This patch introduces a private 'API' to enable server-side OCSP responses
and implements a simple OCSP responder, tests OCSP status on a client
side (the test is pretty basic, but for now should suffice).
Change-Id: I4c6cacd4a1b949dd0ef5e6b59322fb0967d02120
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Usually we embed the private key for the leaf certificate, but in
Schannel _q_makePkcs12 is also used to create a certificate store for
our CA certificates, which we don't have any private key for.
So lift this restriction.
Change-Id: Ic86a2a6725f2c8272c951148eb97e18a964a36f2
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Remove braces for single-line bodies, space around binary operators
Change-Id: I958396772966428dcd9694279175fd61d6109b40
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This patch enables OCSP stapling in QSslSocket::SslClientMode (OpenSSL back-end
only). OCSP stapling is described by RFC6066 and based on the original OCSP as
defined by RFC2560. At the moment multiple certificate status protocol is not
supported (not implemented in OpenSSL). SecureTransport does not support OCSP
stapling at the moment.
[ChangeLog][QtNetwork][TLS] Added OCSP-stapling support for OpenSSL backend
Task-number: QTBUG-12812
Task-number: QTBUG-17158
Change-Id: Id2e0f4cc861311d1ece462864e5e30c76184af8c
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
this considerably speeds up failures, as no doomed build is attempted,
and produces more reliable results, as no second lookup (which would be
subject to environment changes) is done any more during the build.
in principle, this also opens up possibilities like selecting specific
variants of dependencies, automatically extracting rpaths, etc.
qt_helper_lib.prf also needs to create fully resolved library names now.
Change-Id: I65f13564b635433030e40fa017427bbc72d1c130
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
no need in duplicating DTLS-specific cases.
Change-Id: I475c6fb53daa44d60a5054bf3acc8474355b2186
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This is necessary to provide details for the key too,
when the server is using DHE-RSA-AESxxx-SHAxxx.
Amends 7f77dc84fb.
Change-Id: I8ab15b6987c17c857f54bc368df3c6c1818f428c
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
SSL_CTX_set_ciphers is new in 1.1.1.
Task-number: QTBUG-71983
Change-Id: If0ae9f95dcc867c62ed0d3a6a60c22c7f5e1cc9f
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
strlcpy is not available on some UNIX platforms, such as GNU/kFreeBSD.
qstrncpy is available everywhere and has similar semantics (in addition
it fills the rest of buffer size with NULL bytes, but that does not
cause extra work as our buffer sizes are small).
Change-Id: I76c5905eba248fd9fbc1f63f05e88e0617f8407a
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
We report two types of errors - those found by our code and errors
coming from the OS. setErrorString(), despite its name, does not just
set a string, but extracts a windows error code via GetLastError() and
then calls _q_winError(). This is wrong: some arbitrary error code (or
no error) can be reported when it was actually an error found by
Qt. Worse yet, string operations (allocations etc.) can potentially
clear the real error code. So remove setErrorString(), set errors
explicitly if it's the application code error or use _q_WinError
directly.
Task-number: QTBUG-71744
Change-Id: I67277d84006c4ad365f5636caf850e1f3ba4e1dc
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
We use std::vector and thus RAII instead of manual memory management.
std::vector (re)allocates only if needed, growing exponentially,
initializing only new elements. std::vector<>::resize also makes
initialization loop redundant
Task-number: QTBUG-71156
Change-Id: I253bb428c0fb641872f0f7f2dcfe1f9e89db0296
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Mikhail Svetkin <mikhail.svetkin@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
We have linked against Crypt32 for a while.
Change-Id: I7ec9401a63d7405e4b5357d6589501e997e31aca
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
When a TCP connection timed out a QAbstractSocket::NetworkError was set.
To enable a more precise error handling for timeouts
QAbstractSocket::SocketTimeoutError is now set instead.
Separated ETIMEDOUT from other errors in nativeRead() and take over
responsibility for setting the error, which was previously handled by read().
Change-Id: Iccd45bdbb3d944cd160ae50c257d3256e05b1ae5
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: David Faure <david.faure@kdab.com>
The function's documentation needlessly repeated parts of its first
line. The BindFlag enum it takes as a parameter confused readers by
saying an option is ignored on Windows, failing to make clear that it
is so because that option is what Windows does by default.
Tidied some phrasing and typos in the process.
Fixes: QTBUG-52364
Change-Id: Ia6510caff7ec80216eefccf41fb009b1357e4b2e
Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
The engine used to send a UDP datagram to the local address to check
the proxy setup, but the check fails in case of the proxy hosted in
WAN and the local address hidden behind a NAT. In other words the
check fails because a public proxy hosted somewhere in internet has
no access to local addresses such as 192.168.1.2.
Remove the check to fix the issue; we still have other means to
detect network errors.
Change-Id: Ib6df263c87ebd7d6e88a0b5e024e78a559995234
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
1. Remove the conditional inclusion of DTLS versions, they made difficult
and unnecessary ugly adding new protocols (something like TlsV1_2OrLater + 4).
2. OpenSSL 1.1.1 first introduced TLS 1.3 support. OpenSSL 1.1 back-end is
compatible with OpenSSL 1.1.1, but would fail to extract/report protocol
versions and set versions like 'TLS 1.3 only' or 'TLS 1.3 or better' on a
new context. Given 1.1.1 is deployed/adapted fast by different distros,
and 5.12 is LTS, we fix this issue by introducing QSsl::Tls1_3 and
QSsl::Tls1_3OrLater.
SecureTransport, WinRT and OpenSSL below 1.1.1 will report an error in case
the application requests this protocol (SecureTransport in future will
probably enable TLS 1.3).
Saying all that, TLS 1.3 support is experimental in QSslSocket.
Done-by: Albert Astals Cid <albert.astals.cid@kdab.com>
Done-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Change-Id: I4a97cc789b62763763cf41c44157ef0a9fd6cbec
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
This update eliminates ALL parsing errors when clang parses the
Qt headers to build the precompiled header qdoc needs. These errors
are often cases where an old use of Q_QDOC no longer works because
clang sees the enclosed fake declarations as erroneous.
In a few cases, clang reported errors because two dummy function
declartations under the Q_CLANG_QDOC guard were indistinguishable,
so one of them was removed, and the documentation was patched
accordingly.
Using the macro Q_DECLARE_INTERFACE(...) causes clang to report errors
because the class parametewr is abstract. These uses of the macro are
not needed, so they are removed with #ifndef Q_CLANG_QDOC.
Some declarations of default GL types that had been provided for qdoc
were no longer needed, so they are removed.
Now there are some member function signatures in QDBusPendingReply
and QDBusPendingCall that have very long template clauses and qualifiers
in their signatures. These unwieldy signatures will be unnecessary in the
documentation and will look bad there, but for now they are correct. The
ultimate solution will be to add a metacommand to qdoc, something like
\simplify-signature to tell qdoc to generate the documentation for these
member functions without the long template caluses and qualifiers.
Change-Id: I012cf17a544fbba2ebc71002f31bdc865119bb8e
Reviewed-by: Paul Wicking <paul.wicking@qt.io>
Reviewed-by: Topi Reiniö <topi.reinio@qt.io>
Reviewed-by: Martin Smith <martin.smith@qt.io>
Attempts to use QSslSocket and its OpenSSL 1.1 back-end with OpenSSL 1.1.1
in a very peculiar way (for some reason the reporter calls OPENSSL_no_config())
combined with a bug in OpenSSL 1.1.1 resulted in a QSslSocket dead-locking
in initialization. This was happening because supportsSsl() first reported
false (OpenSSL internally fails to initialize after OPENSSL_no_config()),
but we have s_libraryLoaded set to true too early, thus the first supportsSsl()
returns false, the second - true.
Move setting of s_libraryLoaded later so that we don't claim to support
OpenSSL when an earlier ensureLibraryLoaded() attempt failed.
Task-number: QTBUG-70956
Task-number: QTBUG-71446
Change-Id: I8ad8763d357c84fc38c62e2ce914366367c2b445
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
This update removes the requirement for dtls to be present when qdoc
runs so that qdoc can parse qdtls.h.
_#ifndef Q_CLANG_QDOC
QT_REQUIRE_CONFIG(dtls);
_#endif
Change-Id: I69ba5e378bebe86f93830d14e3956eb0d677508e
Reviewed-by: Martin Smith <martin.smith@qt.io>
Some Linux distributions patch OpenSSL's soname, making builds
on such distributions not deployable elsewhere. The problem is that
the code loading OpenSSL symbols would attempt to use the soname
of the build machine, and therefore not finding the OpenSSL
libraries on the deploy system.
The binary builds of Qt for Linux are affected by this problem,
as they build under RHEL7.4 which changes to soname of OpenSSL to
a non-standard string. This makes the binary builds not pick up
OpenSSL 1.0 from the machine where the build gets installed on.
Given that in the pre-1.1 versions only the 1.0 series is supported,
bump the minimum requirement of Qt to that. The 1.0.x releases
(up to 1.0.2, at the time of this writing) have kept binary
compatibility, and advertise a soname of "1.0.0", which is used
by most distributions.
So, if loading of OpenSSL with the build-time soname fails,
try to load them with the "1.0.0" hardcoded soname.
[ChangeLog][QtNetwork][SSL] OpenSSL >= 1.0 is now required to build
Qt with OpenSSL support.
Task-number: QTBUG-68156
Change-Id: Ieff1561a3c1d278b511f09fef06580f034f188c6
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
It's needed to generate a pkcs12/pfx bundle from our
certificate chains which are then imported into a certificate
store in Schannel and then passed to various Schannel API.
Change-Id: Idb88f42f2aa15eb91c52404ee6c57bf43e983379
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Also, call it only if the state really changes. If we stay disconnected
the whole time, there is no point in trying to create the session over
and over.
Change-Id: Ic3a92dd0575bed1a23ae36a944cc51b9741fb64a
Fixes: QTBUG-49760
Reviewed-by: Jesus Fernandez <Jesus.Fernandez@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
We need to override this snippet for the documentation
we generate for Qt for Python, and it is easier to have
it on a separate file.
Task-number: PYSIDE-801
Task-number: PYSIDE-691
Change-Id: Ideb5b6af25024279f167137d3b65660bb9c96a7e
Reviewed-by: Topi Reiniö <topi.reinio@qt.io>
If you, directly after connecting, call "ignoreSslErrors()" followed by
"resume()" then you will most likely crash.
It is very contrived and there's no reason to do this.
Change-Id: I949a303238f5012296d0e84eb76173764eb9de2e
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
and fix handling of incoming binary data
Change-Id: I31e97505ad4ff64cf8e380df5d0d6b70c3cd60b0
Reviewed-by: Ryan Chu <ryan.chu@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Morten Johan Sørvig <morten.sorvig@qt.io>
In iOS, the system certificates cannot be accessed, so this function
will return an empty list for the default configuration.
Task-number: QTBUG-60407
Change-Id: I0d691a0dd5e6367594e71c7ebccfbdc866d4a3f0
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Testing barely 10.13 seems to be insuficcient: we have developers working
on macOS 10.12 with SDK 10.13, but apparently they cannot update to the
latest SDK 10.13. We can try to be more specific and use __MAC_10_13_4.
Task-number: QTBUG-70757
Change-Id: I083d51f1a945f63f0413792387475341ecb96118
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Andy Maloney <asmaloney@gmail.com>
Timur Pocheptsov
Liang Qi
Mårten Nordheim
Oswald Buddenhagen
Samuel Gaist
Qt Forward Merge Bot
Lars Schmertmann
Dmitry Shachnev
Ivan Komissarov
Sven Erdem
Edward Welbourne
Alexander Akulich
Martin Smith
Giuseppe D'Angelo
Ulf Hermann
Cristian Maureira-Fredes
Lorn Potter
Leena Miettinen