Currently the cipher preferred by the client will always be used for SSL
connections. This change makes it so that by default the ciphers
specified by the server will be used (like the Apache SSLHonorCipherOrder
option). This behavior can be disabled using a new SslOption.
[ChangeLog][QtNetwork][QSslSocket] QSslSocket will now default to using
the cipher preferences of the server socket when used as an SSL server.
This can be disabled using the QSslConfiguration.
Change-Id: I2d16d10145cf88a7412f30ef960d87024777de1c
Reviewed-by: Peter Hartmann <peter-qt@hartmann.tk>
This allows further QTcpSocket inheritance in library. Using of this
c'tor is applicable to different socket types that makes them consistent
with existing TCP socket API.
Change-Id: Iafa25c365b88f52d8a3e816a296ee888ceaeb16b
Reviewed-by: Richard J. Moore <rich@kde.org>
When making a QNetworkAccessManager query, don't require a network
session in case of file:/ queries, like we do when "localhost" is the
hostname or a loopback device.
Change-Id: I4faab7cf356ee53e6e13ab55b152365680af9446
Reviewed-by: Albert Astals Cid <albert.astals@canonical.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
This patch fixes several upload corruptions if the server closes the connection
while/before we send data into it. They happen inside multiple places in the HTTP
layer and are explained in the comments.
Corruptions are:
* The upload byte device has an in-flight signal with pending upload data, if
it gets reset (because server closes the connection) then the re-send of the
request was sometimes taking this stale in-flight pending upload data.
* Because some signals were DirectConnection and some were QueuedConnection, there
was a chance that a direct signal overtakes a queued signal. The state machine
then sent data down the socket which was buffered there (and sent later) although
it did not match the current state of the state machine when it was actually sent.
* A socket was seen as being able to have requests sent even though it was not
encrypted yet. This relates to the previous corruption where data is stored inside
the socket's buffer and then sent later.
The included auto test produces all fixed corruptions, I detected no regressions
via the other tests.
This code also adds a bit of sanity checking to protect from possible further
problems.
[ChangeLog][QtNetwork] Fix HTTP(s) upload corruption when server closes connection
Change-Id: I54c883925ec897050941498f139c4b523030432e
Reviewed-by: Peter Hartmann <peter-qt@hartmann.tk>
To avoid source-incompatibilites, wrap in QT_DEPRECATED_SINCE(5, 5)
in public headers.
Change-Id: I6117e8a6b11200d2f1a0a94a0e87d5c27538218e
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
To avoid source-incompatibilites, wrap in QT_DEPRECATED_SINCE(5, 5)
in public headers.
Change-Id: Ic3398f4f330e15a3b55065858add26b90fd70e6c
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
Some kinds of socket options can be applied only to newly created
descriptors. However, a current QAbstractSocket implementation proceeds
to actions immediately after the socket layer initialization. This
disallows a socket tuning in further inheritance.
Add a private virtual configureCreatedSocket() method that gives an
ability to set the socket options before binding or connecting.
Change-Id: I2d858a400cd46ae7fe5bf0b8900220f6121d0132
Reviewed-by: Richard J. Moore <rich@kde.org>
Currently, socket options setting is hardcoded in QTcpServer::listen()
function after the engine initialization and before a binding to the
address. This disallows a socket tuning in further QTcpServer inheritance.
Add a private virtual configureCreatedSocket() method that gives an
ability to set the socket options before listening.
Change-Id: Ice9b477e64f21daee96c0ec6d27a8408f9e1aa93
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
On Windows, we perform an extra certificate lookup for root CAs that
are not in Windows' (minimal) root store. This check can take up to
15 seconds. The SSL context can already be gone once we return. Hence
we now check for a non-null SSL context on Windows before proceeding.
Change-Id: I1951569d9b17da33fa604f7c9d8b33255acf200d
Reviewed-by: Richard J. Moore <rich@kde.org>
We need it because otherwise code like
QNetworkConfigurationManager ncm;
qDebug() << "ONLINE" << ncm->isOnline();
may give the wrong value because the queued signals that have been just connected a few lines above
may not have been processed yet
Change-Id: I959db75ed17497ab91eeba2669ee2c8947244f00
Reviewed-by: Alex Blasche <alexander.blasche@theqtcompany.com>
Takes care about unencrypted data in the socket writeBuffer when
close() flushes the output.
Change-Id: I301f41ea709817e215ee4246a3951e3182d94fbd
Reviewed-by: Richard J. Moore <rich@kde.org>
previously the whole response was cached in a NSMutableData which leads
to high memory usage on large responses (e.g. downloading a large file).
With this patch only the part of the answer that has not yet been read
by the caller is cached.
Task-number: QTBUG-41356
Change-Id: Ic2fe822552620d8835a2c81f8c76dd170fe6ec97
Reviewed-by: Morten Johan Sørvig <morten.sorvig@theqtcompany.com>
Remove DataWriter usage and share the write implementation with the rest of the class.
Change-Id: I87734d1bf65ad2e602279317c625885d6f829b6a
Task-number: QTBUG-44051
Reviewed-by: Oliver Wolff <oliver.wolff@theqtcompany.com>
New SSL backend fails to read data most of the time.
This patch:
1. Removes direct call to _q_SSLRead - it was never executed (intentionally)
and is completely horrible and redundant.
2. Changes the reading loop - read not while we have bytesAvailable, but
until we have errSSLWouldBlock.
Change-Id: I3fc5ff94ded76fcc1748d4979f7af85740b4b6aa
Task-number: QTBUG-45290
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: Jeremy Lainé <jeremy.laine@m4x.org>
Reviewed-by: Timur Pocheptsov <Timur.Pocheptsov@digia.com>
No point in having them separate, as that's a recipe for mistakes.
Change-Id: Iee8cbc07c4434ce9b560ffff13ca4132cd1879ed
Reviewed-by: Richard J. Moore <rich@kde.org>
Fix access or uninitialized memory. It is safe in this case, but causes
valgrind's memcheck to complain unnecessarily.
Change-Id: I01ad09d282b07f7099ad6bed85f4327b3c7c677f
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
We need to make sure that a large scope ID saved in a QString does get
converted properly back to an integer.
Change-Id: Iee8cbc07c4434ce9b560ffff13c9bd0e9008bd9c
Reviewed-by: Richard J. Moore <rich@kde.org>
Let's make sure we don't accidentally have it wrong in one of the three
versions.
Change-Id: Iee8cbc07c4434ce9b560ffff13c9bcf75ba66a66
Reviewed-by: Richard J. Moore <rich@kde.org>
Fixes unnecessary indirect return value and deprecated construction
of QString from QByteArray.
Change-Id: I4b654348285923ac1df39fc03784175ad6acb674
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@theqtcompany.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Change-Id: I9d6771e9da64e59f8a038dd3b506e6293fcb62c0
Reviewed-by: Jan Kundrát <jkt@kde.org>
Reviewed-by: Shawn Rutledge <shawn.rutledge@digia.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
The native socket engine sets the socketProtocol to that when it means
it's using IPv6 with v4 compatibility on (v6only = false).
We mustn't have faced problems so far because the multicast tests set
don't test v6only = false.
Change-Id: Iee8cbc07c4434ce9b560ffff13ca0aff60673940
Reviewed-by: Richard J. Moore <rich@kde.org>
Suddenly :(( With Security Framework v 7.0 dated by 17/02 SSLHandshake
works differently when our server socket is requesting a client side authentication
and client provides no certificate. Despite of kTryAuthenticate (this means,
auth. _can_ fail) server receives an error from SSLHandshake too early.
We have to handle this in startHandshake (when serveMode && canIgnore).
Change-Id: Ie55540078e2944e80cf2f4ade8b000acf29d6ca2
Reviewed-by: Richard J. Moore <rich@kde.org>
According to I/O API, QIODevice and its inherited classes should be
able to process a full 64-bit offsets and lengths. This requires
64-bit parameters in operations with internal buffers. Rework
QRingBuffer to avoid implicit truncation of numbers and fix some
64-bit issues in code.
Change-Id: Iadd6fd5fefd2d64e6c084e2feebb4dc2d6df66de
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
One of the reasons why we use "int" everywhere: to avoid this annoyance
about different types and having to explicitly cast to silence the
compiler.
qsslsocket_openssl.cpp(690) : warning C4267: 'argument' : conversion from 'size_t' to 'int', possible loss of data
Change-Id: Ia0aac2f09e9245339951ffff13c8bdad334ce108
Reviewed-by: Richard J. Moore <rich@kde.org>
It has been a historical mistake that there wasn't a const overload.
Change-Id: Ia0aac2f09e9245339951ffff13c8d8b70f206a99
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
The same qt_timeout_value function was copied 5 times in qtbase's code,
so provide a common implementation in QIoDevice that can be used by
everyone.
This commit also corrects the remaining time calculation in
QProcess::waitForBytesWritten and QProcess::waitForFinished by using
this new function.
For QProcess::waitForFinished, if the process started within almost exactly
the timeout time passed to waitForFinished, msecs - stopWatch.elapsed() would
be -1, which is a special value.
Change-Id: I7b76ee6bae695eafdd02e3db03e2ff1e23a7f40c
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
This commit adds support for following HTTP redirect responses on a per
request basis.
This behavior is disabled by default. It can be switched on by
setting the QNetworkRequest::FollowRedirectAttribute to true.
2 new error codes have been added to QNetworkReply:
* TooManyRedirectsError: Set when the number of redirects exceed a
given value set by the user (defaults to 50 if not set)
* UnsecureRedirectError: Set when we are redirecting from a 'https'
to 'http' protocol.
Test cases for the following scenarios:
* Single HTTP redirect using local test server
* Changing max-redirects
* Testing all redirect related error scenarios
The next commit will extend this feature at a QNAM level.
Task-number: QTBUG-8232
Change-Id: If9e28ad12bad08bcdc5bc511b1cd59dc9d8150f0
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
A mistake in const correctness resulted in the incoming QByteArray
getting modified when it shouldn't. I have no ldea if this could result
in user-visible effects.
Change-Id: Ia0aac2f09e9245339951ffff13c8d8c6b4f909bd
Reviewed-by: Richard J. Moore <rich@kde.org>
This allows one to check whether the conversion is successful without
checking for the return result, as the value of 0 represents the valid
IPv4 address 0.0.0.0.
Change-Id: I637fe55583f2255c85b0d955e5886b61494e0c7c
Reviewed-by: Richard J. Moore <rich@kde.org>
Unlike localhost (127.0.0.1), there's really no point in using
::ffff:0.0.0.0, since you shouldn't be sending packets to it. Linux
transforms 0.0.0.0 to localhost, but that's non-standard and won't work
on other OSs, so it's still a bad idea.
Change-Id: I5982b21bf953e11e04fc19893f94be90ed29089b
Reviewed-by: Richard J. Moore <rich@kde.org>
In 85136496bc, Shane made QHostAddress
automatically convert any IPv6 address that was v4-mapped to IPv4 in
QHostAddress. While that is an interesting trick, it prevents us from
being specific about what we want. On some OS (like FreeBSD and OS X),
the distinction is relevant, so keep it.
Moreover, it was inconsistent: it might fail depending on how the
QHostAddress was constructed and the order of comparison.
[ChangeLog][Important Behavior Changes] QHostAddress will no longer
convert IPv6 addresses of type "v4-mapped" to IPv4. To perform this
conversion manually, construct another QHostAddress with the result of
toIPv4Address().
Change-Id: I06afbc7018539804bb3044ef1fe6a49ac7a5f240
Reviewed-by: Richard J. Moore <rich@kde.org>
QNetworkReplyImpl::abort immediately returns at the beginning of the function
when the state is already finished, and the state does not get changed by the
code in between - so this condition will always be true.
Change-Id: Ia98df7cbecf471c7236b5e17caddd1301b647d2b
Reviewed-by: Peter Hartmann <peter-qt@hartmann.tk>
If our socket is already of a given type (probably due to a previous
call to bind()), then constrain the incoming target address to be of the
same family. On some OSs, trying to send or connect to an IPv4 address
from an IPv6 socket will fail with EINVAL, even if the socket is not in
"v6only" mode.
bind() can't be called after already being bound, but the function can
still be called on a socket created by the user and passed on with
setSocketDescriptor().
Change-Id: I209a1f8d0c782c6b6de2b39ea4cfad74d63f3293
Reviewed-by: Richard J. Moore <rich@kde.org>
This has been known to be broken for a while. Now it works: you can bind
and you'll retain the port (and the file descriptor) for the connect
call. Incidentally, in fixing the binding for more than one IP for the
hostname (with event loop), this commit fixes the setSocketDescriptor
XFAIL.
[ChangeLog][QtNetwork] Fixed a bug that caused both QTcpSocket and
QUdpSocket to close the socket and lose any bound ports before
connecting. Now bind()/setSocketDescriptor() followed by connect() will
retain the original file descriptor.
Task-number: QTBUG-26538
Change-Id: I691caed7e8fd16a9cf687b5995afbf3006bf453a
Reviewed-by: Richard J. Moore <rich@kde.org>
invalid conversion from ‘unsigned char**’ to ‘const unsigned char**’
Task-number: QTBUG-44744
Change-Id: I6263db106fe28c6aa04db8ca79421b3a9fc5adc9
Reviewed-by: Richard J. Moore <rich@kde.org>
Reasons:
- the PlayBook NDK is old and its compiler does not keep up with newest
C++11 improvements inside Qt code.
- the PlayBook NDK diverges considerably from the standard BB10 NDK,
making it non-trivial to keep a common codebase.
- It's a defunct platform.
- Maintenance time is limited.
[ChangeLog][Platform Specific Changes] Removed BlackBerry PlayBook support.
Change-Id: Ia338aff55f4e4b747ebdecb0e1463a369a656c03
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Bernd Weimer <bernd.weimer@pelagicore.com>
Reviewed-by: Rafael Roquetto <rafael.roquetto@kdab.com>
Do not return early on Windows if bytes are still in the buffer.
This is not in line with the behavior on other platforms,
and also breaks apps where the caller knows that the
bytes available are insufficient.
[ChangeLog][Network][QLocalSocket] On Windows, waitForReadyRead
now always waits for more data, even if bytes are still in the
buffer.
Task-number: QTBUG-16688
Change-Id: I1425a5780c7707295374934a6b5446ff8e148cc8
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
This change is a step closer to working with openssl 1.2 which makes
this struct opaque.
Change-Id: I3897142657edc0fa4053142b6ef743c2b00c013e
Reviewed-by: Peter Hartmann <peter-qt@hartmann.tk>
Linux's socket(2) system call can take SOCK_NONBLOCK and let us avoid
the extra two fcntl(2) to change the setting after it's created.
Change-Id: Ie0d7a2d51acc21acd850cbee6d0f76e27b1ae859
Reviewed-by: Richard J. Moore <rich@kde.org>
Enable certificate/trust validation when socket is in server mode.
Change-Id: I8fbba587a9484084495722219d83cca57973a3e6
Reviewed-by: Jeremy Lainé <jeremy.laine@m4x.org>
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: Timur Pocheptsov <Timur.Pocheptsov@digia.com>
...where passing them by value was not intentional.
Change-Id: Ifd5036d57b41fddeeacfbd3f5890881605b80647
Reviewed-by: Shawn Rutledge <shawn.rutledge@digia.com>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Use the
QDebugStateSaver saver(debug);
debug.resetFormat().nospace();
idiom to unify the formatting and whitespace handling.
Change-Id: Id346d63b3f589b60ca19e4459271d587f1a0c003
Reviewed-by: Richard J. Moore <rich@kde.org>
Instead of using sprintf (and #ifdef'ing our way around Windows warnings),
simply do the conversion from uchar to hex digits ourselves, using
QtMiscUtils.
Also used the Qt::Uninitialized QString ctor, as the result length is
exactly known ahead of time.
Change-Id: Ie42e5f11c608e7719f7dc33d72739c1e41901b3b
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
QAbstractSocket::close() always calls QIODevice::close(), which resets
QIODevice's internal read buffer. So it makes no sense to make same calls
from disconnectFromHost(). This made the closeCalled private member
superfluous.
Change-Id: I4ec64e9711490e44e737763e4ed7fb41bffe2556
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Since the algorithm can only be one the underlying structure can
share the same memory.
Change-Id: Ifeaa1a2d5c4ad3566cbbf847445b805876275260
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Qt copyrights are now in The Qt Company, so we could update the source
code headers accordingly. In the same go we should also fix the links to
point to qt.io.
Outdated header.LGPL removed (use header.LGPL21 instead)
Old header.LGPL3 renamed to header.LGPL3-COMM to match actual licensing
combination. New header.LGPL-COMM taken in the use file which were
using old header.LGPL3 (src/plugins/platforms/android/extract.cpp)
Added new header.LGPL3 containing Commercial + LGPLv3 + GPLv2 license
combination
Change-Id: I6f49b819a8a20cc4f88b794a8f6726d975e8ffbe
Reviewed-by: Matti Paaso <matti.paaso@theqtcompany.com>
The cipher is always valid here, so this check was never needed anyway.
Change-Id: I22be273d166702926b98f0c9443657a1dde65f6e
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
There were still ifdefs for openssl 0.9.7 and openssl 0.9.8f.
[ChangeLog][QtNetwork] Some legacy ifdefs for openssl 0.9.7 and openssl 0.9.8f
were removed, Qt will no longer build with these versions. In addition there
is no support for openssl built with NO_TLSEXT.
Change-Id: I9268515c0a125a2f6d79add8ee1cb40768e7e898
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
The postfix increment(decrement) creates a temp copy of *this before the
modification and then returns that copy. It's needed only when using the
old iterator and then incrementing it.
Change-Id: I7f6702de78f5f987cec3556047e76049b4ee063a
Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com>
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
libproxy is not part of Qt's public interface, but a helper library
used by Qt. Treat it as such by using LIB_PRIVATE.
Task-number: QTBUG-44326
Change-Id: I014f992e4b7a51de1e5a7407ce1bd08dd5352136
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
The OpenSSL backend for QSslSocket return an incomplete peer certificate
chain when in server mode: it does not include the peer's certificate as
the first element of the chain.
This change fixes this issue.
Change-Id: I2f0815bca2f314a075b48a2d0b5a6d5b7af50722
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
kernel/qnetworkproxy_libproxy.cpp:152:57: error: suggest parentheses around comparison in operand of ‘&’ [-Werror=parentheses]
if (proxy.capabilities() & requiredCapabilities == requiredCapabilities)
Change-Id: I37eba3443802e4949bab03e9cb4f3fb664fa492d
Reviewed-by: Richard J. Moore <rich@kde.org>
It will be used on Unix systems if the required dev package is
present. (Detected by a configure compile test.)
You can configure with -no-libproxy to avoid the dependency.
It will not be used on OS X or Windows, as we already implement
the native API for getting proxies there.
Currently we use whatever PAC runner is provided by the distro
for running PAC scripts - if we want to run PAC scripts using
Qt, then we would have to implement a pacrunner plugin to libproxy.
Note that their webkit pacrunner is using javascriptcore already.
Tested using the libproxy 0.4.7 that is included in Ubuntu 12.04.
Re-tested using Ubuntu 14.04 which ships libproxy 0.4.11.
It works except when both socks and http proxies are configured in
the manual settings - in that case libproxy returns only the socks
proxy. This seems to be covered by libproxy issue 119.
[ChangeLog][QtNetwork] Introduce libproxy backend for Unix platforms,
enabled automatically if the required dev package is present
Task-number: QTBUG-26295
Change-Id: I521c0a198fcf482386ea8a189114a0077778265c
Reviewed-by: Richard J. Moore <rich@kde.org>
... but choose HTTP/1.1 and continue connecting anyhow. According to
the NPN spec, actually we should choose SPDY:
"In the event that the client doesn't support any of server's protocols,
or the server doesn't advertise any, it SHOULD select the first protocol
that it supports."
However, some tested servers did not advertise anything and did not
support SPDY, so blindly trying the newest protocol would fail. We are
conservative in that case and choose HTTP.
Task-number: QTBUG-40714
Change-Id: Ia8aaf01fea74e13d9e4416306f85f1890b25559e
Reviewed-by: Richard J. Moore <rich@kde.org>
We do not support Windows older versions in the first place ...
Change-Id: I2cd3135f1b7f2dac6929c07624ea9373f4ac0ff1
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
The call to LookupAccountNameW from advapi32 was rewritten following
the example:
http://msdn.microsoft.com/en-us/library/aa392742%28v=vs.85%29.aspx
This prevents the generation of a garbage pointer when accessing
QWindowsSystemProxy::init() for Qt compiled as 64bit library
with MinGW-w64.
Task-number: QTBUG-39874
Task-number: QTBUG-38145
Change-Id: I620b2fa64941f84838f9a386851480285336e8d1
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@theqtcompany.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Move these types to QAsn1Element so that they can use the toString()
method which guards against malicious ASN.1.
Change-Id: I7d6155147a6fc2d41da6f3ae87551b6cb75aa9ce
Reviewed-by: Oliver Wolff <oliver.wolff@theqtcompany.com>
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
We don't currently use this class for critical things like hostname
verification however we still want to ensure that it is not possible
to trick it using ASN.1 strings with embedded NUL characters. This will
avoid problems in the future.
Change-Id: Ibf3bc142a94fc9cad5f06db50f375399a087f9dc
Reviewed-by: Jeremy Lainé <jeremy.laine@m4x.org>
Reviewed-by: Oliver Wolff <oliver.wolff@theqtcompany.com>
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
Classes should either use or not use override, otherwise it hurts
code readability.
Some inline keywords were removed because of an error with MSVC2010:
error C2216: 'override' cannot be used with 'inline'
Change-Id: I7276d5525a92281bd0d743beb11d0dc73441443b
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Because Proxy Auto Configuration performs DNS lookups,
the proxy settings are being cached. For long-running
programs this means that once users switch e.g. from or
to company networks with a proxy, they instantly will
lose connectivity because we cache the old setting.
To remedy this, we monitor the Registry (locations
courtesy of Chromium's platform support) for changes
in its settings, and requery for the current proxy in
that case.
Task-number: QTBUG-3470
Task-number: QTBUG-29990
Change-Id: Id25a51387bcd232c5f879cea0371038986d0e2de
Reviewed-by: Oliver Wolff <oliver.wolff@theqtcompany.com>
Add support for SSL on iOS/OS X by adding a SecureTransport based
backend.
[ChangeLog][QtNetwork][QSslSocket] A new SSL backend for iOS and OS X,
implemented with Apple's Secure Transport (Security Framework).
Change-Id: I7466db471be2a8a2170f9af9d6ad4c7b6425738b
Reviewed-by: Richard J. Moore <rich@kde.org>
Change-Id: I9c09a3e2dfb90eb22d4509ac6c450a0bb5da48f6
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Expose the same kind of TLS PSK client support we already have set
in place for QSslSocket.
[ChangeLog][QtNetwork][QNetworkAccessManager] It is now possible to use
TLS PSK ciphersuites when using HTTPS (or similar protocols working over
SSL).
Change-Id: I56a048e9f4f841f886758c781af2867d18538a3e
Reviewed-by: Richard J. Moore <rich@kde.org>
[ChangeLog][QtNetwork][QSslSocket] It is now possible to use TLS PSK
ciphersuites in client sockets.
Task-number: QTBUG-39077
Change-Id: I5523a2be33d46230c6f4106c322fab8a5afa37b4
Reviewed-by: Richard J. Moore <rich@kde.org>
The documentation says that QUdpSocket emits readyRead() only for one
datagram and that if you don't read it, the class will not emit again.
That should be implemented by disabling of the socket notifier once we
have the datagram already read, but was broken.
In turn, that breakage caused a live-lock of the event loop: since we
didn't disable the notifier nor read the pending datagram, the event
loop would fire every time for the same datagram.
The re-enabling of the notifier was already working.
Task-number: QTBUG-43857
Change-Id: Ic5d393bfd36e48a193fcffff13bb32ad390b5fe8
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Make it easier for the compiler to apply the
Named Return Value Optimization (NRVO) in the
shortName()/longName() functions by not returning
different objects in different return statements.
Change-Id: I1b6fa7e6121bc1c843378be33499728c56c97f92
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
Rationale: the case of an invalid QSslEllipticCurve is already
dealt with before we'd call ensureInitialized(). But in order
to have a non-invalid QSslEllipticCurve, we must have called
one of the constructor functions first. There, we already call
ensureInitialized(), so we don't need to do it here again.
Change-Id: I96bdb5db63ec0165e6b8fac9469b5d81c6b2cdae
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
Since the conversion to a long name was already there, also support
creation from a long name.
Change-Id: Iad712db7447fb0a0a18f600b7db54da5b5b87154
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
They were added in 233a2f37bf, which is in
5.4, but the \since information was missing.
Change-Id: I346a049cad75647fdcd7b64df80dc169bb4ec70a
Reviewed-by: Richard J. Moore <rich@kde.org>
Fixes an issue where under certain circumstances, QSslSocket could get
stuck in a state where it would disconnect immediately after starting
encryption. Since it doesn't make any sense for the socket to be
initialized to a state where any connection attempt will fail, the
pendingClose value should be set to false.
Thanks to Martin Sandsmark for his help debugging this issue.
Task-number: QTBUG-43793
Change-Id: I7deebacbac588c21439a8e594db4222095cf3f22
Reviewed-by: Richard J. Moore <rich@kde.org>
This allows further QTcpServer inheritance in library. Also,
add protected c'tor for this purpose.
Change-Id: I1a5c0cdedd64bcd41b028e09d7752248506296c7
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Add possibility to get length and other information of EC based
certificates. Also it is possible to parse those public/private
keys from PEM and DER encoded files.
Based on patch by Remco Bloemen
[ChangeLog][QtNetwork][SSL/TLS support] It is now possible to
parse elliptic curve certificates.
Change-Id: I4b11f726296aecda89c3cbd195d7c817ae6fc47b
Task-number: QTBUG-18972
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Since openssl 1.0.1k with enabled option no-ssl3-method we need to
check for OPENSSL_NO_SSL3_METHOD to use following functions:
- SSLv3_method
- SSLv3_server_method
- SSLv3_client_method
Change-Id: Iee83a6f4bacbf5660baa6bdb89eb02ceb9f11614
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Add the missing definition for IFF_RUNNING like
documented on http://ports.haiku-files.org/wiki/CommonProblems
Change-Id: Iea3fa224dc8e7e1e36674026efbb28289d2efa2a
Reviewed-by: Augustin Cavalier <waddlesplash@gmail.com>
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
The outer QNativeSocketEngine::bind() function will call
fetchConnectionParameters() as soon as nativeBind() returns, so don't
bother copying localAddress.
Change-Id: Ice13e507ccb9c575a7d3bdf0b41394f35230b746
Reviewed-by: Richard J. Moore <rich@kde.org>
There's no need to allocate memory for the special address.
Change-Id: I5f3760565807731ab595e91fc934c21d10df212a
Reviewed-by: Richard J. Moore <rich@kde.org>
If reset is disabled then POST and PUT requests can not be authenticated
as the upload device can not be reset. There shouldn't be any reason
that shouldn't be allowed if the QIODevice given supports resetting.
The disableReset feature of QNonContiguousByteDevice is removed as it
is not used anywhere else, and is redundant when reset can indicate
success or failure.
Task-number: QTBUG-43628
Change-Id: If941a98fd3f797872351c10bdca6aa6745dbefea
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
The documentation for CFURLCreateDataAndPropertiesFromResource()
does not make this clear but from looking at the CFNetwork implementation
and a user stacktrace it appears that this function can return true
but not set the data argument under certain circumstances.
Change-Id: I48034a640d6f47a51cd5883bbafacad4bcbd0415
Task-number: QTBUG-36787
Patch-By: Robert Knight
Reviewed-by: Markus Goetz <markus@woboq.com>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
This commit checks whether CFURLCreateWithString() succeeded.
It does not appear to be possible to enter an empty URL directly in the
PAC configuration dialog but I can't rule out the possibility
that it could find its way into the settings via some other means.
Change-Id: I6c2053d385503bf0330f5ae9fb1ec36a473d425d
Patch-By: Robert Knight
Task-number: QTBUG-36787
Reviewed-by: Markus Goetz <markus@woboq.com>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
macQueryInternal() was retrieving the PAC URL string as-entered by
the user in the 'Proxies' tab of the system network settings dialog
and passing it to CFURLCreateWithString().
CFURLCreateWithString() returns null if the input string contains
non-URL legal chars or is empty.
Change-Id: I9166d0433a62c7b2274b5435a7dea0a16997d10e
Patch-By: Robert Knight
Task-number: QTBUG-36787
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
Reviewed-by: Markus Goetz <markus@woboq.com>
This does not try to remove support for RVCT. There has been no report
of it working or failing to work, so the status continues to be unknown.
In particular, the inline assembly code in atomic_armv[56].h remains in
place.
This commit only removes workarounds for compiler bugs or bogus
warnings, assuming that anyone using this compiler has updated since Qt
last tried to use it for Symbian in 2011. Note also how anonymous unions
are now part of the language in C++11.
Change-Id: Idc4fab092beb31239eb08b7e139bce2602adae81
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
With toString(), it was printing "0.0.0.0", which is the same as
QHostAddress::AnyIPv4, making it difficult to tell the two apart.
Change-Id: I4668ec3337c25ddfdc2fa3bbacc83b9d34316b1f
Reviewed-by: Richard J. Moore <rich@kde.org>
QUdpSocket doesn't support binding to QHostAddress::Any and then joining
an IPv4 multicat group since QHostAddress::Any is really an IPv6 socket
with v6only = false. The test did check this case, but failed to ignore
the warning.
Change-Id: I62d782408319a6e566e0ff1a6081b706ac1f669c
Reviewed-by: Richard J. Moore <rich@kde.org>
The order is:
1) own header
2) own private header, if any
3) other headers
Commit f17d7a124f broke the order.
Change-Id: I7225024691db91fd936a057accdad65bacb3f979
Reviewed-by: Richard J. Moore <rich@kde.org>
The cookies may contain sensitive information. so we should not store cookies in disk cache.
Task-number: QTBUG-42546
Change-Id: I6331bdd766445af41f55bfaf0e9132b75dd7957f
Reviewed-by: Jeongmin Kim <jm86.kim@lge.com>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
The Qt bug tracker URL changes as part of the qt.io transition
Change-Id: Icb4ab198943b93639b5e3a8d99262303785c6459
Reviewed-by: Kai Koehne <kai.koehne@theqtcompany.com>
Place all debug output into the 'qt.network.ssl' category.
This allows people to disable certain warnings at runtime.
Task-number: QTBUG-43173
Change-Id: Ide731fae3109f9cd7730cc096ee069a5b99d35f1
Reviewed-by: Richard J. Moore <rich@kde.org>
NTLVMv1 is of historic interest only, since even Windows NT 4.0 already
supported NTLMv2. NTLVMv1 is also considered to be insecure.
Removing the code (that was not compiled in by default anyway) allows us
also to get rid of 3rdparty/des.
Change-Id: I5a9778f4250e1974c270ee6be539332318c09443
Reviewed-by: Richard J. Moore <rich@kde.org>
The keepalive socket can only be set if the socket is not connected
(see
http://msdn.microsoft.com/en-us/library/ie/windows.networking.sockets.streamsocketcontrol.keepalive)
Task-number: QTBUG-38623
Change-Id: Ia40dc66f071a8109538e4be7a8f420de81d5be8d
Reviewed-by: Alex Trotsenko <alex1973tr@gmail.com>
Reviewed-by: Leena Miettinen <riitta-leena.miettinen@theqtcompany.com>
Reviewed-by: Andrew Knight <andrew.knight@theqtcompany.com>
The App might use response data of Synchronous 401 reply. (example : specific error info of code, string as json)
so, Added a function to read it for Sync.
Async is already OK. Sync path is different from Async path.
Change-Id: I683d4b6b40f600793d2545811dcd6644515de79c
Task-number:QTBUG-43030
Reviewed-by: Jeongmin Kim <jm86.kim@lge.com>
Reviewed-by: Frederik Gladhorn <frederik.gladhorn@theqtcompany.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
Done automatically with clang-modernize on linux
(But does not add Q_DECL_OVERRIDE to the function that are marked
as inline because it a compilation error with MSVC2010)
Change-Id: I2196ee26e3e6fe20816834ecea5ea389eeab3171
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
The only reason for copying QSslEllipticCurves into a temporary array
would be to be extra-pedantic about type safety, but in the end,
we can simply force a cast and remove the copy.
Change-Id: Ice8a036fe4b79ba438ce83b5eacf6158eb3f0ce7
Reviewed-by: Richard J. Moore <rich@kde.org>
OpenSSL 1.0.2 introduces SSL_CTX_set_ecdh_auto, which allows us
to stop using one specific temporary curve, and instead makes
the server negotiate the best curve.
Task-number: QTBUG-42925
Change-Id: I3a68f29030bdf04f368bfdf79c888401ce82bdd8
Reviewed-by: Richard J. Moore <rich@kde.org>
Conflicts:
dist/changes-5.4.0
7231e1fbe2 went into 5.4 instead of the
5.4.0 branch, thus the conflict.
Change-Id: I70b8597ab52506490dcaf700427183950d42cbd1
[ChangeLog][QtNetwork][QtSSL] It is now possible to choose which elliptic
curves should be used by an elliptic curve cipher.
Change-Id: If5d0d58922768b6f1375836489180e576f5a015a
Done-with: Marc Mutz <marc.mutz@kdab.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
This makes it follow the coding style, which says to camel case acronyms too,
and makes it consistent with the rest of the class.
Change-Id: I4a1b21de1815530e476fc5aa8a0d41c724fc8021
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: hjk <hjk121@nokiamail.com>
If "encrypted" signal is fired the configuration of ssl is not updated.
If someone wants to perform additional checks on the certificate chain
it is now possible to use peerCertificate and peerCertificateChain.
Change-Id: Id5136a8c52727562c36028eaef721cc9ad86619d
Task-number: QTBUG-40401
Reviewed-by: Richard J. Moore <rich@kde.org>
While a POST request with no body may be a pointless thing it does
happen on many websites. Currently this causes QtNetwork to print a
warning to the console and set an invalid content-type. This patch
allows the content-type to be absent when content is.
Task-number: QTBUG-42479
Change-Id: Ia84c89147d2469a9421b9694d062c797987b3194
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Variable dsa is assigned in this block with q_DSA_new instead of rsa.
So this should be the destination of memcpy.
Change-Id: Id5a41d99f1606bf525ad5f819bbc06bb1235bf5b
Reviewed-by: Richard J. Moore <rich@kde.org>
There was still a TODO left in there and the data was never filled.
In addition to filling the data, some pointer checks for addr and port
were added.
Task-number: QTBUG-42244
Change-Id: I8e358b5544edcdb4077a52f433e4bc17d92014ce
Reviewed-by: Andrew Knight <andrew.knight@theqtcompany.com>
This allows apps to ship their own openssl libraries inside the
application bundle.
The change consists of two parts: First, adding
<bundle>/Contents/Frameworks
to the alternative search paths. Second, disabling the preemtive
check for libssl.dylib, libcrypto.dylib in the system paths:
The system's /usr/lib/libssl.dylib, /usr/lib/libcrypto.dylib
will still be picked up as a fallback in the alternative search
paths, but only after .app/Contents/Frameworks have been inspected.
[ChangeLog][QtNetwork][QSsl] On OS X and iOS, openssl dylib's are
picked up from the 'Frameworks' directory of the app bundle.
Change-Id: I982930f4a6cf5e0114c04ecbc87f27e54ba8bb88
Reviewed-by: Jake Petroules <jake.petroules@petroules.com>
QIODevice makes readData() call only when its read buffer is empty.
Also data argument points to the user or reserved read buffer area.
So, no need in data transfer from read buffer at this point at all.
Task-number: QTBUG-41797
Change-Id: Ieb4afdf7eec37fdf288073e4a060e64424f22b9c
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 1853579dad1bbb44599314213a1d8a203ecae1c9)
Reviewed-by: Alex Trotsenko <alex1973tr@gmail.com>
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Since QNAM is initialized with defaultConfiguration, we need to
reset the internal configuration used to the current
defaultConfiguration when the state changes and a new configuration
becomes the default.
Task-number: QTBUG-40234
Change-Id: I50f23c62804f29370915eecac2c92301c5f3ead2
Reviewed-by: Kai Koehne <kai.koehne@theqtcompany.com>
Reviewed-by: Alex Blasche <alexander.blasche@digia.com>
When sending a second request with implied credentials the connection
used may be cached as a connection without credentials, and thereby
incorrectly reused later for other connections with different implied
credentials.
This patch updates the credentials a cached http-connection is using
before sending a request on it.
Task-number: QTBUG-39456
Change-Id: I1609234136a89c32e00432a67720cd62a73a488a
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Fixes errors like
qsslsocket_openssl_symbols.cpp:111:6: error:
unused function 'qsslSocketUnresolvedSymbolWarning'
[-Werror,-Wunused-function]
void qsslSocketUnresolvedSymbolWarning(const char *functionName)
^
1 error generated.
Change-Id: I164518de583f080724ab9a7165c885602a1c6231
Reviewed-by: Richard J. Moore <rich@kde.org>
If requestedServerName is a full path e.g. "/tmp/some/long/path" the
temp path will end up "/tmp/some/long/path.balblabla/tmp/some/long/path"
and it might fail because it doesn't fit in addr.sun_path.
Change-Id: I6a138fd92be9e0b3b432ab9ac977d04cb330f3fd
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
The temp socket is in a safe place. There is no need to set any
permissions at this point.
Change-Id: I18ea4b71b7c20db65dc46c57ddc5d34d8b93f577
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Mode is always != 0 at this point (QLocalServer::WorldAccessOption is
a combination of the bits tested later).
Change-Id: I5abfb4e49fdc7903e21398525af05989f40d7f94
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Reviewed-by: BogDan Vatra <bogdan@kde.org>
After the poodle vulnerability SSLv3 should like SSLv2 no longer be
considered safe, so when a user request a safe protocol we should
only allow TLS versions.
[ChangeLog][QtNetwork][QSsl] QSsl::SecureProtocols now also excludes SSLv3
Change-Id: If825f6beb599294b028d706903b39db6b20be519
Reviewed-by: Richard J. Moore <rich@kde.org>
QNetworkDiskCache don't handle to set CookieHeader. so All Set-Cookie's value is invalid.
The root of cause is that metaDataChanged() don't work because of no slot for it.
Add the slot for it and renamed to _q_metaDataChanged.
Task-number: QTBUG-41514
Change-Id: I5cec017e59a1de69c6e89c0bc7209a73dcdc11da
Reviewed-by: Jeongmin Kim <jm86.kim@lge.com>
Reviewed-by: Jung Dong-Heon <clamp03@gmail.com>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
Set the reply state to "finished" also on errors.
Do a proper string compare to correctly translate
the error codes.
Task-number: QTBUG-42023
Change-Id: I222cc06a47b1f9f89095e8f935f316bf94fd0cd6
Reviewed-by: Caroline Chao <caroline.chao@theqtcompany.com>
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@digia.com>
Richard J. Moore
Alex Trotsenko
Liang Qi
Aleix Pol
Markus Goetz
Marc Mutz
Daniel Molkentin
Albert Astals Cid
Ludger Krämer
Peng Wu
Timur Pocheptsov
Simon Hausmann
Thiago Macieira
Allan Sandfeld Jensen
Daniel Teske
Frederik Gladhorn
Mandeep Sandhu
Florian Bruhin
Nikita Baryshnikov
Friedemann Kleint
Rafael Roquetto
Jani Heikkinen
Kai Koehne
Mikkel Krautz
Konstantin Ritt
André Klitzing
Maks Naumov
Olivier Goffart
Jeremy Lainé
Sérgio Martins
Peter Hartmann
Antonio Lotti
Giuseppe D'Angelo
Simon Hausmann
David Faure
Sze Howe Koh
Michael Marley
Oswald Buddenhagen
Tobias Koenig
Jędrzej Nowacki
Allan Sandfeld Jensen
Jeongmin Kim
Alex Blasche
Oliver Wolff
Alejandro Exojo
Kai Koehne
Lorn Potter
BogDan Vatra
Morten Johan Sørvig