Commit Graph

59 Commits

Author SHA1 Message Date
Richard J. Moore
50e8e95385 Add support for loading PKCS#12 bundles.
Add support for loading certificates and keys from PKCS#12 bundles
(also known as pfx files).

Task-number: QTBUG-1565

[ChangeLog][QtNetwork][QSslSocket] Support for loading PKCS#12
bundles was added. These are often used to transport keys and
certificates conveniently, particularly when making use of
client certificates.

Change-Id: Idaeb2cb4dac4b19881a5c99c7c0a7eea00c2b207
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
2014-05-11 23:50:03 +02:00
Frederik Gladhorn
dda9b5325f Add missing #ifndef QT_NO_SSL
Change-Id: I2912dcca77270582f6e989b8b3fb72b82f6f70d6
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
2014-04-25 10:55:31 +02:00
Richard J. Moore
814a1c7b2b Support for DH and ECDH key exchange for QSslSocket servers
Despite supporting DH and ECDH key exchange as a client, Qt did not provide
any default parameters which prevented them being used as a server. A
future change should allow the user to control the parameters used, but
these defaults should be okay for most users.

[ChangeLog][Important Behavior Changes] Support for DH and ECDH key exchange
cipher suites when acting as an SSL server has been made possible. This
change means the you can now implement servers that offer forward-secrecy
using Qt.

Task-number: QTBUG-20666
Change-Id: I469163900e4313da9d2d0c3e1e5e47ef46320b17
Reviewed-by: Daniel Molkentin <daniel@molkentin.de>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
2014-04-09 20:53:06 +02:00
Friedemann Kleint
5b00bb39f2 Polish tst_qsslsocket a bit.
Output the SSL library version, output socket error string on connection
failure consistently, silence numerous warnings about QIODevice not
being open in tst_QSslSocket::constructing.

Change-Id: Ia23d42de5b2daca55b2f6f50af025d61e99c52a0
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
2014-03-26 07:22:35 +01:00
Frederik Gladhorn
46791c08e1 Merge "Merge remote-tracking branch 'origin/stable' into dev" into refs/staging/dev 2014-01-21 17:57:54 +01:00
Richard J. Moore
5c19fad8c1 Ensure weak ciphers are not part of the default SSL configuration.
Any cipher that is < 128 bits is excluded from the default SSL
configuration. These ciphers are still included in the list
of availableCiphers() and can be used by applications if required.
Calling QSslSocket::setDefaultCiphers(QSslSocket::availableCiphers())
will restore the old behavior.

Note that in doing so I spotted that calling defaultCiphers() before
doing other actions with SSL had an existing bug that I've addressed
as part of the change.

[ChangeLog][Important Behavior Changes] The default set of
ciphers used by QSslSocket has been changed to exclude ciphers that are
using key lengths smaller than 128 bits. These ciphers are still available
and can be enabled by applications if required.

Change-Id: If2241dda67b624e5febf788efa1369f38c6b1dba
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
2014-01-21 03:41:34 +01:00
Frederik Gladhorn
9033977d39 Merge remote-tracking branch 'origin/stable' into dev
Conflicts:
	src/corelib/global/qglobal.h
	src/corelib/tools/qstring.cpp
	src/gui/image/image.pri
	src/gui/image/qimage.cpp
	src/plugins/platforms/cocoa/qcocoawindow.h
	src/plugins/platforms/cocoa/qcocoawindow.mm
	src/plugins/platforms/eglfs/qeglfshooks_stub.cpp
	tests/auto/corelib/io/qstandardpaths/tst_qstandardpaths.cpp

Change-Id: I3b9ba029c8f2263b011f204fdf68c3231c6d4ce5
2014-01-20 18:18:59 +01:00
Richard J. Moore
7c8131763d Prevent spurious SSL errors from local certificates.
Qt since approximately 4.4 has set the verify callback on both the SSL
store and the SSL context. Only the latter is actually needed. This is
normally not a problem, but openssl prior to 1.0.2 uses the verify
code to find the intermediate certificates for any local certificate
that has been set which can lead to verification errors for the local
certificate to be emitted.

Task-number: QTBUG-33228
Task-number: QTBUG-7200
Task-number: QTBUG-24234
Change-Id: Ie4115e7f7faa1267ea9b807c01b1ed6604c4a16c
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
2014-01-16 21:57:06 +01:00
Oliver Wolff
1efe5d4b41 WinRT: Fixed compilation of network autotests and benchmarks
Change-Id: Id689f199cfb22dce231cec36faba57ab958b1bac
Reviewed-by: Maurice Kalinowski <maurice.kalinowski@digia.com>
2013-12-06 15:06:47 +01:00
Sergio Ahumada
b0b754632e test: Skip some more qsslsocket flaky tests [part 2]
Task-number: QTBUG-29941
Change-Id: I28e71f952fcade6ab0aa76db71a1e2f408952830
Reviewed-by: Richard J. Moore <rich@kde.org>
2013-08-16 17:08:24 +02:00
Sergio Ahumada
983fa9b5cb test: Skip some more qsslsocket flaky tests
Task-number: QTBUG-29941
Change-Id: Iaf1c4834ef36db284464184639a1ab00928510cf
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
2013-08-13 17:08:13 +02:00
Sergio Ahumada
d6522b70ad test: Skip some flaky tests, but only if they are expected to fail
Task-number: QTBUG-29941
Change-Id: Ieca736c26711fa292855b3281229282628dce608
Reviewed-by: Richard J. Moore <rich@kde.org>
2013-08-10 22:31:42 +02:00
Peter Hartmann
e145b67fbd SSL internals: do not write after shutting down the socket
... but rather throw an error, so the HTTP layer can recover from a SSL
shutdown gracefully. In case the other side sent us a shutdown, we should
not send one as well, as it results in an error.

Change-Id: Ie7a56cf3008b6ead912aade18dbec67846e2a87e
Reviewed-by: Richard J. Moore <rich@kde.org>
2013-04-23 23:22:43 +02:00
Samuel Rødal
2ab9b747fc Merge remote-tracking branch 'gerrit/release' into stable
Conflicts:
	configure
	mkspecs/features/qt_module_headers.prf
	mkspecs/features/qt_tool.prf
	src/angle/angle.pro
	src/tools/bootstrap/bootstrap.pro
	tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp

Change-Id: Ide5759fe419a50f1c944211a48f7c66f662684e0
2013-03-21 08:49:01 +01:00
Samuel Rødal
678320788e Skip unstable tst_QSslSocket test case.
The connection to qt-project.org seems to be the one that causes this
particular test case to fail.

Task-number: QTBUG-29941
Change-Id: Ie5e430646997e86e3acb04132cd90a1773a091da
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>
2013-03-20 16:11:40 +01:00
Oswald Buddenhagen
76c0be34cd Merge branch 'dev' into stable
This starts Qt 5.1 release cycle

Conflicts:
	src/gui/text/qfontdatabase.cpp
	src/gui/text/qharfbuzz_copy_p.h
	src/widgets/kernel/qapplication.cpp
	src/widgets/kernel/qcoreapplication.cpp

Change-Id: I72fbf83ab3c2206aeea1b089428b0fc2a89bd62b
2013-03-20 13:49:28 +01:00
Stephen Kelly
ff84d2258f Don't fail on tst_QSslSocket::setReadBufferSize_task_250027
It is flakey and often blocks integration.

Task-number: QTBUG-29730

Change-Id: I8acfc243ec6a6782b7f7d78fc27827f3fdc1ce52
Reviewed-by: Stephen Kelly <stephen.kelly@kdab.com>
2013-03-15 10:04:03 +01:00
Richard Moore
7898080ca7 Add support for intermediate certificates to server sockets.
Add intermediate certificates to our server sockets, and to our client
certs.

Change-Id: Ib5aa575473f9e84f337bebe35099506dd7d7e2ba
Task-Number: QTBUG-19825
Task-Number: QTBUG-13281
Reviewed-by: Peter Hartmann <phartmann@rim.com>
2013-02-19 21:37:24 +01:00
Richard Moore
4a07519877 Store the local certificate in a QList.
Instead of storing a single QSslCertificate for a the local cert, store
a list of them. This will allow us to handle server sockets that use a
certificate that is not issued directly from the CA root in future.

Change-Id: I9a36b9a99daa9c0bdd17f61b4ce1a7da746f2e96
Reviewed-by: Peter Hartmann <phartmann@rim.com>
2013-02-19 21:37:14 +01:00
Giuseppe D'Angelo
e88011357e Merge "Merge remote-tracking branch 'origin/stable' into dev" into refs/staging/dev 2013-02-17 20:31:38 +01:00
Tor Arne Vestbø
2df8884bc6 Skip tst_QSslSocket::setReadBufferSize_task_250027()
It's flakey and is blocking integration. Tracked in QTBUG-29730.

Change-Id: Ia5b8f952314bf2e1aa6dbb5c5c0a97e32e68d0f6
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@digia.com>
2013-02-17 20:31:31 +01:00
Sze Howe Koh
7bb43454b8 Fix minor typos in docs, printed messages & comments
Missing apostrophes

Change-Id: I3ef5e9d494fb7a37f8e6075f24cd3a274e572c23
Reviewed-by: Jerome Pasion <jerome.pasion@digia.com>
2013-01-28 18:12:41 +01:00
Sergio Ahumada
48e0c4df23 Update copyright year in Digia's license headers
Change-Id: Ic804938fc352291d011800d21e549c10acac66fb
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
2013-01-18 09:07:35 +01:00
Sergio Ahumada
83188c6499 test: Change trolltech.com:443 to qt-project.org:443
trolltech.com seems to be shut down already

Change-Id: Ic90ce01aeb51b6f154b9bbf4762c365a398c9e3d
Reviewed-by: Simo Fält <simo.falt@digia.com>
Reviewed-by: Stephen Kelly <stephen.kelly@kdab.com>
2013-01-03 11:32:17 +01:00
Stephen Kelly
348c5bd19a Fix some typos in QProcess and QSslSocket unit tests.
The QSslSocket one is both wrong and redundant as there is a
Q_DECLARE_METATYPE for it already.

Change-Id: I63d065abfb3d0e3d82a8b1f29a6752b7676db847
Reviewed-by: Jędrzej Nowacki <jedrzej.nowacki@digia.com>
2012-12-04 14:41:43 +01:00
Marc Mutz
a4ffbfefe7 normalise signal/slot signatures [QtNetwork tests]
Change-Id: I2491cfe421a811d00759224da03580b3dcc2a091
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
2012-10-19 00:44:54 +02:00
Iikka Eklund
be15856f61 Change copyrights from Nokia to Digia
Change copyrights and license headers from Nokia to Digia

Change-Id: If1cc974286d29fd01ec6c19dd4719a67f4c3f00e
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
Reviewed-by: Sergio Ahumada <sergio.ahumada@digia.com>
2012-09-22 19:20:11 +02:00
Richard Moore
5ea896fbc6 Disable SSL compression by default.
Disable SSL compression by default since this appears to be the a likely
cause of the currently hyped CRIME attack.

Change-Id: I515fcc46f5199acf938e9e880a4345f2d405b2a3
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Peter Hartmann <phartmann@rim.com>
2012-09-18 14:12:17 +02:00
Brendan Long
860f95946b Add support for explicit TLS 1.1 and 1.2
Add SslProtocol enums TlsV1_1 and TlsV1_2 and use the appropriate OpenSSL
methods when they're selected (TLSv1_1_client_method, TLSv1_2_client_method,
TLSv1_1_server_method and TLSv1_2_server_method). This allows us to
explicitly use TLS 1.1 or 1.2.

Task-number: QTBUG-26866
Change-Id: I159da548546fa746c20e9e96bc0e5b785e4e761b
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
2012-08-29 14:22:54 +02:00
Marc Mutz
79b742b7e0 QtNetwork: use nullary version of qRegisterMetaType<T>("T")
Using the nullary version has the advantage that multiple calls
during a program run are much more efficient, since an inlined
atomic is used to store the result. It also ensures that
Q_DECLARE_METATYPE(T) has been used, whereas qRegisterMetaType<T>("T")
will happily register anything. So I've added the macro where it
was missing, or moved it to a central place when it existed
hidden.

In tst_qnetworkreply, this became a bit tricky, because a private
header is conditionally included, so moved the Q_DECLARE_METATYPE()
into a conditional section, too.

Change-Id: I71484523e4277f4697b7d4b2ddc3505375162727
Reviewed-by: Stephen Kelly <stephen.kelly@kdab.com>
2012-07-25 19:32:41 +02:00
Mitch Curtis
05d980664f Make QIODevice::seek() return false for sequential files.
Task-number: QTBUG-18173
Change-Id: Ie3a96d3a6f60995b8ba7823153778869d0c2dc58
Reviewed-by: Andy Shaw <andy.shaw@digia.com>
Reviewed-by: Jędrzej Nowacki <jedrzej.nowacki@nokia.com>
2012-06-05 13:12:58 +02:00
Shane Kearns
7578a9f69d Fix a QSslSocket test expectation on ubuntu 11.10
Because SSL2 is disabled in ubuntu's openssl binaries, the SSL
connection is expected to succeed rather than fail when the server
side is using SSL3/TLS1.0.
Used the OPENSSL_NO_SSL2 macro to decide this.

Change-Id: I2c35aa5aa0c9432ae78000c81f70086bdc31843d
Reviewed-by: Richard J. Moore <rich@kde.org>
2012-05-10 02:39:30 +02:00
Shane Kearns
bb234e238c Rename QAbstractSocket::PauseOnNotify -> PauseOnSslErrors
Although we created an enum for pause modes to make 5.x binary
compatible with 5.0, the enum value is not well named.
In 5.1, we propose to add PauseOnProxyAuthentication to the enum.
PauseOnNotify is not clear what it means, while PauseOnSslErrors is.

Any new notification in a minor release would need a new enum value
otherwise applications would get pauses they did not expect.

Task-number: QTBUG-19032
Change-Id: I4dbb7467663b37ca7f0551d24a31bc013968bedc
Reviewed-by: Richard J. Moore <rich@kde.org>
Reviewed-by: Lars Knoll <lars.knoll@nokia.com>
2012-05-04 03:11:17 +02:00
Debao Zhang
ade8888603 Don't use obsolete qVariantValue, qVariantCanConvert, etc.
qVariantValue and qVariantCanConvert are Compatibility members, while in
Qt4.8 they are marked as Qt 3 Support Members.

qVariantFromValue and qVariantSetValue are Obsolete members.

Change-Id: Ie8505cad1e0950e40c6f6710fde9f6fb2ac670fd
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@nokia.com>
2012-05-02 08:30:59 +02:00
Jason McDonald
3019c9da1a Remove insignification of qsslsocket test on Windows and Mac.
The test has a single stable failure on both of these platforms. Mark
the failure with QEXPECT_FAIL (that was already the case on Ubuntu
11.10) and re-enable the test.

Note also the elimination of duplicate bug numbers.

Task-number: QTBUG-24234
Change-Id: Ica11e7d1f3cd9487647127984fef7c75e0e764fe
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
2012-04-30 01:07:50 +02:00
Kalle Viironen
83c637aa94 Fix bug in qsslsocket peek()
Calling peek() for qsslsocket caused socket data to be copied into
qiodevices buffer and therefore make it unaccessible in qsslsocket.

Cherry picked form 4.8-branch & modified to Qt5 API changes
(int -> qintptr)
Original commits:
commit 621f18955082fc73471e75d1f8c35c2dcd4befeb
Author: Shane Kearns <ext-shane.2.kearns@nokia.com>
commit 68b1d5c17aa38d5921bdade2b0e0cb67c6c90513
Author: Kalle Viironen <kalle.viironen@digia.com>

Task-number: QTBUG-18498
Change-Id: I6be4b19baec2f3197537f5e7b61432040ec84ad2
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
2012-04-23 09:45:24 +02:00
Marc Mutz
0defa2782f tst_qsslsocket*: don't inherit from QSharedPointer
QSharedPointer is about to become final.

Instead of inheriting from it to add implicit
conversions to and from QSslSocket*, make
QSslSocketPtr a typedef, and make the
conversions explicit.

Change-Id: I4eebb262ab5aef348f4d676f9e839325d4ed13da
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
2012-03-23 11:22:40 +01:00
Shane Kearns
4bdc7e6f8b Mark unstable windows network tests
This is unfortunately still "most of them", because of QTBUG-24451
however some of the unit tests are still possible to test stably.

Also skipped test cases which would hang forever due to QTBUG-24451.

Bearer tests are not run, because they pass when test machine has no
wireless LAN, but fail or hang if it does (QTBUG-24503)

Change-Id: Icf99d45707102d2ef9219ed0b5ad521605716219
Reviewed-by: Sergio Ahumada <sergio.ahumada@nokia.com>
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-03-08 05:31:40 +01:00
Shane Kearns
3f91cde588 Test for QT_NO_SSL instead of QT_NO_OPENSSL
Change the ifdefs in our own code (except openssl backend) to use the
new configure flag.

Change-Id: I8774734771c66b22164b5fae8fdb27814ac3df7b
Reviewed-by: Richard J. Moore <rich@kde.org>
2012-02-21 15:28:40 +01:00
Shane Kearns
911ab74161 Fix link error in QSslSocket auto test
This has been broken for months, but invisible because the code causing
the link error is unreachable (due to QSKIP). So the link error only
occurs in debug builds with -O0.

Change-Id: I6093a7803bedf37bfc8c2d9ff0b28b2309b57959
Reviewed-by: Richard J. Moore <rich@kde.org>
2012-01-30 20:18:28 +01:00
Jason McDonald
5635823e17 Remove "All rights reserved" line from license headers.
As in the past, to avoid rewriting various autotests that contain
line-number information, an extra blank line has been inserted at the
end of the license text to ensure that this commit does not change the
total number of lines in the license header.

Change-Id: I311e001373776812699d6efc045b5f742890c689
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-01-30 03:54:59 +01:00
Peter Hartmann
07662f93ac QAbstractSocket / QSslSocket: add API to pause and resume
pause and resume is currently only supported upon emitting the
QSslSocket::sslErrors() signal. The API was added in QAbstractSocket to
also support QAbstractSocket::proxyAuthenticationRequired() in the
future.

This is the first patch to support that feature on the socket level,
another patch will follow to support sslErrors() and
authenticationRequired() in QNetworkAccessManager / QNetworkReply.

Task-number: QTBUG-19032
Change-Id: Ide2918268590ab9a01454ab26cb7fdca3dc840ab
Reviewed-by: Shane Kearns <ext-shane.2.kearns@nokia.com>
2012-01-25 19:35:05 +01:00
Jason McDonald
629d6eda5c Update contact information in license headers.
Replace Nokia contact email address with Qt Project website.

Change-Id: I431bbbf76d7c27d8b502f87947675c116994c415
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-01-23 04:04:33 +01:00
Toby Tomkins
d4d14e28e6 Modify SSL Socket test exceptions on Ubuntu 11.10 x64.
Modified exceptions as most tests are now passing correctly. Three exceptions
still remain, two serverSideMode tests (ssl3-any, tls1.0-any) and a
verifyMode test.

Task-number: QTBUG-23575

Change-Id: I847e8c2e3484050b8d07ede9aec955c30f7ef5a1
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-01-16 05:30:36 +01:00
Jonas M. Gastal
bdce610022 Fixes examples/tests to use qinptr in QTcpServer::incomingConnection.
This is a fix for problems introduced by bf7f170.

Change-Id: If5dd8e031ef2efea578b3efb188c2e950e1ba41a
Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
Reviewed-by: Bradley T. Hughes <bradley.hughes@nokia.com>
2012-01-13 20:55:00 +01:00
Toby Tomkins
605329eb1b SSL Socket withoutproxy failures on Ubuntu 11.10 x64.
Numerous failures in the qsslsocket autotest suite relating to
connections without using proxies. Some have been skipped due to
the number of failures, other more specific tests have been set
to expect a failure.

Task-number: QTBUG-23575

Change-Id: I35fccc65bcab303646617a57a33f5aa7f7a4323f
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-01-12 06:13:29 +01:00
Jonas M. Gastal
bf7f170607 Make socket descriptors qintptr.
Windows x64 uses 64 bits integer for sockets, to ensure compatibility we
should use ptr sized integers for our socket descriptors.

Task-number: QTBUG-19004
Change-Id: I4b56023874a4f1bad107c66c054fecfedde33d88
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
2012-01-05 15:07:51 +01:00
Jason McDonald
1fdfc2abfe Update copyright year in license headers.
Change-Id: I02f2c620296fcd91d4967d58767ea33fc4e1e7dc
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>
2012-01-05 06:36:56 +01:00
Richard Moore
2757a5fe8c Check we're connected before startClientEncryption()
The docs say this is required, but we don't check it and instead
segfault right now.

Change-Id: I825b00a312a481c5383af127333c0c4698188348
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
2011-12-07 12:55:28 +01:00
Richard Moore
3d3fdcd3a5 Make the default ssloptions testable.
Centralise the specification of the default ssloptions to make the code
clearer and more testable.

Change-Id: I4f4bae72736dd063ee4cd64c6375e82d0600a105
Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
2011-11-29 14:00:01 +01:00