1 /****************************************************************************

     2 **

     3 ** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).

     4 ** All rights reserved.

     5 ** Contact: Nokia Corporation (qt-info@nokia.com)

     6 **

     7 ** This file is part of the QtNetwork module of the Qt Toolkit.

     8 **

     9 ** $QT_BEGIN_LICENSE:LGPL$

    10 ** No Commercial Usage

    11 ** This file contains pre-release code and may not be distributed.

    12 ** You may use this file in accordance with the terms and conditions

    13 ** contained in the Technology Preview License Agreement accompanying

    14 ** this package.

    15 **

    16 ** GNU Lesser General Public License Usage

    17 ** Alternatively, this file may be used under the terms of the GNU Lesser

    18 ** General Public License version 2.1 as published by the Free Software

    19 ** Foundation and appearing in the file LICENSE.LGPL included in the

    20 ** packaging of this file.  Please review the following information to

    21 ** ensure the GNU Lesser General Public License version 2.1 requirements

    22 ** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.

    23 **

    24 ** In addition, as a special exception, Nokia gives you certain additional

    25 ** rights.  These rights are described in the Nokia Qt LGPL Exception

    26 ** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.

    27 **

    28 ** If you have questions regarding the use of this file, please contact

    29 ** Nokia at qt-info@nokia.com.

    30 **

    31 **

    32 **

    33 **

    34 **

    35 **

    36 **

    37 **

    38 ** $QT_END_LICENSE$

    39 **

    40 ****************************************************************************/

    41 

    42 

    43 //#define QSSLSOCKET_DEBUG

    44 

    45 /*!

    46     \class QSslSocket

    47     \brief The QSslSocket class provides an SSL encrypted socket for both

    48     clients and servers.

    49     \since 4.3

    50 

    51     \reentrant

    52     \ingroup network

    53     \ingroup ssl

    54     \inmodule QtNetwork

    55 

    56     QSslSocket establishes a secure, encrypted TCP connection you can

    57     use for transmitting encrypted data. It can operate in both client

    58     and server mode, and it supports modern SSL protocols, including

    59     SSLv3 and TLSv1. By default, QSslSocket uses SSLv3, but you can

    60     change the SSL protocol by calling setProtocol() as long as you do

    61     it before the handshake has started.

    62 

    63     SSL encryption operates on top of the existing TCP stream after

    64     the socket enters the ConnectedState. There are two simple ways to

    65     establish a secure connection using QSslSocket: With an immediate

    66     SSL handshake, or with a delayed SSL handshake occurring after the

    67     connection has been established in unencrypted mode.

    68 

    69     The most common way to use QSslSocket is to construct an object

    70     and start a secure connection by calling connectToHostEncrypted().

    71     This method starts an immediate SSL handshake once the connection

    72     has been established.

    73 

    74     \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 0

    75 

    76     As with a plain QTcpSocket, QSslSocket enters the HostLookupState,

    77     ConnectingState, and finally the ConnectedState, if the connection

    78     is successful. The handshake then starts automatically, and if it

    79     succeeds, the encrypted() signal is emitted to indicate the socket

    80     has entered the encrypted state and is ready for use.

    81 

    82     Note that data can be written to the socket immediately after the

    83     return from connectToHostEncrypted() (i.e., before the encrypted()

    84     signal is emitted). The data is queued in QSslSocket until after

    85     the encrypted() signal is emitted.

    86 

    87     An example of using the delayed SSL handshake to secure an

    88     existing connection is the case where an SSL server secures an

    89     incoming connection. Suppose you create an SSL server class as a

    90     subclass of QTcpServer. You would override

    91     QTcpServer::incomingConnection() with something like the example

    92     below, which first constructs an instance of QSslSocket and then

    93     calls setSocketDescriptor() to set the new socket's descriptor to

    94     the existing one passed in. It then initiates the SSL handshake

    95     by calling startServerEncryption().

    96 

    97     \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 1

    98 

    99     If an error occurs, QSslSocket emits the sslErrors() signal. In this

   100     case, if no action is taken to ignore the error(s), the connection

   101     is dropped. To continue, despite the occurrence of an error, you

   102     can call ignoreSslErrors(), either from within this slot after the

   103     error occurs, or any time after construction of the QSslSocket and

   104     before the connection is attempted. This will allow QSslSocket to

   105     ignore the errors it encounters when establishing the identity of

   106     the peer. Ignoring errors during an SSL handshake should be used

   107     with caution, since a fundamental characteristic of secure

   108     connections is that they should be established with a successful

   109     handshake.

   110 

   111     Once encrypted, you use QSslSocket as a regular QTcpSocket. When

   112     readyRead() is emitted, you can call read(), canReadLine() and

   113     readLine(), or getChar() to read decrypted data from QSslSocket's

   114     internal buffer, and you can call write() or putChar() to write

   115     data back to the peer. QSslSocket will automatically encrypt the

   116     written data for you, and emit encryptedBytesWritten() once

   117     the data has been written to the peer.

   118 

   119     As a convenience, QSslSocket supports QTcpSocket's blocking

   120     functions waitForConnected(), waitForReadyRead(),

   121     waitForBytesWritten(), and waitForDisconnected(). It also provides

   122     waitForEncrypted(), which will block the calling thread until an

   123     encrypted connection has been established.

   124 

   125     \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 2

   126 

   127     QSslSocket provides an extensive, easy-to-use API for handling

   128     cryptographic ciphers, private keys, and local, peer, and

   129     Certification Authority (CA) certificates. It also provides an API

   130     for handling errors that occur during the handshake phase.

   131 

   132     The following features can also be customized:

   133 

   134     \list

   135     \o The socket's cryptographic cipher suite can be customized before

   136     the handshake phase with setCiphers() and setDefaultCiphers().

   137     \o The socket's local certificate and private key can be customized

   138     before the handshake phase with setLocalCertificate() and

   139     setPrivateKey().

   140     \o The CA certificate database can be extended and customized with

   141     addCaCertificate(), addCaCertificates(), setCaCertificates(),

   142     addDefaultCaCertificate(), addDefaultCaCertificates(), and

   143     setDefaultCaCertificates().

   144     \endlist

   145 

   146     For more information about ciphers and certificates, refer to QSslCipher and

   147     QSslCertificate.

   148 

   149     This product includes software developed by the OpenSSL Project

   150     for use in the OpenSSL Toolkit (\l{http://www.openssl.org/}).

   151 

   152     \note Be aware of the difference between the bytesWritten() signal and

   153     the encryptedBytesWritten() signal. For a QTcpSocket, bytesWritten()

   154     will get emitted as soon as data has been written to the TCP socket.

   155     For a QSslSocket, bytesWritten() will get emitted when the data

   156     is being encrypted and encryptedBytesWritten()

   157     will get emitted as soon as data has been written to the TCP socket.

   158 

   159     \sa QSslCertificate, QSslCipher, QSslError

   160 */

   161 

   162 /*!

   163     \enum QSslSocket::SslMode

   164 

   165     Describes the connection modes available for QSslSocket.

   166 

   167     \value UnencryptedMode The socket is unencrypted. Its

   168     behavior is identical to QTcpSocket.

   169 

   170     \value SslClientMode The socket is a client-side SSL socket.

   171     It is either alreayd encrypted, or it is in the SSL handshake

   172     phase (see QSslSocket::isEncrypted()).

   173 

   174     \value SslServerMode The socket is a server-side SSL socket.

   175     It is either already encrypted, or it is in the SSL handshake

   176     phase (see QSslSocket::isEncrypted()).

   177 */

   178 

   179 /*!

   180     \enum QSslSocket::PeerVerifyMode

   181     \since 4.4

   182 

   183     Describes the peer verification modes for QSslSocket. The default mode is

   184     AutoVerifyPeer, which selects an appropriate mode depending on the

   185     socket's QSocket::SslMode.

   186 

   187     \value VerifyNone QSslSocket will not request a certificate from the

   188     peer. You can set this mode if you are not interested in the identity of

   189     the other side of the connection. The connection will still be encrypted,

   190     and your socket will still send its local certificate to the peer if it's

   191     requested.

   192 

   193     \value QueryPeer QSslSocket will request a certificate from the peer, but

   194     does not require this certificate to be valid. This is useful when you

   195     want to display peer certificate details to the user without affecting the

   196     actual SSL handshake. This mode is the default for servers.

   197 

   198     \value VerifyPeer QSslSocket will request a certificate from the peer

   199     during the SSL handshake phase, and requires that this certificate is

   200     valid. On failure, QSslSocket will emit the QSslSocket::sslErrors()

   201     signal. This mode is the default for clients.

   202 

   203     \value AutoVerifyPeer QSslSocket will automaticaly use QueryPeer for

   204     server sockets and VerifyPeer for client sockets.

   205 

   206     \sa QSslSocket::peerVerifyMode()

   207 */

   208 

   209 /*!

   210     \fn QSslSocket::encrypted()

   211 

   212     This signal is emitted when QSslSocket enters encrypted mode. After this

   213     signal has been emitted, QSslSocket::isEncrypted() will return true, and

   214     all further transmissions on the socket will be encrypted.

   215 

   216     \sa QSslSocket::connectToHostEncrypted(), QSslSocket::isEncrypted()

   217 */

   218 

   219 /*!

   220     \fn QSslSocket::modeChanged(QSslSocket::SslMode mode)

   221 

   222     This signal is emitted when QSslSocket changes from \l

   223     QSslSocket::UnencryptedMode to either \l QSslSocket::SslClientMode or \l

   224     QSslSocket::SslServerMode. \a mode is the new mode.

   225 

   226     \sa QSslSocket::mode()

   227 */

   228 

   229 /*!

   230     \fn QSslSocket::encryptedBytesWritten(qint64 written)

   231     \since 4.4

   232 

   233     This signal is emitted when QSslSocket writes its encrypted data to the

   234     network. The \a written parameter contains the number of bytes that were

   235     successfully written.

   236 

   237     \sa QIODevice::bytesWritten()

   238 */

   239 

   240 /*!

   241     \fn void QSslSocket::peerVerifyError(const QSslError &error)

   242     \since 4.4

   243 

   244     QSslSocket can emit this signal several times during the SSL handshake,

   245     before encryption has been established, to indicate that an error has

   246     occurred while establishing the identity of the peer. The \a error is

   247     usually an indication that QSslSocket is unable to securely identify the

   248     peer.

   249 

   250     This signal provides you with an early indication when something's wrong.

   251     By connecting to this signal, you can manually choose to tear down the

   252     connection from inside the connected slot before the handshake has

   253     completed. If no action is taken, QSslSocket will proceed to emitting

   254     QSslSocket::sslErrors().

   255 

   256     \sa sslErrors()

   257 */

   258 

   259 /*!

   260     \fn void QSslSocket::sslErrors(const QList<QSslError> &errors);

   261     

   262     QSslSocket emits this signal after the SSL handshake to indicate that one

   263     or more errors have occurred while establishing the identity of the

   264     peer. The errors are usually an indication that QSslSocket is unable to

   265     securely identify the peer. Unless any action is taken, the connection

   266     will be dropped after this signal has been emitted.

   267 

   268     If you want to continue connecting despite the errors that have occurred,

   269     you must call QSslSocket::ignoreSslErrors() from inside a slot connected to

   270     this signal. If you need to access the error list at a later point, you

   271     can call sslErrors() (without arguments).

   272 

   273     \a errors contains one or more errors that prevent QSslSocket from

   274     verifying the identity of the peer.

   275     

   276     Note: You cannot use Qt::QueuedConnection when connecting to this signal,

   277     or calling QSslSocket::ignoreSslErrors() will have no effect.

   278 

   279     \sa peerVerifyError()

   280 */

   281 

   282 #include "qsslcipher.h"

   283 #include "qsslsocket.h"

   284 #include "qsslsocket_openssl_p.h"

   285 #include "qsslconfiguration_p.h"

   286 

   287 #include <QtCore/qdebug.h>

   288 #include <QtCore/qdir.h>

   289 #include <QtCore/qdatetime.h>

   290 #include <QtCore/qmutex.h>

   291 #include <QtNetwork/qhostaddress.h>

   292 #include <QtNetwork/qhostinfo.h>

   293 

   294 QT_BEGIN_NAMESPACE

   295 

   296 /*

   297    Returns the difference between msecs and elapsed. If msecs is -1,

   298    however, -1 is returned.

   299 */

   300 static int qt_timeout_value(int msecs, int elapsed)

   301 {

   302     if (msecs == -1)

   303         return -1;

   304 

   305     int timeout = msecs - elapsed;

   306     return timeout < 0 ? 0 : timeout;

   307 }

   308 

   309 class QSslSocketGlobalData

   310 {

   311 public:

   312     QSslSocketGlobalData() : config(new QSslConfigurationPrivate) {}

   313 

   314     QMutex mutex;

   315     QList<QSslCipher> supportedCiphers;

   316     QExplicitlySharedDataPointer<QSslConfigurationPrivate> config;

   317 };

   318 Q_GLOBAL_STATIC(QSslSocketGlobalData, globalData)

   319 

   320 /*!

   321     Constructs a QSslSocket object. \a parent is passed to QObject's

   322     constructor. The new socket's \l {QSslCipher} {cipher} suite is

   323     set to the one returned by the static method defaultCiphers().

   324 */

   325 QSslSocket::QSslSocket(QObject *parent)

   326     : QTcpSocket(*new QSslSocketBackendPrivate, parent)

   327 {

   328     Q_D(QSslSocket);

   329 #ifdef QSSLSOCKET_DEBUG

   330     qDebug() << "QSslSocket::QSslSocket(" << parent << "), this =" << (void *)this;

   331 #endif

   332     d->q_ptr = this;

   333     d->init();

   334 }

   335 

   336 /*!

   337     Destroys the QSslSocket.

   338 */

   339 QSslSocket::~QSslSocket()

   340 {

   341     Q_D(QSslSocket);

   342 #ifdef QSSLSOCKET_DEBUG

   343     qDebug() << "QSslSocket::~QSslSocket(), this =" << (void *)this;

   344 #endif

   345     delete d->plainSocket;

   346     d->plainSocket = 0;

   347 }

   348 

   349 /*!

   350     Starts an encrypted connection to the device \a hostName on \a

   351     port, using \a mode as the \l OpenMode. This is equivalent to

   352     calling connectToHost() to establish the connection, followed by a

   353     call to startClientEncryption().

   354 

   355     QSslSocket first enters the HostLookupState. Then, after entering

   356     either the event loop or one of the waitFor...() functions, it

   357     enters the ConnectingState, emits connected(), and then initiates

   358     the SSL client handshake. At each state change, QSslSocket emits

   359     signal stateChanged().

   360 

   361     After initiating the SSL client handshake, if the identity of the

   362     peer can't be established, signal sslErrors() is emitted. If you

   363     want to ignore the errors and continue connecting, you must call

   364     ignoreSslErrors(), either from inside a slot function connected to

   365     the sslErrors() signal, or prior to entering encrypted mode. If

   366     ignoreSslErrors() is not called, the connection is dropped, signal

   367     disconnected() is emitted, and QSslSocket returns to the

   368     UnconnectedState.

   369 

   370     If the SSL handshake is successful, QSslSocket emits encrypted().

   371 

   372     \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 3

   373 

   374     \bold{Note:} The example above shows that text can be written to

   375     the socket immediately after requesting the encrypted connection,

   376     before the encrypted() signal has been emitted. In such cases, the

   377     text is queued in the object and written to the socket \e after

   378     the connection is established and the encrypted() signal has been

   379     emitted.

   380 

   381     The default for \a mode is \l ReadWrite.

   382 

   383     If you want to create a QSslSocket on the server side of a connection, you

   384     should instead call startServerEncryption() upon receiving the incoming

   385     connection through QTcpServer.

   386 

   387     \sa connectToHost(), startClientEncryption(), waitForConnected(), waitForEncrypted()

   388 */

   389 void QSslSocket::connectToHostEncrypted(const QString &hostName, quint16 port, OpenMode mode)

   390 {

   391     Q_D(QSslSocket);

   392     if (d->state == ConnectedState || d->state == ConnectingState) {

   393         qWarning("QSslSocket::connectToHostEncrypted() called when already connecting/connected");

   394         return;

   395     }

   396 

   397     d->init();

   398     d->autoStartHandshake = true;

   399     d->initialized = true;

   400 

   401     // Note: When connecting to localhost, some platforms (e.g., HP-UX and some BSDs)

   402     // establish the connection immediately (i.e., first attempt).

   403     connectToHost(hostName, port, mode);

   404 }

   405 

   406 /*!

   407     \since 4.6

   408     \overload

   409 

   410     In addition to the original behaviour of connectToHostEncrypted,

   411     this overloaded method enables the usage of a different hostname 

   412     (\a sslPeerName) for the certificate validation instead of

   413     the one used for the TCP connection (\a hostName).

   414 

   415     \sa connectToHostEncrypted()

   416 */

   417 void QSslSocket::connectToHostEncrypted(const QString &hostName, quint16 port,

   418                                         const QString &sslPeerName, OpenMode mode)

   419 {

   420     Q_D(QSslSocket);

   421     if (d->state == ConnectedState || d->state == ConnectingState) {

   422         qWarning("QSslSocket::connectToHostEncrypted() called when already connecting/connected");

   423         return;

   424     }

   425 

   426     d->init();

   427     d->autoStartHandshake = true;

   428     d->initialized = true;

   429     d->verificationPeerName = sslPeerName;

   430 

   431     // Note: When connecting to localhost, some platforms (e.g., HP-UX and some BSDs)

   432     // establish the connection immediately (i.e., first attempt).

   433     connectToHost(hostName, port, mode);

   434 }

   435 

   436 /*!

   437     Initializes QSslSocket with the native socket descriptor \a

   438     socketDescriptor. Returns true if \a socketDescriptor is accepted

   439     as a valid socket descriptor; otherwise returns false.

   440     The socket is opened in the mode specified by \a openMode, and

   441     enters the socket state specified by \a state.

   442 

   443     \bold{Note:} It is not possible to initialize two sockets with the same

   444     native socket descriptor.

   445 

   446     \sa socketDescriptor()

   447 */

   448 bool QSslSocket::setSocketDescriptor(int socketDescriptor, SocketState state, OpenMode openMode)

   449 {

   450     Q_D(QSslSocket);

   451 #ifdef QSSLSOCKET_DEBUG

   452     qDebug() << "QSslSocket::setSocketDescriptor(" << socketDescriptor << ','

   453              << state << ',' << openMode << ')';

   454 #endif

   455     if (!d->plainSocket)

   456         d->createPlainSocket(openMode);

   457     bool retVal = d->plainSocket->setSocketDescriptor(socketDescriptor, state, openMode);

   458     d->cachedSocketDescriptor = d->plainSocket->socketDescriptor();

   459     setSocketError(d->plainSocket->error());

   460     setSocketState(state);

   461     setOpenMode(openMode);

   462     setLocalPort(d->plainSocket->localPort());

   463     setLocalAddress(d->plainSocket->localAddress());

   464     setPeerPort(d->plainSocket->peerPort());

   465     setPeerAddress(d->plainSocket->peerAddress());

   466     setPeerName(d->plainSocket->peerName());

   467     return retVal;

   468 }

   469 

   470 void QSslSocket::setSocketOption(QAbstractSocket::SocketOption option, const QVariant &value)

   471 {

   472     Q_D(QSslSocket);

   473     if (d->plainSocket)

   474         d->plainSocket->setSocketOption(option, value);

   475 }

   476 

   477 QVariant QSslSocket::socketOption(QAbstractSocket::SocketOption option)

   478 {

   479     Q_D(QSslSocket);

   480     if (d->plainSocket)

   481         return d->plainSocket->socketOption(option);

   482     else

   483         return QVariant();

   484 }

   485 

   486 /*!

   487     Returns the current mode for the socket; either UnencryptedMode, where

   488     QSslSocket behaves identially to QTcpSocket, or one of SslClientMode or

   489     SslServerMode, where the client is either negotiating or in encrypted

   490     mode.

   491 

   492     When the mode changes, QSslSocket emits modeChanged()

   493 

   494     \sa SslMode

   495 */

   496 QSslSocket::SslMode QSslSocket::mode() const

   497 {

   498     Q_D(const QSslSocket);

   499     return d->mode;

   500 }

   501 

   502 /*!

   503     Returns true if the socket is encrypted; otherwise, false is returned.

   504 

   505     An encrypted socket encrypts all data that is written by calling write()

   506     or putChar() before the data is written to the network, and decrypts all

   507     incoming data as the data is received from the network, before you call

   508     read(), readLine() or getChar().

   509 

   510     QSslSocket emits encrypted() when it enters encrypted mode.

   511 

   512     You can call sessionCipher() to find which cryptographic cipher is used to

   513     encrypt and decrypt your data.

   514 

   515     \sa mode()

   516 */

   517 bool QSslSocket::isEncrypted() const

   518 {

   519     Q_D(const QSslSocket);

   520     return d->connectionEncrypted;

   521 }

   522 

   523 /*!

   524     Returns the socket's SSL protocol. By default, \l QSsl::SslV3 is used.

   525 

   526     \sa setProtocol()

   527 */

   528 QSsl::SslProtocol QSslSocket::protocol() const

   529 {

   530     Q_D(const QSslSocket);

   531     return d->configuration.protocol;

   532 }

   533 

   534 /*!

   535     Sets the socket's SSL protocol to \a protocol. This will affect the next

   536     initiated handshake; calling this function on an already-encrypted socket

   537     will not affect the socket's protocol.

   538 */

   539 void QSslSocket::setProtocol(QSsl::SslProtocol protocol)

   540 {

   541     Q_D(QSslSocket);

   542     d->configuration.protocol = protocol;

   543 }

   544 

   545 /*!

   546     \since 4.4

   547 

   548     Returns the socket's verify mode. This mode mode decides whether

   549     QSslSocket should request a certificate from the peer (i.e., the client

   550     requests a certificate from the server, or a server requesting a

   551     certificate from the client), and whether it should require that this

   552     certificate is valid.

   553 

   554     The default mode is AutoVerifyPeer, which tells QSslSocket to use

   555     VerifyPeer for clients, QueryPeer for clients.

   556 

   557     \sa setPeerVerifyMode(), peerVerifyDepth(), mode()

   558 */

   559 QSslSocket::PeerVerifyMode QSslSocket::peerVerifyMode() const

   560 {

   561     Q_D(const QSslSocket);

   562     return d->configuration.peerVerifyMode;

   563 }

   564 

   565 /*!

   566     \since 4.4

   567 

   568     Sets the socket's verify mode to \a mode. This mode decides whether

   569     QSslSocket should request a certificate from the peer (i.e., the client

   570     requests a certificate from the server, or a server requesting a

   571     certificate from the client), and whether it should require that this

   572     certificate is valid.

   573 

   574     The default mode is AutoVerifyPeer, which tells QSslSocket to use

   575     VerifyPeer for clients, QueryPeer for clients.

   576 

   577     Setting this mode after encryption has started has no effect on the

   578     current connection.

   579 

   580     \sa peerVerifyMode(), setPeerVerifyDepth(), mode()

   581 */

   582 void QSslSocket::setPeerVerifyMode(QSslSocket::PeerVerifyMode mode)

   583 {

   584     Q_D(QSslSocket);

   585     d->configuration.peerVerifyMode = mode;

   586 }

   587 

   588 /*!

   589     \since 4.4

   590 

   591     Returns the maximum number of certificates in the peer's certificate chain

   592     to be checked during the SSL handshake phase, or 0 (the default) if no

   593     maximum depth has been set, indicating that the whole certificate chain

   594     should be checked.

   595 

   596     The certificates are checked in issuing order, starting with the peer's

   597     own certificate, then its issuer's certificate, and so on.

   598 

   599     \sa setPeerVerifyDepth(), peerVerifyMode()

   600 */

   601 int QSslSocket::peerVerifyDepth() const

   602 {

   603     Q_D(const QSslSocket);

   604     return d->configuration.peerVerifyDepth;

   605 }

   606 

   607 /*!

   608     \since 4.4

   609 

   610     Sets the maximum number of certificates in the peer's certificate chain to

   611     be checked during the SSL handshake phase, to \a depth. Setting a depth of

   612     0 means that no maximum depth is set, indicating that the whole

   613     certificate chain should be checked.

   614 

   615     The certificates are checked in issuing order, starting with the peer's

   616     own certificate, then its issuer's certificate, and so on.

   617 

   618     \sa peerVerifyDepth(), setPeerVerifyMode()

   619 */

   620 void QSslSocket::setPeerVerifyDepth(int depth)

   621 {

   622     Q_D(QSslSocket);

   623     if (depth < 0) {

   624         qWarning("QSslSocket::setPeerVerifyDepth: cannot set negative depth of %d", depth);

   625         return;

   626     }

   627     d->configuration.peerVerifyDepth = depth;

   628 }

   629 

   630 /*!

   631     \reimp

   632 

   633     Returns the number of decrypted bytes that are immediately available for

   634     reading.

   635 */

   636 qint64 QSslSocket::bytesAvailable() const

   637 {

   638     Q_D(const QSslSocket);

   639     if (d->mode == UnencryptedMode)

   640         return QIODevice::bytesAvailable() + (d->plainSocket ? d->plainSocket->bytesAvailable() : 0);

   641     return QIODevice::bytesAvailable() + d->readBuffer.size();

   642 }

   643 

   644 /*!

   645     \reimp

   646 

   647     Returns the number of unencrypted bytes that are waiting to be encrypted

   648     and written to the network.

   649 */

   650 qint64 QSslSocket::bytesToWrite() const

   651 {

   652     Q_D(const QSslSocket);

   653     if (d->mode == UnencryptedMode)

   654         return d->plainSocket ? d->plainSocket->bytesToWrite() : 0;

   655     return d->writeBuffer.size();

   656 }

   657 

   658 /*!

   659     \since 4.4

   660 

   661     Returns the number of encrypted bytes that are awaiting decryption.

   662     Normally, this function will return 0 because QSslSocket decrypts its

   663     incoming data as soon as it can.

   664 */

   665 qint64 QSslSocket::encryptedBytesAvailable() const

   666 {

   667     Q_D(const QSslSocket);

   668     if (d->mode == UnencryptedMode)

   669         return 0;

   670     return d->plainSocket->bytesAvailable();

   671 }

   672 

   673 /*!

   674     \since 4.4

   675 

   676     Returns the number of encrypted bytes that are waiting to be written to

   677     the network.

   678 */

   679 qint64 QSslSocket::encryptedBytesToWrite() const

   680 {

   681     Q_D(const QSslSocket);

   682     if (d->mode == UnencryptedMode)

   683         return 0;

   684     return d->plainSocket->bytesToWrite();

   685 }

   686 

   687 /*!

   688     \reimp

   689 

   690     Returns true if you can read one while line (terminated by a single ASCII

   691     '\n' character) of decrypted characters; otherwise, false is returned.

   692 */

   693 bool QSslSocket::canReadLine() const

   694 {

   695     Q_D(const QSslSocket);

   696     if (d->mode == UnencryptedMode)

   697         return QIODevice::canReadLine() || (d->plainSocket && d->plainSocket->canReadLine());

   698     return QIODevice::canReadLine() || (!d->readBuffer.isEmpty() && d->readBuffer.canReadLine());

   699 }

   700 

   701 /*!

   702     \reimp

   703 */

   704 void QSslSocket::close()

   705 {

   706 #ifdef QSSLSOCKET_DEBUG

   707     qDebug() << "QSslSocket::close()";

   708 #endif

   709     Q_D(QSslSocket);

   710     QTcpSocket::close();

   711 

   712     // must be cleared, reading/writing not possible on closed socket:

   713     d->readBuffer.clear();

   714     d->writeBuffer.clear();

   715     // for QTcpSocket this is already done because it uses the readBuffer/writeBuffer

   716     // if the QIODevice it is based on

   717     // ### FIXME QSslSocket should probably do similar instead of having

   718     // its own readBuffer/writeBuffer

   719 }

   720 

   721 /*!

   722     \reimp

   723 */

   724 bool QSslSocket::atEnd() const

   725 {

   726     Q_D(const QSslSocket);

   727     if (d->mode == UnencryptedMode)

   728         return QIODevice::atEnd() && (!d->plainSocket || d->plainSocket->atEnd());

   729     return QIODevice::atEnd() && d->readBuffer.isEmpty();

   730 }

   731 

   732 /*!

   733     This function writes as much as possible from the internal write buffer to

   734     the underlying network socket, without blocking. If any data was written,

   735     this function returns true; otherwise false is returned.

   736 

   737     Call this function if you need QSslSocket to start sending buffered data

   738     immediately. The number of bytes successfully written depends on the

   739     operating system. In most cases, you do not need to call this function,

   740     because QAbstractSocket will start sending data automatically once control

   741     goes back to the event loop. In the absence of an event loop, call

   742     waitForBytesWritten() instead.

   743 

   744     \sa write(), waitForBytesWritten()

   745 */

   746 // Note! docs copied from QAbstractSocket::flush()

   747 bool QSslSocket::flush()

   748 {

   749     Q_D(QSslSocket);

   750 #ifdef QSSLSOCKET_DEBUG

   751     qDebug() << "QSslSocket::flush()";

   752 #endif

   753     if (d->mode != UnencryptedMode)

   754         // encrypt any unencrypted bytes in our buffer

   755         d->transmit();

   756 

   757     return d->plainSocket ? d->plainSocket->flush() : false;

   758 }

   759 

   760 /*!

   761     \since 4.4

   762 

   763     Sets the size of QSslSocket's internal read buffer to be \a size bytes. 

   764 */

   765 void QSslSocket::setReadBufferSize(qint64 size)

   766 {

   767     Q_D(QSslSocket);

   768     d->readBufferMaxSize = size;

   769 

   770     // set the plain socket's buffer size to 1k if we have a limit

   771     // see also the same logic in QSslSocketPrivate::createPlainSocket

   772     if (d->plainSocket) {

   773         if (d->mode == UnencryptedMode)

   774             d->plainSocket->setReadBufferSize(size);

   775         else

   776             d->plainSocket->setReadBufferSize(size ? 1024 : 0);

   777     }

   778 }

   779 

   780 /*!

   781     Aborts the current connection and resets the socket. Unlike

   782     disconnectFromHost(), this function immediately closes the socket,

   783     clearing any pending data in the write buffer.

   784 

   785     \sa disconnectFromHost(), close()

   786 */

   787 void QSslSocket::abort()

   788 {

   789     Q_D(QSslSocket);

   790 #ifdef QSSLSOCKET_DEBUG

   791     qDebug() << "QSslSocket::abort()";

   792 #endif

   793     if (d->plainSocket)

   794         d->plainSocket->abort();

   795     close();

   796 }

   797 

   798 /*!

   799     \since 4.4

   800 

   801     Returns the socket's SSL configuration state. The default SSL

   802     configuration of a socket is to use the default ciphers,

   803     default CA certificates, no local private key or certificate.

   804 

   805     The SSL configuration also contains fields that can change with

   806     time without notice.

   807 

   808     \sa localCertificate(), peerCertificate(), peerCertificateChain(),

   809         sessionCipher(), privateKey(), ciphers(), caCertificates()

   810 */

   811 QSslConfiguration QSslSocket::sslConfiguration() const

   812 {

   813     Q_D(const QSslSocket);

   814 

   815     // create a deep copy of our configuration

   816     QSslConfigurationPrivate *copy = new QSslConfigurationPrivate(d->configuration);

   817     copy->ref = 0;              // the QSslConfiguration constructor refs up

   818     copy->sessionCipher = d->sessionCipher();

   819 

   820     return QSslConfiguration(copy);

   821 }

   822 

   823 /*!

   824     \since 4.4

   825 

   826     Sets the socket's SSL configuration to be the contents of \a configuration.

   827     This function sets the local certificate, the ciphers, the private key and the CA

   828     certificates to those stored in \a configuration.

   829 

   830     It is not possible to set the SSL-state related fields.

   831 

   832     \sa setLocalCertificate(), setPrivateKey(), setCaCertificates(), setCiphers()

   833 */

   834 void QSslSocket::setSslConfiguration(const QSslConfiguration &configuration)

   835 {

   836     Q_D(QSslSocket);

   837     d->configuration.localCertificate = configuration.localCertificate();

   838     d->configuration.privateKey = configuration.privateKey();

   839     d->configuration.ciphers = configuration.ciphers();

   840     d->configuration.caCertificates = configuration.caCertificates();

   841     d->configuration.peerVerifyDepth = configuration.peerVerifyDepth();

   842     d->configuration.peerVerifyMode = configuration.peerVerifyMode();

   843     d->configuration.protocol = configuration.protocol();

   844 }

   845 

   846 /*!

   847     Sets the socket's local certificate to \a certificate. The local

   848     certificate is necessary if you need to confirm your identity to the

   849     peer. It is used together with the private key; if you set the local

   850     certificate, you must also set the private key.

   851 

   852     The local certificate and private key are always necessary for server

   853     sockets, but are also rarely used by client sockets if the server requires

   854     the client to authenticate.

   855 

   856     \sa localCertificate(), setPrivateKey()

   857 */

   858 void QSslSocket::setLocalCertificate(const QSslCertificate &certificate)

   859 {

   860     Q_D(QSslSocket);

   861     d->configuration.localCertificate = certificate;

   862 }

   863 

   864 /*!

   865     \overload

   866 

   867     Sets the socket's local \l {QSslCertificate} {certificate} to the

   868     first one found in file \a path, which is parsed according to the 

   869     specified \a format.

   870 */

   871 void QSslSocket::setLocalCertificate(const QString &path,

   872                                      QSsl::EncodingFormat format)

   873 {

   874     Q_D(QSslSocket);

   875     QFile file(path);

   876     if (file.open(QIODevice::ReadOnly | QIODevice::Text))

   877         d->configuration.localCertificate = QSslCertificate(file.readAll(), format);

   878 }

   879 

   880 /*!

   881     Returns the socket's local \l {QSslCertificate} {certificate}, or

   882     an empty certificate if no local certificate has been assigned.

   883 

   884     \sa setLocalCertificate(), privateKey()

   885 */

   886 QSslCertificate QSslSocket::localCertificate() const

   887 {

   888     Q_D(const QSslSocket);

   889     return d->configuration.localCertificate;

   890 }

   891 

   892 /*!

   893     Returns the peer's digital certificate (i.e., the immediate

   894     certificate of the host you are connected to), or a null

   895     certificate, if the peer has not assigned a certificate.

   896     

   897     The peer certificate is checked automatically during the

   898     handshake phase, so this function is normally used to fetch

   899     the certificate for display or for connection diagnostic

   900     purposes. It contains information about the peer, including

   901     its host name, the certificate issuer, and the peer's public

   902     key.

   903 

   904     Because the peer certificate is set during the handshake phase, it

   905     is safe to access the peer certificate from a slot connected to

   906     the sslErrors() signal or the encrypted() signal.

   907 

   908     If a null certificate is returned, it can mean the SSL handshake

   909     failed, or it can mean the host you are connected to doesn't have

   910     a certificate, or it can mean there is no connection.

   911 

   912     If you want to check the peer's complete chain of certificates,

   913     use peerCertificateChain() to get them all at once.

   914 

   915     \sa peerCertificateChain()

   916 */

   917 QSslCertificate QSslSocket::peerCertificate() const

   918 {

   919     Q_D(const QSslSocket);

   920     return d->configuration.peerCertificate;

   921 }

   922 

   923 /*!

   924     Returns the peer's chain of digital certificates, or an empty list

   925     of certificates.

   926 

   927     Peer certificates are checked automatically during the handshake

   928     phase. This function is normally used to fetch certificates for

   929     display, or for performing connection diagnostics. Certificates

   930     contain information about the peer and the certificate issuers,

   931     including host name, issuer names, and issuer public keys.

   932 

   933     The peer certificates are set in QSslSocket during the handshake

   934     phase, so it is safe to call this function from a slot connected

   935     to the sslErrors() signal or the encrypted() signal.

   936 

   937     If an empty list is returned, it can mean the SSL handshake

   938     failed, or it can mean the host you are connected to doesn't have

   939     a certificate, or it can mean there is no connection.

   940 

   941     If you want to get only the peer's immediate certificate, use

   942     peerCertificate().

   943 

   944     \sa peerCertificate()

   945 */

   946 QList<QSslCertificate> QSslSocket::peerCertificateChain() const

   947 {

   948     Q_D(const QSslSocket);

   949     return d->configuration.peerCertificateChain;

   950 }

   951 

   952 /*!

   953     Returns the socket's cryptographic \l {QSslCipher} {cipher}, or a

   954     null cipher if the connection isn't encrypted. The socket's cipher

   955     for the session is set during the handshake phase. The cipher is

   956     used to encrypt and decrypt data transmitted through the socket.

   957 

   958     QSslSocket also provides functions for setting the ordered list of

   959     ciphers from which the handshake phase will eventually select the

   960     session cipher. This ordered list must be in place before the

   961     handshake phase begins.

   962 

   963     \sa ciphers(), setCiphers(), setDefaultCiphers(), defaultCiphers(),

   964     supportedCiphers()

   965 */

   966 QSslCipher QSslSocket::sessionCipher() const

   967 {

   968     Q_D(const QSslSocket);

   969     return d->sessionCipher();

   970 }

   971 

   972 /*!

   973     Sets the socket's private \l {QSslKey} {key} to \a key. The

   974     private key and the local \l {QSslCertificate} {certificate} are

   975     used by clients and servers that must prove their identity to

   976     SSL peers.

   977 

   978     Both the key and the local certificate are required if you are

   979     creating an SSL server socket. If you are creating an SSL client

   980     socket, the key and local certificate are required if your client

   981     must identify itself to an SSL server.

   982 

   983     \sa privateKey(), setLocalCertificate()

   984 */

   985 void QSslSocket::setPrivateKey(const QSslKey &key)

   986 {

   987     Q_D(QSslSocket);

   988     d->configuration.privateKey = key;

   989 }

   990 

   991 /*!

   992     \overload

   993 

   994     Reads the string in file \a fileName and decodes it using

   995     a specified \a algorithm and encoding \a format to construct

   996     an \l {QSslKey} {SSL key}. If the encoded key is encrypted,

   997     \a passPhrase is used to decrypt it.

   998 

   999     The socket's private key is set to the constructed key. The

  1000     private key and the local \l {QSslCertificate} {certificate} are

  1001     used by clients and servers that must prove their identity to SSL

  1002     peers.

  1003 

  1004     Both the key and the local certificate are required if you are

  1005     creating an SSL server socket. If you are creating an SSL client

  1006     socket, the key and local certificate are required if your client

  1007     must identify itself to an SSL server.

  1008     

  1009     \sa privateKey(), setLocalCertificate()

  1010 */

  1011 void QSslSocket::setPrivateKey(const QString &fileName, QSsl::KeyAlgorithm algorithm,

  1012                                QSsl::EncodingFormat format, const QByteArray &passPhrase)

  1013 {

  1014     Q_D(QSslSocket);

  1015     QFile file(fileName);

  1016     if (file.open(QIODevice::ReadOnly)) {

  1017         d->configuration.privateKey = QSslKey(file.readAll(), algorithm,

  1018                                               format, QSsl::PrivateKey, passPhrase);

  1019     }

  1020 }

  1021 

  1022 /*!

  1023     Returns this socket's private key.

  1024 

  1025     \sa setPrivateKey(), localCertificate()

  1026 */

  1027 QSslKey QSslSocket::privateKey() const

  1028 {

  1029     Q_D(const QSslSocket);

  1030     return d->configuration.privateKey;

  1031 }

  1032 

  1033 /*!

  1034     Returns this socket's current cryptographic cipher suite. This

  1035     list is used during the socket's handshake phase for choosing a

  1036     session cipher. The returned list of ciphers is ordered by

  1037     descending preference. (i.e., the first cipher in the list is the

  1038     most preferred cipher). The session cipher will be the first one

  1039     in the list that is also supported by the peer.

  1040 

  1041     By default, the handshake phase can choose any of the ciphers

  1042     supported by this system's SSL libraries, which may vary from

  1043     system to system. The list of ciphers supported by this system's

  1044     SSL libraries is returned by supportedCiphers(). You can restrict

  1045     the list of ciphers used for choosing the session cipher for this

  1046     socket by calling setCiphers() with a subset of the supported

  1047     ciphers. You can revert to using the entire set by calling

  1048     setCiphers() with the list returned by supportedCiphers().

  1049 

  1050     You can restrict the list of ciphers used for choosing the session

  1051     cipher for \e all sockets by calling setDefaultCiphers() with a

  1052     subset of the supported ciphers. You can revert to using the

  1053     entire set by calling setCiphers() with the list returned by

  1054     supportedCiphers().

  1055 

  1056     \sa setCiphers(), defaultCiphers(), setDefaultCiphers(), supportedCiphers()

  1057 */

  1058 QList<QSslCipher> QSslSocket::ciphers() const

  1059 {

  1060     Q_D(const QSslSocket);

  1061     return d->configuration.ciphers;

  1062 }

  1063 

  1064 /*!

  1065     Sets the cryptographic cipher suite for this socket to \a ciphers,

  1066     which must contain a subset of the ciphers in the list returned by

  1067     supportedCiphers().

  1068 

  1069     Restricting the cipher suite must be done before the handshake

  1070     phase, where the session cipher is chosen.

  1071 

  1072     \sa ciphers(), setDefaultCiphers(), supportedCiphers()

  1073 */

  1074 void QSslSocket::setCiphers(const QList<QSslCipher> &ciphers)

  1075 {

  1076     Q_D(QSslSocket);

  1077     d->configuration.ciphers = ciphers;

  1078 }

  1079 

  1080 /*!

  1081     Sets the cryptographic cipher suite for this socket to \a ciphers, which

  1082     is a colon-separated list of cipher suite names. The ciphers are listed in

  1083     order of preference, starting with the most preferred cipher. For example:

  1084 

  1085     \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 4

  1086 

  1087     Each cipher name in \a ciphers must be the name of a cipher in the

  1088     list returned by supportedCiphers().  Restricting the cipher suite

  1089     must be done before the handshake phase, where the session cipher

  1090     is chosen.

  1091 

  1092     \sa ciphers(), setDefaultCiphers(), supportedCiphers()

  1093 */

  1094 void QSslSocket::setCiphers(const QString &ciphers)

  1095 {

  1096     Q_D(QSslSocket);

  1097     d->configuration.ciphers.clear();

  1098     foreach (QString cipherName, ciphers.split(QLatin1String(":"),QString::SkipEmptyParts)) {

  1099         for (int i = 0; i < 3; ++i) {

  1100             // ### Crude

  1101             QSslCipher cipher(cipherName, QSsl::SslProtocol(i));

  1102             if (!cipher.isNull())

  1103                 d->configuration.ciphers << cipher;

  1104         }

  1105     }

  1106 }

  1107 

  1108 /*!

  1109     Sets the default cryptographic cipher suite for all sockets in

  1110     this application to \a ciphers, which must contain a subset of the

  1111     ciphers in the list returned by supportedCiphers().

  1112 

  1113     Restricting the default cipher suite only affects SSL sockets

  1114     that perform their handshake phase after the default cipher

  1115     suite has been changed.

  1116 

  1117     \sa setCiphers(), defaultCiphers(), supportedCiphers()

  1118 */

  1119 void QSslSocket::setDefaultCiphers(const QList<QSslCipher> &ciphers)

  1120 {

  1121     QSslSocketPrivate::setDefaultCiphers(ciphers);

  1122 }

  1123 

  1124 /*!

  1125     Returns the default cryptographic cipher suite for all sockets in

  1126     this application. This list is used during the socket's handshake

  1127     phase when negotiating with the peer to choose a session cipher.

  1128     The list is ordered by preference (i.e., the first cipher in the

  1129     list is the most preferred cipher).

  1130 

  1131     By default, the handshake phase can choose any of the ciphers

  1132     supported by this system's SSL libraries, which may vary from

  1133     system to system. The list of ciphers supported by this system's

  1134     SSL libraries is returned by supportedCiphers().