#include <QtCrypto>
Inheritance diagram for QCA::TLS:
Transport Layer Security (TLS) is the current state-of-the-art in secure transport mechanisms over the internet. It can be used in a way where only one side of the link needs to authenticate to the other. This makes it very useful for servers to provide their identity to clients. Note that is is possible to use TLS to authenticate both client and server.
TLS is a IETF standard (RFC2712 for TLS version 1.0) based on earlier Netscape work on Secure Socket Layer (SSL version 2 and SSL version 3). New applications should use at least TLS 1.0, and SSL version 2 should be avoided due to known security problems.
|
Operating mode.
|
|
Version of TLS or SSL.
|
|
Type of error.
|
|
Type of identity.
|
|
Constructor for Transport Layer Security connection. This produces a Stream (normal TLS) rather than Datagram (DTLS) object. If you want to do DTLS, see below.
|
|
Constructor for Transport Layer Security connection.
|
|
Destructor.
|
|
Reset the connection.
|
|
Get the list of cipher suites that are available for use. A cipher suite is a combination of key exchange, encryption and hashing algorithms that are agreed during the initial handshake between client and server.
|
|
The local certificate to use. This is the certificate that will be provided to the peer. This is almost always required on the server side (because the server has to provide a certificate to the client), and may be used on the client side.
|
|
This is an overloaded member function, provided for convenience. It differs from the above function only in what argument(s) it accepts. Allows setting a certificate from a KeyBundle.
|
|
Return the trusted certificates set for this object.
|
|
Set up the set of trusted certificates that will be used to verify that the certificate provided is valid. Typically, this will be the collection of root certificates from the system, which you can get using QCA::systemStore(), however you may choose to pass whatever certificates match your assurance needs.
|
|
The security level required for this link.
|
|
This is an overloaded member function, provided for convenience. It differs from the above function only in what argument(s) it accepts.
|
|
This is an overloaded member function, provided for convenience. It differs from the above function only in what argument(s) it accepts.
|
|
Retrieve the list of allowed issuers by the server, if the server has provided them. Only DN types will be present.
Certificate someCert = ... PrivateKey someKey = ... // see if the server will take our cert CertificateInfoOrdered issuerInfo = someCert.issuerInfoOrdered().dnOnly(); foreach(const CertificateInfoOrdered &info, tls->issuerList()) { if(info == issuerInfo) { // server will accept someCert, let's present it tls->setCertificate(someCert, someKey); break; } }
|
|
Sets the issuer list to present to the client. For use with servers only. Only DN types are allowed. |
|
Resume a TLS session using the given session object.
|
|
Test if the link can use compression.
|
|
Test if the link can specify a hostname (Server Name Indication).
|
|
Returns true if compression is enabled. This only indicates whether or not the object is configured to use compression, not whether or not the link is actually compressed. Use isCompressed() for that. |
|
Set the link to use compression.
|
|
Returns the host name specified or an empty string if no host name is specified.
|
|
Start the TLS/SSL connection as a client. Typically, you'll want to perform RFC 2818 validation on the server's certificate, based on the hostname you're intending to connect to. Pass a value for host in order to have the validation for you. If you want to bypass this behavior and do the validation yourself, pass an empty string for host. If the host is an internationalized domain name, then it must be provided in unicode format, not in IDNA ACE/punycode format.
|
|
Start the TLS/SSL connection as a server.
|
|
Resumes TLS processing. Call this function after hostNameReceived(), certificateRequested() peerCertificateAvailable() or handshaken() is emitted. By requiring this function to be called in order to proceed, applications are given a chance to perform user interaction between steps in the TLS process.
|
|
test if the handshake is complete
|
|
test if the link is compressed
|
|
The protocol version that is in use for this connection.
|
|
The cipher suite that has been negotiated for this connection. The name returned here is the name used in the applicable RFC (or Internet Draft, where there is no RFC).
|
|
The number of effective bits of security being used for this connection. This can differ from the actual number of bits in the cipher for certain older "export ciphers" that are deliberately crippled. If you want that information, use cipherMaxBits().
|
|
The number of bits of security that the cipher could use. This is normally the same as cipherBits(), but can be greater for older "export ciphers".
|
|
The session object of the TLS connection, which can be used for resuming.
|
|
This method returns the type of error that has occurred. You should only need to check this if the error() signal is emitted.
|
|
After the SSL/TLS handshake is complete, this method allows you to determine if the other end of the connection (if the application is a client, this is the server; if the application is a server, this is the client) has a valid identity. Note that the security of TLS/SSL depends on checking this. It is not enough to check that the certificate is valid - you must check that the certificate is valid for the entity that you are trying to communicate with.
|
|
After the SSL/TLS handshake is valid, this method allows you to check if the received certificate from the other end is valid. As noted in peerIdentityResult(), you also need to check that the certificate matches the entity you are trying to communicate with.
|
|
The CertificateChain for the local host certificate.
|
|
The PrivateKey for the local host certificate.
|
|
The CertificateChain from the peer (other end of the connection to the trusted root certificate).
|
|
Returns true if the layer has a meaningful "close".
Reimplemented from QCA::SecureLayer. |
|
Returns the number of bytes available to be read() on the application side.
Implements QCA::SecureLayer. |
|
Returns the number of bytes available to be readOutgoing() on the network side.
Implements QCA::SecureLayer. |
|
Close the link. Note that this may not be meaningful / possible for all implementations.
Reimplemented from QCA::SecureLayer. |
|
This method writes unencrypted (plain) data to the SecureLayer implementation. You normally call this function on the application side. Implements QCA::SecureLayer.
|
|
This method reads decrypted (plain) data from the SecureLayer implementation. You normally call this function on the application side after receiving the readyRead() signal. Implements QCA::SecureLayer.
|
|
This method accepts encoded (typically encrypted) data for processing. You normally call this function using data read from the network socket (e.g. using QTcpSocket::readAll()) after receiving a signal that indicates that the socket has data to read. Implements QCA::SecureLayer.
|
|
This method provides encoded (typically encrypted) data. You normally call this function to get data to write out to the network socket (e.g. using QTcpSocket::write()) after receiving the readyReadOutgoing() signal. Implements QCA::SecureLayer.
|
|
This allows you to read data without having it decrypted first. This is intended to be used for protocols that close off the connection and return to plain text transfer. You do not normally need to use this function. Reimplemented from QCA::SecureLayer. |
|
Convert encrypted bytes written to plain text bytes written.
Implements QCA::SecureLayer. |
|
Determine the number of packets available to be read on the application side.
|
|
Determine the number of packets available to be read on the network side.
|
|
Return the currently configured maximum packet size.
|
|
Set the maximum packet size to use.
|
|
Emitted when the server requests a certificate. At this time, the client can inspect the issuerList(). You must call continueAfterStep() in order for TLS processing to resume after this signal is emitted. This signal is only emitted in client mode.
|
|
Emitted when a certificate is received from the peer. At this time, you may inspect peerIdentityResult(), peerCertificateValidity(), and peerCertificateChain(). You must call continueAfterStep() in order for TLS processing to resume after this signal is emitted.
|
|
Emitted when the protocol handshake is complete. At this time, all available information about the TLS session can be inspected. You must call continueAfterStep() in order for TLS processing to resume after this signal is emitted.
|