qsslconfiguration.cpp

Go to the documentation of this file.

// Copyright (C) 2016 The Qt Company Ltd.
// Copyright (C) 2014 BlackBerry Limited. All rights reserved.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
 
#include "qssl_p.h"
#include "qsslconfiguration.h"
#include "qsslconfiguration_p.h"
#include "qsslsocket.h"
#include "qsslsocket_p.h"
#include "qmutex.h"
#include "qdebug.h"
 
QT_BEGIN_NAMESPACE
 
QT_IMPL_METATYPE_EXTERN(QSslConfiguration)
 
const QSsl::SslOptions QSslConfigurationPrivate::defaultSslOptions = QSsl::SslOptionDisableEmptyFragments
                                                                    |QSsl::SslOptionDisableLegacyRenegotiation
                                                                    |QSsl::SslOptionDisableCompression
                                                                    |QSsl::SslOptionDisableSessionPersistence;
 
const char QSslConfiguration::ALPNProtocolHTTP2[] = "h2";
const char QSslConfiguration::NextProtocolHttp1_1[] = "http/1.1";
 
QSslConfiguration::QSslConfiguration()
    : d(new QSslConfigurationPrivate)
{
}
 
QSslConfiguration::QSslConfiguration(const QSslConfiguration &other)
    : d(other.d)
{
}
 
QSslConfiguration::~QSslConfiguration()
{
    // QSharedDataPointer deletes d for us if necessary
}
 
QSslConfiguration &QSslConfiguration::operator=(const QSslConfiguration &other)
{
    d = other.d;
    return *this;
}
 
bool QSslConfiguration::operator==(const QSslConfiguration &other) const
{
    if (d == other.d)
        return true;
    return d->peerCertificate == other.d->peerCertificate &&
        d->peerCertificateChain == other.d->peerCertificateChain &&
        d->localCertificateChain == other.d->localCertificateChain &&
        d->privateKey == other.d->privateKey &&
        d->sessionCipher == other.d->sessionCipher &&
        d->sessionProtocol == other.d->sessionProtocol &&
        d->preSharedKeyIdentityHint == other.d->preSharedKeyIdentityHint &&
        d->ciphers == other.d->ciphers &&
        d->ellipticCurves == other.d->ellipticCurves &&
        d->ephemeralServerKey == other.d->ephemeralServerKey &&
        d->dhParams == other.d->dhParams &&
        d->caCertificates == other.d->caCertificates &&
        d->protocol == other.d->protocol &&
        d->peerVerifyMode == other.d->peerVerifyMode &&
        d->peerVerifyDepth == other.d->peerVerifyDepth &&
        d->allowRootCertOnDemandLoading == other.d->allowRootCertOnDemandLoading &&
        d->backendConfig == other.d->backendConfig &&
        d->sslOptions == other.d->sslOptions &&
        d->sslSession == other.d->sslSession &&
        d->sslSessionTicketLifeTimeHint == other.d->sslSessionTicketLifeTimeHint &&
        d->nextAllowedProtocols == other.d->nextAllowedProtocols &&
        d->nextNegotiatedProtocol == other.d->nextNegotiatedProtocol &&
        d->nextProtocolNegotiationStatus == other.d->nextProtocolNegotiationStatus &&
        d->dtlsCookieEnabled == other.d->dtlsCookieEnabled &&
        d->ocspStaplingEnabled == other.d->ocspStaplingEnabled &&
        d->reportFromCallback == other.d->reportFromCallback &&
        d->missingCertIsFatal == other.d->missingCertIsFatal;
}
 
bool QSslConfiguration::isNull() const
{
    return (d->protocol == QSsl::SecureProtocols &&
            d->peerVerifyMode == QSslSocket::AutoVerifyPeer &&
            d->peerVerifyDepth == 0 &&
            d->allowRootCertOnDemandLoading == true &&
            d->caCertificates.size() == 0 &&
            d->ciphers.size() == 0 &&
            d->ellipticCurves.isEmpty() &&
            d->ephemeralServerKey.isNull() &&
            d->dhParams == QSslDiffieHellmanParameters::defaultParameters() &&
            d->localCertificateChain.isEmpty() &&
            d->privateKey.isNull() &&
            d->peerCertificate.isNull() &&
            d->peerCertificateChain.size() == 0 &&
            d->backendConfig.isEmpty() &&
            d->sslOptions == QSslConfigurationPrivate::defaultSslOptions &&
            d->sslSession.isNull() &&
            d->sslSessionTicketLifeTimeHint == -1 &&
            d->preSharedKeyIdentityHint.isNull() &&
            d->nextAllowedProtocols.isEmpty() &&
            d->nextNegotiatedProtocol.isNull() &&
            d->nextProtocolNegotiationStatus == QSslConfiguration::NextProtocolNegotiationNone &&
            d->ocspStaplingEnabled == false &&
            d->reportFromCallback == false &&
            d->missingCertIsFatal == false);
}
 
QSsl::SslProtocol QSslConfiguration::protocol() const
{
    return d->protocol;
}
 
void QSslConfiguration::setProtocol(QSsl::SslProtocol protocol)
{
    d->protocol = protocol;
}
 
QSslSocket::PeerVerifyMode QSslConfiguration::peerVerifyMode() const
{
    return d->peerVerifyMode;
}
 
void QSslConfiguration::setPeerVerifyMode(QSslSocket::PeerVerifyMode mode)
{
    d->peerVerifyMode = mode;
}
 
 
int QSslConfiguration::peerVerifyDepth() const
{
    return d->peerVerifyDepth;
}
 
void QSslConfiguration::setPeerVerifyDepth(int depth)
{
    if (depth < 0) {
        qCWarning(lcSsl,
                 "QSslConfiguration::setPeerVerifyDepth: cannot set negative depth of %d", depth);
        return;
    }
    d->peerVerifyDepth = depth;
}
 
QList<QSslCertificate> QSslConfiguration::localCertificateChain() const
{
    return d->localCertificateChain;
}
 
void QSslConfiguration::setLocalCertificateChain(const QList<QSslCertificate> &localChain)
{
    d->localCertificateChain = localChain;
}
 
QSslCertificate QSslConfiguration::localCertificate() const
{
    if (d->localCertificateChain.isEmpty())
        return QSslCertificate();
    return d->localCertificateChain[0];
}
 
void QSslConfiguration::setLocalCertificate(const QSslCertificate &certificate)
{
    d->localCertificateChain = QList<QSslCertificate>();
    d->localCertificateChain += certificate;
}
 
QSslCertificate QSslConfiguration::peerCertificate() const
{
    return d->peerCertificate;
}
 
QList<QSslCertificate> QSslConfiguration::peerCertificateChain() const
{
    return d->peerCertificateChain;
}
 
QSslCipher QSslConfiguration::sessionCipher() const
{
    return d->sessionCipher;
}
 
QSsl::SslProtocol QSslConfiguration::sessionProtocol() const
{
    return d->sessionProtocol;
}
 
QSslKey QSslConfiguration::privateKey() const
{
    return d->privateKey;
}
 
void QSslConfiguration::setPrivateKey(const QSslKey &key)
{
    d->privateKey = key;
}
 
QList<QSslCipher> QSslConfiguration::ciphers() const
{
    return d->ciphers;
}
 
void QSslConfiguration::setCiphers(const QList<QSslCipher> &ciphers)
{
    d->ciphers = ciphers;
}
 
void QSslConfiguration::setCiphers(const QString &ciphers)
{
    auto *p = d.data();
    p->ciphers.clear();
    const auto cipherNames = ciphers.split(u':', Qt::SkipEmptyParts);
    for (const QString &cipherName : cipherNames) {
        QSslCipher cipher(cipherName);
        if (!cipher.isNull())
            p->ciphers << cipher;
    }
}
 
QList<QSslCipher> QSslConfiguration::supportedCiphers()
{
    return QSslSocketPrivate::supportedCiphers();
}
 
QList<QSslCertificate> QSslConfiguration::caCertificates() const
{
    return d->caCertificates;
}
 
void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certificates)
{
    d->caCertificates = certificates;
    d->allowRootCertOnDemandLoading = false;
}
 
bool QSslConfiguration::addCaCertificates(const QString &path, QSsl::EncodingFormat format,
                                          QSslCertificate::PatternSyntax syntax)
{
    QList<QSslCertificate> certs = QSslCertificate::fromPath(path, format, syntax);
    if (certs.isEmpty())
        return false;
 
    d->caCertificates += certs;
    return true;
}
 
void QSslConfiguration::addCaCertificate(const QSslCertificate &certificate)
{
    d->caCertificates += certificate;
    d->allowRootCertOnDemandLoading = false;
}
 
void QSslConfiguration::addCaCertificates(const QList<QSslCertificate> &certificates)
{
    d->caCertificates += certificates;
    d->allowRootCertOnDemandLoading = false;
}
 
QList<QSslCertificate> QSslConfiguration::systemCaCertificates()
{
    // we are calling ensureInitialized() in the method below
    return QSslSocketPrivate::systemCaCertificates();
}
 
void QSslConfiguration::setSslOption(QSsl::SslOption option, bool on)
{
    d->sslOptions.setFlag(option, on);
}
 
bool QSslConfiguration::testSslOption(QSsl::SslOption option) const
{
    return d->sslOptions & option;
}
 
QByteArray QSslConfiguration::sessionTicket() const
{
    return d->sslSession;
}
 
void QSslConfiguration::setSessionTicket(const QByteArray &sessionTicket)
{
    d->sslSession = sessionTicket;
}
 
int QSslConfiguration::sessionTicketLifeTimeHint() const
{
    return d->sslSessionTicketLifeTimeHint;
}
 
QSslKey QSslConfiguration::ephemeralServerKey() const
{
    return d->ephemeralServerKey;
}
 
QList<QSslEllipticCurve> QSslConfiguration::ellipticCurves() const
{
    return d->ellipticCurves;
}
 
void QSslConfiguration::setEllipticCurves(const QList<QSslEllipticCurve> &curves)
{
    d->ellipticCurves = curves;
}
 
QList<QSslEllipticCurve> QSslConfiguration::supportedEllipticCurves()
{
    return QSslSocketPrivate::supportedEllipticCurves();
}
 
QByteArray QSslConfiguration::preSharedKeyIdentityHint() const
{
    return d->preSharedKeyIdentityHint;
}
 
void QSslConfiguration::setPreSharedKeyIdentityHint(const QByteArray &hint)
{
    d->preSharedKeyIdentityHint = hint;
}
 
QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const
{
    return d->dhParams;
}
 
void QSslConfiguration::setDiffieHellmanParameters(const QSslDiffieHellmanParameters &dhparams)
{
    d->dhParams = dhparams;
}
 
QMap<QByteArray, QVariant> QSslConfiguration::backendConfiguration() const
{
    return d->backendConfig;
}
 
void QSslConfiguration::setBackendConfigurationOption(const QByteArray &name, const QVariant &value)
{
    d->backendConfig[name] = value;
}
 
void QSslConfiguration::setBackendConfiguration(const QMap<QByteArray, QVariant> &backendConfiguration)
{
    d->backendConfig = backendConfiguration;
}
 
QByteArray QSslConfiguration::nextNegotiatedProtocol() const
{
    return d->nextNegotiatedProtocol;
}
 
void QSslConfiguration::setAllowedNextProtocols(const QList<QByteArray> &protocols)
{
    d->nextAllowedProtocols = protocols;
}
 
QList<QByteArray> QSslConfiguration::allowedNextProtocols() const
{
    return d->nextAllowedProtocols;
}
 
QSslConfiguration::NextProtocolNegotiationStatus QSslConfiguration::nextProtocolNegotiationStatus() const
{
    return d->nextProtocolNegotiationStatus;
}
 
QSslConfiguration QSslConfiguration::defaultConfiguration()
{
    return QSslConfigurationPrivate::defaultConfiguration();
}
 
void QSslConfiguration::setDefaultConfiguration(const QSslConfiguration &configuration)
{
    QSslConfigurationPrivate::setDefaultConfiguration(configuration);
}
 
#if QT_CONFIG(dtls) || defined(Q_QDOC)
 
bool QSslConfiguration::dtlsCookieVerificationEnabled() const
{
    return d->dtlsCookieEnabled;
}
 
void QSslConfiguration::setDtlsCookieVerificationEnabled(bool enable)
{
    d->dtlsCookieEnabled = enable;
}
 
QSslConfiguration QSslConfiguration::defaultDtlsConfiguration()
{
    return QSslConfigurationPrivate::defaultDtlsConfiguration();
}
 
void QSslConfiguration::setDefaultDtlsConfiguration(const QSslConfiguration &configuration)
{
    QSslConfigurationPrivate::setDefaultDtlsConfiguration(configuration);
}
 
#endif // dtls
 
void QSslConfiguration::setOcspStaplingEnabled(bool enabled)
{
#if QT_CONFIG(ocsp)
    d->ocspStaplingEnabled = enabled;
#else
    if (enabled)
        qCWarning(lcSsl, "Enabling OCSP-stapling requires the feature 'ocsp'");
#endif // ocsp
}
 
bool QSslConfiguration::ocspStaplingEnabled() const
{
    return d->ocspStaplingEnabled;
}
 
bool QSslConfiguration::handshakeMustInterruptOnError() const
{
    return d->reportFromCallback;
}
 
void QSslConfiguration::setHandshakeMustInterruptOnError(bool interrupt)
{
#if QT_CONFIG(openssl)
    d->reportFromCallback = interrupt;
#else
    Q_UNUSED(interrupt);
    qCWarning(lcSsl, "This operation requires OpenSSL as TLS backend");
#endif
}
 
bool QSslConfiguration::missingCertificateIsFatal() const
{
    return d->missingCertIsFatal;
}
 
void QSslConfiguration::setMissingCertificateIsFatal(bool cannotRecover)
{
#if QT_CONFIG(openssl)
    d->missingCertIsFatal = cannotRecover;
#else
    Q_UNUSED(cannotRecover);
    qCWarning(lcSsl, "Handling a missing certificate as a fatal error requires an OpenSSL backend");
#endif // openssl
}
 
bool QSslConfigurationPrivate::peerSessionWasShared(const QSslConfiguration &configuration) {
        return configuration.d->peerSessionShared;
    }
 
QT_END_NAMESPACE