable TLS 1.3).
Saying all that, TLS 1.3 support is experimental in QSslSocket.
Done-by: Albert Astals Cid <albert.astals.cid@kdab.com>
Done-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Change-Id: I4a97cc789b62763763cf41c44157ef0a9fd6cbec
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
This update eliminates ALL parsing errors when clang parses the
Qt headers to build the precompiled header qdoc needs. These errors
are often cases where an old use of Q_QDOC no longer works because
clang sees the enclosed fake declarations as erroneous.
In a few cases, clang reported errors because two dummy function
declartations under the Q_CLANG_QDOC guard were indistinguishable,
so one of them was removed, and the documentation was patched
accordingly.
Using the macro Q_DECLARE_INTERFACE(...) causes clang to report errors
because the class parametewr is abstract. These uses of the macro are
not needed, so they are removed with #ifndef Q_CLANG_QDOC.
Some declarations of default GL types that had been provided for qdoc
were no longer needed, so they are removed.
Now there are some member function signatures in QDBusPendingReply
and QDBusPendingCall that have very long template clauses and qualifiers
in their signatures. These unwieldy signatures will be unnecessary in the
documentation and will look bad there, but for now they are correct. The
ultimate solution will be to add a metacommand to qdoc, something like
\simplify-signature to tell qdoc to generate the documentation for these
member functions without the long template caluses and qualifiers.
Change-Id: I012cf17a544fbba2ebc71002f31bdc865119bb8e
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
Reviewed-by: Topi Reiniö <topi.reinio@qt.io>
Reviewed-by: Martin Smith <martin.smith@qt.io>
Attempts to use QSslSocket and its OpenSSL 1.1 back-end with OpenSSL 1.1.1
in a very peculiar way (for some reason the reporter calls OPENSSL_no_config())
combined with a bug in OpenSSL 1.1.1 resulted in a QSslSocket dead-locking
in initialization. This was happening because supportsSsl() first reported
false (OpenSSL internally fails to initialize after OPENSSL_no_config()),
but we have s_libraryLoaded set to true too early, thus the first supportsSsl()
returns false, the second - true.
Move setting of s_libraryLoaded later so that we don't claim to support
OpenSSL when an earlier ensureLibraryLoaded() attempt failed.
Task-number: QTBUG-70956
Task-number: QTBUG-71446
Change-Id: I8ad8763d357c84fc38c62e2ce914366367c2b445
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
This update removes the requirement for dtls to be present when qdoc
runs so that qdoc can parse qdtls.h.
_#ifndef Q_CLANG_QDOC
QT_REQUIRE_CONFIG(dtls);
_#endif
Change-Id: I69ba5e378bebe86f93830d14e3956eb0d677508e
Reviewed-by: Martin Smith <martin.smith@qt.io>
Some Linux distributions patch OpenSSL's soname, making builds
on such distributions not deployable elsewhere. The problem is that
the code loading OpenSSL symbols would attempt to use the soname
of the build machine, and therefore not finding the OpenSSL
libraries on the deploy system.
The binary builds of Qt for Linux are affected by this problem,
as they build under RHEL7.4 which changes to soname of OpenSSL to
a non-standard string. This makes the binary builds not pick up
OpenSSL 1.0 from the machine where the build gets installed on.
Given that in the pre-1.1 versions only the 1.0 series is supported,
bump the minimum requirement of Qt to that. The 1.0.x releases
(up to 1.0.2, at the time of this writing) have kept binary
compatibility, and advertise a soname of "1.0.0", which is used
by most distributions.
So, if loading of OpenSSL with the build-time soname fails,
try to load them with the "1.0.0" hardcoded soname.
[ChangeLog][QtNetwork][SSL] OpenSSL >= 1.0 is now required to build
Qt with OpenSSL support.
Task-number: QTBUG-68156
Change-Id: Ieff1561a3c1d278b511f09fef06580f034f188c6
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
It's needed to generate a pkcs12/pfx bundle from our
certificate chains which are then imported into a certificate
store in Schannel and then passed to various Schannel API.
Change-Id: Idb88f42f2aa15eb91c52404ee6c57bf43e983379
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Also, call it only if the state really changes. If we stay disconnected
the whole time, there is no point in trying to create the session over
and over.
Change-Id: Ic3a92dd0575bed1a23ae36a944cc51b9741fb64a
Fixes: QTBUG-49760
Reviewed-by: Jesus Fernandez <Jesus.Fernandez@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
We need to override this snippet for the documentation
we generate for Qt for Python, and it is easier to have
it on a separate file.
Task-number: PYSIDE-801
Task-number: PYSIDE-691
Change-Id: Ideb5b6af25024279f167137d3b65660bb9c96a7e
Reviewed-by: Topi Reiniö <topi.reinio@qt.io>
If you, directly after connecting, call "ignoreSslErrors()" followed by
"resume()" then you will most likely crash.
It is very contrived and there's no reason to do this.
Change-Id: I949a303238f5012296d0e84eb76173764eb9de2e
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
and fix handling of incoming binary data
Change-Id: I31e97505ad4ff64cf8e380df5d0d6b70c3cd60b0
Reviewed-by: Ryan Chu <ryan.chu@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
In iOS, the system certificates cannot be accessed, so this function
will return an empty list for the default configuration.
Task-number: QTBUG-60407
Change-Id: I0d691a0dd5e6367594e71c7ebccfbdc866d4a3f0
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Testing barely 10.13 seems to be insuficcient: we have developers working
on macOS 10.12 with SDK 10.13, but apparently they cannot update to the
latest SDK 10.13. We can try to be more specific and use __MAC_10_13_4.
Task-number: QTBUG-70757
Change-Id: I083d51f1a945f63f0413792387475341ecb96118
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Andy Maloney <asmaloney@gmail.com>
As it's done (albeit in old-style there) in other public QSsl-classes.
Task-number: QTBUG-70604
Change-Id: If3cd9da0e8f8378fd29a80215cd889e459aa7bce
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
According to the SSL_CTX_set_max_proto_version manpage [1]:
> Setting the minimum or maximum version to 0, will enable protocol
> versions down to the lowest version, or up to the highest version
> supported by the library, respectively.
This should make it possible to use Qt Network with older versions of
libssl than it was compiled against. In particular, use with 1.1.0 when
compiled against 1.1.1.
Also, one of OpenSSL developers is suggesting to remove TLS_MAX_VERSION
from the public header in the future [2].
[1] https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_max_proto_version.html#DESCRIPTION
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908567#59
Change-Id: Ie76054b917daa8e54d5c0156e848dbaca7bb8a82
Reviewed-by: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Under the hood we use QSettings to store HSTS policies.
Qt configured with 'no feature settings' would fail to
build then. For such builds, we fall back to in-memory
only HSTS cache.
Change-Id: I6df551d8c6c96d982080a51ce6b1bdce71d04b9f
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
While these destructors are essentially trivial and contain no code,
the classes inherit QObject and thus have virtual tables. For such
classes -Wweak-vtable generates a warning: "'Class' has no out-of-line
virtual method definitions; its vtable will be emitted in every translation
unit." Noticed this after updating QtCreator to the latest version.
Change-Id: Iacb5d0cd49353bd35260aff736652542bb1ef197
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Add override, disable copies where appropriate and use = default
for trivial functions.
Change-Id: Ia5bc7419b1aa053c5503ea7dfaf11cb6dfafd2e2
Reviewed-by: Oliver Wolff <oliver.wolff@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Gabriel de Dietrich <gabriel.dedietrich@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This is the squashed diff from wip/webassembly to dev.
Done-with: Peng Wu <peng.wu@intopalo.com>
Done-with: Sami Enne <sami.enne@intopalo.com>
Done-with: Morten Johan Sørvig <morten.sorvig@qt.io>
Started-by: Andrew Knight <andrew.knight@intopalo.com>
Change-Id: I6562433c0a38d6ec49ab675e0f104f2665f3392d
Reviewed-by: Lorn Potter <lorn.potter@gmail.com>
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Replace by reinterpret_cast or const_cast, respectively.
Use auto when initializing a variable to fix Clang warnings
about repeating the type name, do minor tidying along the way,
and a few conversions of 0 or NULL to nullptr.
Change-Id: Ieb271a87ddcf064f536e1ff05d23b1e688b1b56a
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Add a definition for qIsEffectiveTLD for when Qt is configured with
-no-feature-topleveldomain. Then we can merge the #if-#else branch.
Change-Id: I91bc329ab95744a2e10dcc4168cd8b84f8fee9f6
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
At some point we stopped supporting "Plain", "CramMd5" and "Login" but
their entries in the enum and a few lines of code related to them were
left behind.
Change-Id: Id8186c9a0760b3b2382544579aa1148ff8125ac4
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Provides two convenient getter for a display name of the subject and
issuer. This simplifies cases where you just want a simple string
describing either of the two.
Change-Id: Ia5d0e058f14dae067b13ac7360e7fec4edd9ec53
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Add it to configure.json and replace all occurrences of QT_NO_THREAD
with QT_CONFIG(thread). Add conditions for other features that depend
on thread support. Remove conditions where we can use the QMutex and
QThreadStorage stubs.
Change-Id: I284e5d794fda9a4c6f4a1ab29e55aa686272a0eb
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Respect allowRootCertOnDemandLoading, as it's done in QSslSocket (well,
almost as in QSslSocket).
Change-Id: Ic6cbb24a91e92cdb20f5f749553f15a62aae8b02
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Previously, the function had a different name that made its purpose
clear - "abort after peer verification error was encoutered". Since
now it's just 'abort handshake', it also should abort an ongoing
handshake, even if no peer verification error found so that we
now have an API that can reset a QDtls object to its initial
'nothing done yet' state.
Change-Id: Idadfec6f82d65c8f07d1c2afa4467c921c7e85c4
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
This update corrects several minor documentation errors that
were introduced by a recent change to QDtls.
Change-Id: I6ee6b0bf74c82dca86ba8d5f39acbd642829ec44
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
This update corrects several minor documentation errors that
cause qdoc warnings. These include incorrect or missing \fn
commands, incorrect uses of \e and \a commands together,
incorrect spellings, etc.
Change-Id: Ib26edef541fa3440025490bcf79cc101623e7f7b
Reviewed-by: Martin Smith <martin.smith@qt.io>
A weird behavior of the DTLS server example, when linked with 1.0.2,
exposed that client code, requesting an invalid protocol (for example, SSLv3)
can end-up with connection encrypted with DTLS 1.2 (which is not that bad,
but totally surprising). When we check the protocol version early in
setDtlsConfiguration() and find a wrong version, we leave our previous
configuration intact and we will use it later during the handshake.
This is wrong. So now we let our user set whatever wrong configuration they
have and later fail in TLS initialization, saying -
'Unsupported protocol, DTLS was expected'.
Auto-test was reduced - the follow-up patch will introduce a new
'invalidConfiguration' auto-test.
Change-Id: I9be054c6112eea11b7801a1595aaf1d34329e1d2
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
And reflow the text where it exceeds the 100 column limit.
Change-Id: I0d270c6a74a4c6ecba30e4e4d38a5d8f2cf81040
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
As discussed/proposed previously: remove the duplicated code when converting the
native certificate representation into QSslCertificate (configuration.peerCertificate).
Also, use the correct integer type when iterating - CFIndex is actually long, not int.
Change-Id: Ia6f43172e21b5153a93f1ef2589980d68ec2b39f
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Specify that we're calling QLocalSocket::close in dtor.
While it's virtual it will not call any overloads at this time.
From cppcheck.
Change-Id: I7b8030ab96e1568cbb2a378ceaf07b2ecabf054f
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
QNetworkAccessBackend has a QSharedPointer called uploadByteDevice.
QNetworkAccessDebugPipeBackend and QNetworkAccessFileBackend both
duplicated the member, by taking a copy of the raw pointer, while also
shadowing the QNetworkAccessBackend's member by reusing the name.
Change-Id: I91f4e8d43d95c5f30c5bc2571393804209b7a843
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Also remove unneeded and now wrong check (was marked with TODO)
which was a copy and paste from OpenSSL counterpart. There, testing
if peerCertificateChain.isEmpty() makes sense, since there we
potentially call storePeerCertificates() twice during the handshake.
Change-Id: I946e6876adb3f9504e93c06ac90ff36dd44aca4c
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
It appears that by default our keychain auto-locks when the
system sleeps. This makes the keychain totally useless, since
its password is a random 256 bytes our user never has a chance
to know. Thanks to Mårten for the hint about SecKeychainSetSettings,
the way to properly fix it.
Task-number: QTBUG-69677
Change-Id: I2603c26b8422a1bcace3336e9b4ebe0381c952d7
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
When the connection has been encrypted we will,
in QHttpNetworkConnectionChannel::_q_encrypted, emit 'reply->encrypted'
in which user slots can be called.
In the event that the user calls abort it will, however, not abort until
the next time it goes back to the event loop (which might not happen
until after the request has already been sent).
Task-number: QTBUG-65960
Change-Id: I96865f83c47f89deb9f644c86a71948dbb0ec0d0
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
That's actually how ignoreVerificationErrors (and QSslSocket::ignoreSslErrors)
are used to set the expected/known verification errors before handshake.
Auto-test updated too.
Change-Id: I9c700302d81ddb383a4a750fafd594373fb38ace
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
As now the feature 'dtls' depends on the feature 'openssl' - ifdefs
are redundant, this code is always 'openssl-only'.
Change-Id: I6a7fe9e3a00ae05656af1626e7de74e813df5d32
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Unfortunately, this enum is not 'binary', it also has 'UnencryptedMode'
and as a result we can end up with server-side method/context.
Change-Id: If2da4c1b9f7e9ff916d933c9517c00a632aea324
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Change-Id: I719856168a254c90b0bb0943faee5ab0be75b0bd
Reviewed-by: Martin Smith <martin.smith@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
More Qt-style and more natural, also, shorter names.
Change-Id: I97bd68a8614126d518a3853027661435dc4e080d
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
After a handshake was completed, TLS socket is in 'connectionEncrypted' state.
So on a read notification, in 'transmit', we call 'SSLRead' to read supposedly
encrypted application data or TLS internal messages. In case SSLRead finds either
ClientHello or HelloRequest from a server, it attempts in a rather sneaky manner
to renegotiate. And as it happens here and there with SecureTransport, SSLRead
fails and the work is only half-done, since we have kSSLSessionOptionBreakOnServerAuth
and kSSLSessionOptionBreakOnCertRequested options set to 'true'. We end up with
completely unexpected errors like errSSLClientCertRequested or errSSLPeerAuthCompleted
(yes, this is so normal and totally expected for 'SSLRead' function to verify
certificates and WRITE messages, no need to document this at all!).
If SecureTransport is sneaky, so can be us:
- in a read callback SecureTransport is probing the type of record
and we can notice a sudden session state change - it goes from
kSSLConnected (which is set upon handshake completion) to
kSSLHandshake (which means a (re)handshake is ongoing);
- if this is the case - we lie to SecureTransport about the amount
of data available (0 bytes), set 'renegotiating' to 'true', return
errSSLWouldBlock;
- in 'transmit', if SSLRead returns errSSLWouldBlock and 'renegotiating'
was set, we call 'startHandshake' until isHandshakeComplete() == true
or some error encountered.
[ChangeLog][QtNetwork][QSslSocket] Implement renegotiation for SecureTransport backend
Task-number: QTBUG-69420
Change-Id: Iaab1336aa3abf3f6ac94b358f3142d2738a18ee9
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This patch renames rather awkward 'remote' into more conventional
'peer' (similar to what we have in QAbstractSocket).
Change-Id: Ifc45e538b8adf9cc076bd7aee693277829fd94dc
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
The wording was quite confusing and misleading - if not set exlicitly,
QNetworkRequest::sslConfiguration() will initialize configuration to
be equivalent of QSslConfiguration::defaultConfiguration(), not what
the documentation stated.
Task-number: QTBUG-13418
Change-Id: Id578db47ec75031376f73db42108053655fbf5c3
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Initially macOS SDK 10.13 had a missing symbol (only a function declaration
in a header), while iOS, tvOS and watchOS SDKs all had the required symbol. Now
it appears more recent SDK for macOS also has the function we need and thus we enable
ALPN on macOS (as a result 'h2' protocol can now be negotiated as required by
RFC 7540).
[ChangeLog][QtNetwork][QSslSocket] Enable ALPN (and thus HTTP/2 negotiation) in SecureTransport backend (macOS).
Change-Id: I65bd8262a9571a5495d11f7f5a29d150334cd09c
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
No need in ugly macro ioErr and if-ery, no need in generic noErr.
SecureTransport has its own, more specific error codes: errSecIO
and errSecSuccess (which have the equivalent values).
Change-Id: Ifd99fbcbee290fe27caa0c258923f4527c047ba8
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
OpenSSL has 'no-dtls' configure option (or can be too ancient to properly
support it), we shall respect such builds. This patch extends configure.json
with a 'dtls' test and adds protection against linkage/compile-time
issues in the QtNetwork's code.
Change-Id: I0c0dd94f5c226115cee4285b82c83aa546555aea
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Christian Ehrlicher
Liang Qi
Mårten Nordheim
Joerg Bornemann
Timur Pocheptsov
Qt Forward Merge Bot
Edward Welbourne
Friedemann Kleint
Lorn Potter
Nico Vertriest
Sona Kurazyan
Samuel Gaist
Thiago Macieira
Oswald Buddenhagen
Giuseppe D'Angelo
Lars Knoll
Andy Shaw
Lars Schmertmann
Dmitry Shachnev
Ivan Komissarov
Sven Erdem
Alexander Akulich
Martin Smith
Ulf Hermann
Cristian Maureira-Fredes
Leena Miettinen
Aleix Pol
Venugopal Shivashankar
Morten Johan Sørvig
Allan Sandfeld Jensen
Paolo Angelelli
Andre Hartmann
Jesus Fernandez