// Copyright (C) 2021 The Qt Company Ltd.

// Copyright (C) 2014 BlackBerry Limited. All rights reserved.

// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

// Qt-Security score:significant reason:default

//#define QSSLSOCKET_DEBUG

/*!

    \class QSslSocket

    \brief The QSslSocket class provides an SSL encrypted socket for both

    clients and servers.

    \since 4.3

    \reentrant

    \ingroup network

    \ingroup ssl

    \inmodule QtNetwork

    QSslSocket establishes a secure, encrypted TCP connection you can

    use for transmitting encrypted data. It can operate in both client

    and server mode, and it supports modern TLS protocols, including

    TLS 1.3. By default, QSslSocket uses only TLS protocols

    which are considered to be secure (QSsl::SecureProtocols), but you can

    change the TLS protocol by calling setProtocol() as long as you do

    it before the handshake has started.

    SSL encryption operates on top of the existing TCP stream after

    the socket enters the ConnectedState. There are two simple ways to

    establish a secure connection using QSslSocket: With an immediate

    SSL handshake, or with a delayed SSL handshake occurring after the

    connection has been established in unencrypted mode.

    The most common way to use QSslSocket is to construct an object

    and start a secure connection by calling connectToHostEncrypted().

    This method starts an immediate SSL handshake once the connection

    has been established.

    \snippet code/src_network_ssl_qsslsocket.cpp 0

    As with a plain QTcpSocket, QSslSocket enters the HostLookupState,

    ConnectingState, and finally the ConnectedState, if the connection

    is successful. The handshake then starts automatically, and if it

    succeeds, the encrypted() signal is emitted to indicate the socket

    has entered the encrypted state and is ready for use.

    Note that data can be written to the socket immediately after the

    return from connectToHostEncrypted() (i.e., before the encrypted()

    signal is emitted). The data is queued in QSslSocket until after

    the encrypted() signal is emitted.

    An example of using the delayed SSL handshake to secure an

    existing connection is the case where an SSL server secures an

    incoming connection. Suppose you create an SSL server class as a

    subclass of QTcpServer. You would override

    QTcpServer::incomingConnection() with something like the example

    below, which first constructs an instance of QSslSocket and then

    calls setSocketDescriptor() to set the new socket's descriptor to

    the existing one passed in. It then initiates the SSL handshake

    by calling startServerEncryption().

    \snippet code/src_network_ssl_qsslsocket.cpp 1

    If an error occurs, QSslSocket emits the sslErrors() signal. In this

    case, if no action is taken to ignore the error(s), the connection

    is dropped. To continue, despite the occurrence of an error, you

    can call ignoreSslErrors(), either from within this slot after the

    error occurs, or any time after construction of the QSslSocket and

    before the connection is attempted. This will allow QSslSocket to

    ignore the errors it encounters when establishing the identity of

    the peer. Ignoring errors during an SSL handshake should be used

    with caution, since a fundamental characteristic of secure

    connections is that they should be established with a successful

    handshake.

    Once encrypted, you use QSslSocket as a regular QTcpSocket. When

    readyRead() is emitted, you can call read(), canReadLine() and

    readLine(), or getChar() to read decrypted data from QSslSocket's

    internal buffer, and you can call write() or putChar() to write

    data back to the peer. QSslSocket will automatically encrypt the

    written data for you, and emit encryptedBytesWritten() once

    the data has been written to the peer.

    As a convenience, QSslSocket supports QTcpSocket's blocking

    functions waitForConnected(), waitForReadyRead(),

    waitForBytesWritten(), and waitForDisconnected(). It also provides

    waitForEncrypted(), which will block the calling thread until an

    encrypted connection has been established.

    \snippet code/src_network_ssl_qsslsocket.cpp 2

    QSslSocket provides an extensive, easy-to-use API for handling

    cryptographic ciphers, private keys, and local, peer, and

    Certification Authority (CA) certificates. It also provides an API

    for handling errors that occur during the handshake phase.

    The following features can also be customized:

    \list

    \li The socket's cryptographic cipher suite can be customized before

    the handshake phase with QSslConfiguration::setCiphers().

    \li The socket's local certificate and private key can be customized

    before the handshake phase with setLocalCertificate() and

    setPrivateKey().

    \li The CA certificate database can be extended and customized with

    QSslConfiguration::addCaCertificate(),

    QSslConfiguration::addCaCertificates().

    \endlist

    To extend the list of \e default CA certificates used by the SSL sockets

    during the SSL handshake you must update the default configuration, as

    in the snippet below:

    \code

        QList<QSslCertificate> certificates = getCertificates();

        QSslConfiguration configuration = QSslConfiguration::defaultConfiguration();

        configuration.addCaCertificates(certificates);

        QSslConfiguration::setDefaultConfiguration(configuration);

    \endcode

    \note If available, root certificates on Unix (excluding \macos) will be

    loaded on demand from the standard certificate directories. If you do not

    want to load root certificates on demand, you need to call either

    QSslConfiguration::defaultConfiguration().setCaCertificates() before the first

    SSL handshake is made in your application (for example, via passing

    QSslSocket::systemCaCertificates() to it), or call

    QSslConfiguration::defaultConfiguration()::setCaCertificates() on your QSslSocket instance

    prior to the SSL handshake.

    For more information about ciphers and certificates, refer to QSslCipher and

    QSslCertificate.

    This product includes software developed by the OpenSSL Project

    for use in the OpenSSL Toolkit (\l{http://www.openssl.org/}).

    \note Be aware of the difference between the bytesWritten() signal and

    the encryptedBytesWritten() signal. For a QTcpSocket, bytesWritten()

    will get emitted as soon as data has been written to the TCP socket.

    For a QSslSocket, bytesWritten() will get emitted when the data

    is being encrypted and encryptedBytesWritten()

    will get emitted as soon as data has been written to the TCP socket.

    \sa QSslCertificate, QSslCipher, QSslError

*/

/*!

    \enum QSslSocket::SslMode

    Describes the connection modes available for QSslSocket.

    \value UnencryptedMode The socket is unencrypted. Its

    behavior is identical to QTcpSocket.

    \value SslClientMode The socket is a client-side SSL socket.

    It is either already encrypted, or it is in the SSL handshake

    phase (see QSslSocket::isEncrypted()).

    \value SslServerMode The socket is a server-side SSL socket.

    It is either already encrypted, or it is in the SSL handshake

    phase (see QSslSocket::isEncrypted()).

*/

/*!

    \enum QSslSocket::PeerVerifyMode

    \since 4.4

    Describes the peer verification modes for QSslSocket. The default mode is

    AutoVerifyPeer, which selects an appropriate mode depending on the

    socket's QSocket::SslMode.

    \value VerifyNone QSslSocket will not request a certificate from the

    peer. You can set this mode if you are not interested in the identity of

    the other side of the connection. The connection will still be encrypted,

    and your socket will still send its local certificate to the peer if it's

    requested.

    \value QueryPeer QSslSocket will request a certificate from the peer, but

    does not require this certificate to be valid. This is useful when you

    want to display peer certificate details to the user without affecting the

    actual SSL handshake. This mode is the default for servers.

    Note: In Schannel this value acts the same as VerifyNone.

    \value VerifyPeer QSslSocket will request a certificate from the peer

    during the SSL handshake phase, and requires that this certificate is

    valid. On failure, QSslSocket will emit the QSslSocket::sslErrors()

    signal. This mode is the default for clients.

    \value AutoVerifyPeer QSslSocket will automatically use QueryPeer for

    server sockets and VerifyPeer for client sockets.

    \sa QSslSocket::peerVerifyMode()

*/

/*!

    \fn void QSslSocket::encrypted()

    This signal is emitted when QSslSocket enters encrypted mode. After this

    signal has been emitted, QSslSocket::isEncrypted() will return true, and

    all further transmissions on the socket will be encrypted.

    \sa QSslSocket::connectToHostEncrypted(), QSslSocket::isEncrypted()

*/

/*!

    \fn void QSslSocket::modeChanged(QSslSocket::SslMode mode)

    This signal is emitted when QSslSocket changes from \l

    QSslSocket::UnencryptedMode to either \l QSslSocket::SslClientMode or \l

    QSslSocket::SslServerMode. \a mode is the new mode.

    \sa QSslSocket::mode()

*/

/*!

    \fn void QSslSocket::encryptedBytesWritten(qint64 written)

    \since 4.4

    This signal is emitted when QSslSocket writes its encrypted data to the

    network. The \a written parameter contains the number of bytes that were

    successfully written.

    \sa QIODevice::bytesWritten()

*/

/*!

    \fn void QSslSocket::peerVerifyError(const QSslError &error)

    \since 4.4

    QSslSocket can emit this signal several times during the SSL handshake,

    before encryption has been established, to indicate that an error has

    occurred while establishing the identity of the peer. The \a error is

    usually an indication that QSslSocket is unable to securely identify the

    peer.

    This signal provides you with an early indication when something's wrong.

    By connecting to this signal, you can manually choose to tear down the

    connection from inside the connected slot before the handshake has

    completed. If no action is taken, QSslSocket will proceed to emitting

    QSslSocket::sslErrors().

    \sa sslErrors()

*/

/*!

    \fn void QSslSocket::sslErrors(const QList<QSslError> &errors);

    QSslSocket emits this signal after the SSL handshake to indicate that one

    or more errors have occurred while establishing the identity of the

    peer. The errors are usually an indication that QSslSocket is unable to

    securely identify the peer. Unless any action is taken, the connection

    will be dropped after this signal has been emitted.

    If you want to continue connecting despite the errors that have occurred,

    you must call QSslSocket::ignoreSslErrors() from inside a slot connected to

    this signal. If you need to access the error list at a later point, you

    can call sslHandshakeErrors().

    \a errors contains one or more errors that prevent QSslSocket from

    verifying the identity of the peer.

    \note You cannot use Qt::QueuedConnection when connecting to this signal,

    or calling QSslSocket::ignoreSslErrors() will have no effect.

    \sa peerVerifyError()

*/

/*!

    \fn void QSslSocket::preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator *authenticator)

    \since 5.5

    QSslSocket emits this signal when it negotiates a PSK ciphersuite, and

    therefore a PSK authentication is then required.

    When using PSK, the client must send to the server a valid identity and a

    valid pre shared key, in order for the SSL handshake to continue.

    Applications can provide this information in a slot connected to this

    signal, by filling in the passed \a authenticator object according to their

    needs.

    \note Ignoring this signal, or failing to provide the required credentials,

    will cause the handshake to fail, and therefore the connection to be aborted.

    \note The \a authenticator object is owned by the socket and must not be

    deleted by the application.

    \sa QSslPreSharedKeyAuthenticator

*/

/*!

    \fn void QSslSocket::alertSent(QSsl::AlertLevel level, QSsl::AlertType type, const QString &description)

    QSslSocket emits this signal if an alert message was sent to a peer. \a level

    describes if it was a warning or a fatal error. \a type gives the code

    of the alert message. When a textual description of the alert message is

    available, it is supplied in \a description.

    \note This signal is mostly informational and can be used for debugging

    purposes, normally it does not require any actions from the application.

    \note Not all backends support this functionality.

    \sa alertReceived(), QSsl::AlertLevel, QSsl::AlertType

*/

/*!

    \fn void QSslSocket::alertReceived(QSsl::AlertLevel level, QSsl::AlertType type, const QString &description)

    QSslSocket emits this signal if an alert message was received from a peer.

    \a level tells if the alert was fatal or it was a warning. \a type is the

    code explaining why the alert was sent. When a textual description of

    the alert message is available, it is supplied in \a description.

    \note The signal is mostly for informational and debugging purposes and does not

    require any handling in the application. If the alert was fatal, underlying

    backend will handle it and close the connection.

    \note Not all backends support this functionality.

    \sa alertSent(), QSsl::AlertLevel, QSsl::AlertType

*/

/*!

    \fn void QSslSocket::handshakeInterruptedOnError(const QSslError &error)

    QSslSocket emits this signal if a certificate verification error was

    found and if early error reporting was enabled in QSslConfiguration.

    An application is expected to inspect the \a error and decide if

    it wants to continue the handshake, or abort it and send an alert message

    to the peer. The signal-slot connection must be direct.

    \sa continueInterruptedHandshake(), sslErrors(), QSslConfiguration::setHandshakeMustInterruptOnError()

*/

/*!

    \fn void QSslSocket::newSessionTicketReceived()

    \since 5.15

    If TLS 1.3 protocol was negotiated during a handshake, QSslSocket

    emits this signal after receiving NewSessionTicket message. Session

    and session ticket's lifetime hint are updated in the socket's

    configuration. The session can be used for session resumption (and

    a shortened handshake) in future TLS connections.

    \note This functionality enabled only with OpenSSL backend and requires

    OpenSSL v 1.1.1 or above.

    \sa QSslSocket::sslConfiguration(), QSslConfiguration::sessionTicket(), QSslConfiguration::sessionTicketLifeTimeHint()

*/

#include "qssl_p.h"

#include "qsslsocket.h"

#include "qsslcipher.h"

#include "qocspresponse.h"

#include "qtlsbackend_p.h"

#include "qsslconfiguration_p.h"

#include "qsslsocket_p.h"

#include <QtCore/qdebug.h>

#include <QtCore/qdir.h>

#include <QtCore/qmutex.h>

#include <QtCore/qurl.h>

#include <QtCore/qelapsedtimer.h>

#include <QtNetwork/qhostaddress.h>

#include <QtNetwork/qhostinfo.h>

QT_BEGIN_NAMESPACE

using namespace Qt::StringLiterals;

#ifdef Q_OS_VXWORKS

constexpr auto isVxworks = true;

#else

constexpr auto isVxworks = false;

#endif

class QSslSocketGlobalData

{

public:

    QSslSocketGlobalData()

        : config(new QSslConfigurationPrivate),

          dtlsConfig(new QSslConfigurationPrivate)

    {

#if QT_CONFIG(dtls)

        dtlsConfig->protocol = QSsl::DtlsV1_2OrLater;

#endif // dtls

    }

    QMutex mutex;

    QList<QSslCipher> supportedCiphers;

    QList<QSslEllipticCurve> supportedEllipticCurves;

    QExplicitlySharedDataPointer<QSslConfigurationPrivate> config;

    QExplicitlySharedDataPointer<QSslConfigurationPrivate> dtlsConfig;

};

Q_GLOBAL_STATIC(QSslSocketGlobalData, globalData)

/*!

    Constructs a QSslSocket object. \a parent is passed to QObject's

    constructor. The new socket's \l {QSslCipher} {cipher} suite is

    set to the one returned by the static method defaultCiphers().

*/

QSslSocket::QSslSocket(QObject *parent)

    : QTcpSocket(*new QSslSocketPrivate, parent)

{

    Q_D(QSslSocket);

#ifdef QSSLSOCKET_DEBUG

    qCDebug(lcSsl) << "QSslSocket::QSslSocket(" << parent << "), this =" << (void *)this;

#endif

    d->q_ptr = this;

    d->init();

}

/*!

    Destroys the QSslSocket.

*/

QSslSocket::~QSslSocket()

{

    Q_D(QSslSocket);

#ifdef QSSLSOCKET_DEBUG

    qCDebug(lcSsl) << "QSslSocket::~QSslSocket(), this =" << (void *)this;

#endif

    delete d->plainSocket;

    d->plainSocket = nullptr;

}

/*!

    \reimp

    \since 5.0

    Continues data transfer on the socket after it has been paused. If

    "setPauseMode(QAbstractSocket::PauseOnSslErrors);" has been called on

    this socket and a sslErrors() signal is received, calling this method

    is necessary for the socket to continue.

    \sa QAbstractSocket::pauseMode(), QAbstractSocket::setPauseMode()

*/

void QSslSocket::resume()

{

    Q_D(QSslSocket);

    if (!d->paused)

        return;

    // continuing might emit signals, rather do this through the event loop

    QMetaObject::invokeMethod(this, "_q_resumeImplementation", Qt::QueuedConnection);

}

/*!

    Starts an encrypted connection to the device \a hostName on \a

    port, using \a mode as the \l OpenMode. This is equivalent to

    calling connectToHost() to establish the connection, followed by a

    call to startClientEncryption(). The \a protocol parameter can be

    used to specify which network protocol to use (eg. IPv4 or IPv6).

    QSslSocket first enters the HostLookupState. Then, after entering

    either the event loop or one of the waitFor...() functions, it

    enters the ConnectingState, emits connected(), and then initiates

    the SSL client handshake. At each state change, QSslSocket emits

    signal stateChanged().

    After initiating the SSL client handshake, if the identity of the

    peer can't be established, signal sslErrors() is emitted. If you

    want to ignore the errors and continue connecting, you must call

    ignoreSslErrors(), either from inside a slot function connected to

    the sslErrors() signal, or prior to entering encrypted mode. If

    ignoreSslErrors() is not called, the connection is dropped, signal

    disconnected() is emitted, and QSslSocket returns to the

    UnconnectedState.

    If the SSL handshake is successful, QSslSocket emits encrypted().

    \snippet code/src_network_ssl_qsslsocket.cpp 3

    \note The example above shows that text can be written to

    the socket immediately after requesting the encrypted connection,

    before the encrypted() signal has been emitted. In such cases, the

    text is queued in the object and written to the socket \e after

    the connection is established and the encrypted() signal has been

    emitted.

    The default for \a mode is \l ReadWrite.

    If you want to create a QSslSocket on the server side of a connection, you

    should instead call startServerEncryption() upon receiving the incoming

    connection through QTcpServer.

    \sa connectToHost(), startClientEncryption(), waitForConnected(), waitForEncrypted()

*/

void QSslSocket::connectToHostEncrypted(const QString &hostName, quint16 port, OpenMode mode, NetworkLayerProtocol protocol)

{

    Q_D(QSslSocket);

    if (d->state == ConnectedState || d->state == ConnectingState) {

        qCWarning(lcSsl,

                  "QSslSocket::connectToHostEncrypted() called when already connecting/connected");

        return;

    }

    if (!supportsSsl()) {

        qCWarning(lcSsl, "QSslSocket::connectToHostEncrypted: TLS initialization failed");

        d->setErrorAndEmit(QAbstractSocket::SslInternalError, tr("TLS initialization failed"));

        return;

    }

    if (!d->verifyProtocolSupported("QSslSocket::connectToHostEncrypted:"))

        return;

    d->init();

    d->autoStartHandshake = true;

    d->initialized = true;

    // Note: When connecting to localhost, some platforms (e.g., HP-UX and some BSDs)

    // establish the connection immediately (i.e., first attempt).

    connectToHost(hostName, port, mode, protocol);

}

/*!

    \since 4.6

    \overload

    In addition to the original behaviour of connectToHostEncrypted,

    this overloaded method enables the usage of a different hostname

    (\a sslPeerName) for the certificate validation instead of

    the one used for the TCP connection (\a hostName).

    \sa connectToHostEncrypted()

*/

void QSslSocket::connectToHostEncrypted(const QString &hostName, quint16 port,

                                        const QString &sslPeerName, OpenMode mode,

                                        NetworkLayerProtocol protocol)

{

    Q_D(QSslSocket);

    if (d->state == ConnectedState || d->state == ConnectingState) {

        qCWarning(lcSsl,

                  "QSslSocket::connectToHostEncrypted() called when already connecting/connected");

        return;

    }

    if (!supportsSsl()) {

        qCWarning(lcSsl, "QSslSocket::connectToHostEncrypted: TLS initialization failed");

        d->setErrorAndEmit(QAbstractSocket::SslInternalError, tr("TLS initialization failed"));

        return;

    }

    d->init();

    d->autoStartHandshake = true;

    d->initialized = true;

    d->verificationPeerName = sslPeerName;

    // Note: When connecting to localhost, some platforms (e.g., HP-UX and some BSDs)

    // establish the connection immediately (i.e., first attempt).

    connectToHost(hostName, port, mode, protocol);

}

/*!

    Initializes QSslSocket with the native socket descriptor \a

    socketDescriptor. Returns \c true if \a socketDescriptor is accepted

    as a valid socket descriptor; otherwise returns \c false.

    The socket is opened in the mode specified by \a openMode, and

    enters the socket state specified by \a state.

    \note It is not possible to initialize two sockets with the same

    native socket descriptor.

    \sa socketDescriptor()

*/

bool QSslSocket::setSocketDescriptor(qintptr socketDescriptor, SocketState state, OpenMode openMode)

{

    Q_D(QSslSocket);

#ifdef QSSLSOCKET_DEBUG

    qCDebug(lcSsl) << "QSslSocket::setSocketDescriptor(" << socketDescriptor << ','

             << state << ',' << openMode << ')';

#endif

    if (!d->plainSocket)

        d->createPlainSocket(openMode);

    bool retVal = d->plainSocket->setSocketDescriptor(socketDescriptor, state, openMode);

    d->cachedSocketDescriptor = d->plainSocket->socketDescriptor();

    d->setError(d->plainSocket->error(), d->plainSocket->errorString());

    setSocketState(state);

    setOpenMode(openMode);

    setLocalPort(d->plainSocket->localPort());

    setLocalAddress(d->plainSocket->localAddress());

    setPeerPort(d->plainSocket->peerPort());

    setPeerAddress(d->plainSocket->peerAddress());

    setPeerName(d->plainSocket->peerName());

    d->readChannelCount = d->plainSocket->readChannelCount();

    d->writeChannelCount = d->plainSocket->writeChannelCount();

    return retVal;

}

/*!

    \since 4.6

    Sets the given \a option to the value described by \a value.

    \sa socketOption()

*/

void QSslSocket::setSocketOption(QAbstractSocket::SocketOption option, const QVariant &value)

{

    Q_D(QSslSocket);

    if (d->plainSocket)

        d->plainSocket->setSocketOption(option, value);

}

/*!

    \since 4.6

    Returns the value of the \a option option.

    \sa setSocketOption()

*/

QVariant QSslSocket::socketOption(QAbstractSocket::SocketOption option)

{

    Q_D(QSslSocket);

    if (d->plainSocket)

        return d->plainSocket->socketOption(option);

    else

        return QVariant();

}

/*!

    Returns the current mode for the socket; either UnencryptedMode, where

    QSslSocket behaves identially to QTcpSocket, or one of SslClientMode or

    SslServerMode, where the client is either negotiating or in encrypted

    mode.

    When the mode changes, QSslSocket emits modeChanged()

    \sa SslMode

*/

QSslSocket::SslMode QSslSocket::mode() const

{

    Q_D(const QSslSocket);

    return d->mode;

}

/*!

    Returns \c true if the socket is encrypted; otherwise, false is returned.

    An encrypted socket encrypts all data that is written by calling write()

    or putChar() before the data is written to the network, and decrypts all

    incoming data as the data is received from the network, before you call

    read(), readLine() or getChar().

    QSslSocket emits encrypted() when it enters encrypted mode.

    You can call sessionCipher() to find which cryptographic cipher is used to

    encrypt and decrypt your data.

    \sa mode()

*/

bool QSslSocket::isEncrypted() const

{

    Q_D(const QSslSocket);

    return d->connectionEncrypted;

}

/*!

    Returns the socket's SSL protocol. By default, \l QSsl::SecureProtocols is used.

    \sa setProtocol()

*/

QSsl::SslProtocol QSslSocket::protocol() const

{

    Q_D(const QSslSocket);

    return d->configuration.protocol;

}

/*!

    Sets the socket's SSL protocol to \a protocol. This will affect the next

    initiated handshake; calling this function on an already-encrypted socket

    will not affect the socket's protocol.

*/

void QSslSocket::setProtocol(QSsl::SslProtocol protocol)

{

    Q_D(QSslSocket);

    d->configuration.protocol = protocol;

}

/*!

    \since 4.4

    Returns the socket's verify mode. This mode decides whether

    QSslSocket should request a certificate from the peer (i.e., the client

    requests a certificate from the server, or a server requesting a

    certificate from the client), and whether it should require that this

    certificate is valid.

    The default mode is AutoVerifyPeer, which tells QSslSocket to use

    VerifyPeer for clients and QueryPeer for servers.

    \sa setPeerVerifyMode(), peerVerifyDepth(), mode()

*/

QSslSocket::PeerVerifyMode QSslSocket::peerVerifyMode() const

{

    Q_D(const QSslSocket);

    return d->configuration.peerVerifyMode;

}

/*!

    \since 4.4

    Sets the socket's verify mode to \a mode. This mode decides whether

    QSslSocket should request a certificate from the peer (i.e., the client

    requests a certificate from the server, or a server requesting a

    certificate from the client), and whether it should require that this

    certificate is valid.

    The default mode is AutoVerifyPeer, which tells QSslSocket to use

    VerifyPeer for clients and QueryPeer for servers.

    Setting this mode after encryption has started has no effect on the

    current connection.

    \sa peerVerifyMode(), setPeerVerifyDepth(), mode()

*/

void QSslSocket::setPeerVerifyMode(QSslSocket::PeerVerifyMode mode)

{

    Q_D(QSslSocket);

    d->configuration.peerVerifyMode = mode;

}

/*!

    \since 4.4

    Returns the maximum number of certificates in the peer's certificate chain

    to be checked during the SSL handshake phase, or 0 (the default) if no

    maximum depth has been set, indicating that the whole certificate chain

    should be checked.

    The certificates are checked in issuing order, starting with the peer's

    own certificate, then its issuer's certificate, and so on.

    \sa setPeerVerifyDepth(), peerVerifyMode()

*/

int QSslSocket::peerVerifyDepth() const

{

    Q_D(const QSslSocket);

    return d->configuration.peerVerifyDepth;

}

/*!

    \since 4.4

    Sets the maximum number of certificates in the peer's certificate chain to

    be checked during the SSL handshake phase, to \a depth. Setting a depth of

    0 means that no maximum depth is set, indicating that the whole

    certificate chain should be checked.

    The certificates are checked in issuing order, starting with the peer's

    own certificate, then its issuer's certificate, and so on.

    \sa peerVerifyDepth(), setPeerVerifyMode()

*/

void QSslSocket::setPeerVerifyDepth(int depth)

{

    Q_D(QSslSocket);

    if (depth < 0) {

        qCWarning(lcSsl, "QSslSocket::setPeerVerifyDepth: cannot set negative depth of %d", depth);

        return;

    }

    d->configuration.peerVerifyDepth = depth;

}

/*!

    \since 4.8

    Returns the different hostname for the certificate validation, as set by

    setPeerVerifyName or by connectToHostEncrypted.

    \sa setPeerVerifyName(), connectToHostEncrypted()

*/

QString QSslSocket::peerVerifyName() const

{

    Q_D(const QSslSocket);

    return d->verificationPeerName;

}

/*!

    \since 4.8

    Sets a different host name, given by \a hostName, for the certificate

    validation instead of the one used for the TCP connection.

    \sa connectToHostEncrypted()

*/

void QSslSocket::setPeerVerifyName(const QString &hostName)

{

    Q_D(QSslSocket);

    d->verificationPeerName = hostName;

}

/*!

    \reimp

    Returns the number of decrypted bytes that are immediately available for

    reading.

*/

qint64 QSslSocket::bytesAvailable() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return QAbstractSocket::bytesAvailable() + (d->plainSocket ? d->plainSocket->bytesAvailable() : 0);

    return QAbstractSocket::bytesAvailable();

}

/*!

    \reimp

    Returns the number of unencrypted bytes that are waiting to be encrypted

    and written to the network.

*/

qint64 QSslSocket::bytesToWrite() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return d->plainSocket ? d->plainSocket->bytesToWrite() : 0;

    return d->writeBuffer.size();

}

/*!

    \since 4.4

    Returns the number of encrypted bytes that are awaiting decryption.

    Normally, this function will return 0 because QSslSocket decrypts its

    incoming data as soon as it can.

*/

qint64 QSslSocket::encryptedBytesAvailable() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return 0;

    return d->plainSocket->bytesAvailable();

}

/*!

    \since 4.4

    Returns the number of encrypted bytes that are waiting to be written to

    the network.

*/

qint64 QSslSocket::encryptedBytesToWrite() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return 0;

    return d->plainSocket->bytesToWrite();

}

/*!

    \reimp

    Returns \c true if you can read one while line (terminated by a single ASCII

    '\\n' character) of decrypted characters; otherwise, false is returned.

*/

bool QSslSocket::canReadLine() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return QAbstractSocket::canReadLine() || (d->plainSocket && d->plainSocket->canReadLine());

    return QAbstractSocket::canReadLine();

}

/*!

    \reimp

*/

void QSslSocket::close()

{

#ifdef QSSLSOCKET_DEBUG

    qCDebug(lcSsl) << "QSslSocket::close()";

#endif

    Q_D(QSslSocket);

    // On Windows, CertGetCertificateChain is probably still doing its

    // job, if the socket is re-used, we want to ignore its reported

    // root CA.

    if (auto *backend = d->backend.get())

        backend->cancelCAFetch();

    if (!d->abortCalled && (encryptedBytesToWrite() || !d->writeBuffer.isEmpty()))

        flush();

    // Initiate TLS shutdown while the read buffer is still valid;

    // QTcpSocket::close() destroys it before calling disconnectFromHost().

    if (!d->abortCalled)

        disconnectFromHost();

    if (d->plainSocket) {

        if (d->abortCalled)

            d->plainSocket->abort();

        else

            d->plainSocket->close();

    }

    QTcpSocket::close();

    // must be cleared, reading/writing not possible on closed socket:

    d->buffer.clear();

    d->writeBuffer.clear();

}

/*!

    \reimp

*/

bool QSslSocket::atEnd() const

{

    Q_D(const QSslSocket);

    if (d->mode == UnencryptedMode)

        return QAbstractSocket::atEnd() && (!d->plainSocket || d->plainSocket->atEnd());

    return QAbstractSocket::atEnd();

}

/*!

    \since 4.4

    Sets the size of QSslSocket's internal read buffer to be \a size bytes.

*/

void QSslSocket::setReadBufferSize(qint64 size)

{

    Q_D(QSslSocket);

    d->readBufferMaxSize = size;

    if (d->plainSocket)

        d->plainSocket->setReadBufferSize(size);

}

/*!

    \since 4.4

    Returns the socket's SSL configuration state. The default SSL

    configuration of a socket is to use the default ciphers,

    default CA certificates, no local private key or certificate.

    The SSL configuration also contains fields that can change with

    time without notice.

    \sa localCertificate(), peerCertificate(), peerCertificateChain(),

        sessionCipher(), privateKey(), QSslConfiguration::ciphers(),

        QSslConfiguration::caCertificates()

*/

QSslConfiguration QSslSocket::sslConfiguration() const

{

    Q_D(const QSslSocket);

    // create a deep copy of our configuration

    QSslConfigurationPrivate *copy = new QSslConfigurationPrivate(d->configuration);

    copy->ref.storeRelaxed(0);              // the QSslConfiguration constructor refs up

    copy->sessionCipher = d->sessionCipher();

    copy->sessionProtocol = d->sessionProtocol();

    return QSslConfiguration(copy);

}

/*!

    \since 4.4

    Sets the socket's SSL configuration to be the contents of \a configuration.

    This function sets the local certificate, the ciphers, the private key and the CA

    certificates to those stored in \a configuration.

    It is not possible to set the SSL-state related fields.

    \sa setLocalCertificate(), setPrivateKey(), QSslConfiguration::setCaCertificates(),

        QSslConfiguration::setCiphers()

*/

void QSslSocket::setSslConfiguration(const QSslConfiguration &configuration)

{

    Q_D(QSslSocket);

    d->configuration.localCertificateChain = configuration.localCertificateChain();

    d->configuration.privateKey = configuration.privateKey();

    d->configuration.ciphers = configuration.ciphers();

    d->configuration.ellipticCurves = configuration.ellipticCurves();

    d->configuration.preSharedKeyIdentityHint = configuration.preSharedKeyIdentityHint();

    d->configuration.dhParams = configuration.diffieHellmanParameters();

    d->configuration.caCertificates = configuration.caCertificates();

    d->configuration.peerVerifyDepth = configuration.peerVerifyDepth();

    d->configuration.peerVerifyMode = configuration.peerVerifyMode();

    d->configuration.protocol = configuration.protocol();

    d->configuration.backendConfig = configuration.backendConfiguration();

    d->configuration.sslOptions = configuration.d->sslOptions;

    d->configuration.sslSession = configuration.sessionTicket();

    d->configuration.sslSessionTicketLifeTimeHint = configuration.sessionTicketLifeTimeHint();

    d->configuration.nextAllowedProtocols = configuration.allowedNextProtocols();

    d->configuration.nextNegotiatedProtocol = configuration.nextNegotiatedProtocol();

    d->configuration.nextProtocolNegotiationStatus = configuration.nextProtocolNegotiationStatus();

    d->configuration.keyingMaterial = configuration.keyingMaterial();

#if QT_CONFIG(ocsp)

    d->configuration.ocspStaplingEnabled = configuration.ocspStaplingEnabled();

#endif

#if QT_CONFIG(openssl)

    d->configuration.reportFromCallback = configuration.handshakeMustInterruptOnError();

    d->configuration.missingCertIsFatal = configuration.missingCertificateIsFatal();

#endif // openssl

    // if the CA certificates were set explicitly (either via

    // QSslConfiguration::setCaCertificates() or QSslSocket::setCaCertificates(),

    // we cannot load the certificates on demand

    if (!configuration.d->allowRootCertOnDemandLoading) {

        d->allowRootCertOnDemandLoading = false;

        d->configuration.allowRootCertOnDemandLoading = false;

    }

}

/*!

    Sets the certificate chain to be presented to the peer during the

    SSL handshake to be \a localChain.

    \sa QSslConfiguration::setLocalCertificateChain()

    \since 5.1

 */

void QSslSocket::setLocalCertificateChain(const QList<QSslCertificate> &localChain)

{

    Q_D(QSslSocket);

    d->configuration.localCertificateChain = localChain;

}

/*!

    Returns the socket's local \l {QSslCertificate} {certificate} chain,

    or an empty list if no local certificates have been assigned.

    \sa setLocalCertificateChain()

    \since 5.1

*/

QList<QSslCertificate> QSslSocket::localCertificateChain() const

{

    Q_D(const QSslSocket);

    return d->configuration.localCertificateChain;

}

/*!

    Sets the socket's local certificate to \a certificate. The local

    certificate is necessary if you need to confirm your identity to the

    peer. It is used together with the private key; if you set the local

    certificate, you must also set the private key.

    The local certificate and private key are always necessary for server

    sockets, but are also rarely used by client sockets if the server requires

    the client to authenticate.

    \note Secure Transport SSL backend on macOS may update the default keychain

    (the default is probably your login keychain) by importing your local certificates

    and keys. This can also result in system dialogs showing up and asking for

    permission when your application is using these private keys. If such behavior

    is undesired, set the QT_SSL_USE_TEMPORARY_KEYCHAIN environment variable to a

    non-zero value; this will prompt QSslSocket to use its own temporary keychain.

    \sa localCertificate(), setPrivateKey()

*/

void QSslSocket::setLocalCertificate(const QSslCertificate &certificate)

{

    Q_D(QSslSocket);