--- /dev/null
+/****************************************************************************
+**
+** Copyright (C) 2013 Digia Plc and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/legal
+**
+** This file is part of the QtWebSockets module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and Digia. For licensing terms and
+** conditions see http://qt.digia.com/licensing. For further information
+** use the contact form at http://qt.digia.com/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Digia gives you certain additional
+** rights. These rights are described in the Digia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "qdefaultmaskgenerator_p.h"
+#include <QDateTime>
+#include <limits>
+
+QT_BEGIN_NAMESPACE
+
+QDefaultMaskGenerator::QDefaultMaskGenerator(QObject *parent) :
+ QMaskGenerator(parent)
+{
+}
+
+QDefaultMaskGenerator::~QDefaultMaskGenerator()
+{
+}
+
+bool QDefaultMaskGenerator::seed()
+{
+ qsrand(static_cast<uint>(QDateTime::currentMSecsSinceEpoch()));
+ return true;
+}
+
+quint32 QDefaultMaskGenerator::nextMask()
+{
+ return quint32((double(qrand()) / RAND_MAX) * std::numeric_limits<quint32>::max());
+}
+
+QT_END_NAMESPACE
--- /dev/null
+/****************************************************************************
+**
+** Copyright (C) 2013 Digia Plc and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/legal
+**
+** This file is part of the QtWebSockets module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and Digia. For licensing terms and
+** conditions see http://qt.digia.com/licensing. For further information
+** use the contact form at http://qt.digia.com/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Digia gives you certain additional
+** rights. These rights are described in the Digia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QDEFAULTMASKGENERATOR_P_H
+#define QDEFAULTMASKGENERATOR_P_H
+
+//
+// W A R N I N G
+// -------------
+//
+// This file is not part of the Qt API. It exists purely as an
+// implementation detail. This header file may change from version to
+// version without notice, or even be removed.
+//
+// We mean it.
+//
+
+#include <QtWebSockets/qmaskgenerator.h>
+
+QT_BEGIN_NAMESPACE
+class QObject;
+
+class Q_AUTOTEST_EXPORT QDefaultMaskGenerator : public QMaskGenerator
+{
+ Q_DISABLE_COPY(QDefaultMaskGenerator)
+
+public:
+ explicit QDefaultMaskGenerator(QObject *parent = 0);
+ virtual ~QDefaultMaskGenerator();
+
+ bool seed() Q_DECL_NOEXCEPT Q_DECL_OVERRIDE;
+ quint32 nextMask() Q_DECL_NOEXCEPT Q_DECL_OVERRIDE;
+};
+
+QT_END_NAMESPACE
+
+#endif // QDEFAULTMASKGENERATOR_P_H
--- /dev/null
+/****************************************************************************
+**
+** Copyright (C) 2013 Digia Plc and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/legal
+**
+** This file is part of the QtWebSockets module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and Digia. For licensing terms and
+** conditions see http://qt.digia.com/licensing. For further information
+** use the contact form at http://qt.digia.com/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Digia gives you certain additional
+** rights. These rights are described in the Digia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+ \class QMaskGenerator
+ The QMaskGenerator class provides an abstract base for custom 32-bit mask generators.
+
+ The WebSockets specification as outlined in {http://tools.ietf.org/html/rfc6455}{RFC 6455}
+ requires that all communication from client to server must be masked. This is to prevent
+ malicious scripts to attack bad behaving proxies.
+ For more information about the importance of good masking,
+ see \l {http://w2spconf.com/2011/papers/websocket.pdf}.
+ By default QWebSocket uses the cryptographically insecure qrand() function.
+ The best measure against attacks mentioned in the document above,
+ is to use QWebSocket over a secure connection (\e wss://).
+ In general, always be careful to not have 3rd party script access to
+ a QWebSocket in your application.
+*/
+
+/*!
+ \fn bool QMaskGenerator::seed()
+
+ Initializes the QMaskGenerator by seeding the randomizer.
+ When seed() is not called, it depends on the specific implementation of a subclass if
+ a default seed is used or no seed is used at all.
+*/
+
+/*!
+ \fn quint32 QMaskGenerator::nextMask()
+
+ Returns a new random 32-bit mask. The randomness depends on the RNG used to created the
+ mask.
+*/
+
+#include "qmaskgenerator.h"
+
+QT_BEGIN_NAMESPACE
+
+/*!
+ Creates a new QMaskGenerator object.
+ */
+QMaskGenerator::QMaskGenerator(QObject *parent) :
+ QObject(parent)
+{
+}
+
+/*!
+ Destroys the QMaskGenerator object.
+ */
+QMaskGenerator::~QMaskGenerator()
+{}
+
+QT_END_NAMESPACE
--- /dev/null
+/****************************************************************************
+**
+** Copyright (C) 2013 Digia Plc and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/legal
+**
+** This file is part of the QtWebSockets module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and Digia. For licensing terms and
+** conditions see http://qt.digia.com/licensing. For further information
+** use the contact form at http://qt.digia.com/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Digia gives you certain additional
+** rights. These rights are described in the Digia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QMASKGENERATOR_H
+#define QMASKGENERATOR_H
+
+#include <QObject>
+#include "QtWebSockets/qwebsockets_global.h"
+
+QT_BEGIN_NAMESPACE
+
+class Q_WEBSOCKETS_EXPORT QMaskGenerator : public QObject
+{
+ Q_DISABLE_COPY(QMaskGenerator)
+
+public:
+ explicit QMaskGenerator(QObject *parent = Q_NULLPTR);
+ virtual ~QMaskGenerator();
+
+ virtual bool seed() = 0;
+ virtual quint32 nextMask() = 0;
+};
+
+QT_END_NAMESPACE
+
+#endif // QMASKGENERATOR_H
\l {http://tools.ietf.org/html/rfc6455#page-39} {extensions} and
\l {http://tools.ietf.org/html/rfc6455#page-12} {subprotocols}.
- QWebSocket only supports version 13 of the WebSocket protocol, as outlined in RFC 6455.
+ QWebSocket only supports version 13 of the WebSocket protocol, as outlined in
+ \l {http://tools.ietf.org/html/rfc6455}{RFC 6455}.
+
+ \warning To generate masks, this implementation of WebSockets uses the cryptographically
+ insecure qrand() function.
+ For more information about the importance of good masking,
+ see \l {http://w2spconf.com/2011/papers/websocket.pdf}.
+ The best measure against attacks mentioned in the document above,
+ is to use QWebSocket over a secure connection (\e wss://).
+ In general, always be careful to not have 3rd party script access to
+ a QWebSocket in your application.
\sa QAbstractSocket, QTcpSocket
#endif
/*!
+ Sets the generator to use for creating masks to \a maskGenerator.
+ The default QWebSocket generator can be reset by supplying a \e Q_NULLPTR.
+ The mask generator can be changed at any time, even while the connection is open.
+ */
+void QWebSocket::setMaskGenerator(const QMaskGenerator *maskGenerator)
+{
+ Q_D(QWebSocket);
+ d->setMaskGenerator(maskGenerator);
+}
+
+/*!
+ Returns the mask generator that is currently used by this QWebSocket.
+ */
+const QMaskGenerator *QWebSocket::maskGenerator() const
+{
+ Q_D(const QWebSocket);
+ return d->maskGenerator();
+}
+
+/*!
Returns the size in bytes of the readbuffer that is used by the socket.
*/
qint64 QWebSocket::readBufferSize() const
class QTcpSocket;
class QWebSocketPrivate;
+class QMaskGenerator;
class Q_WEBSOCKETS_EXPORT QWebSocket : public QObject
{
QNetworkProxy proxy() const;
void setProxy(const QNetworkProxy &networkProxy);
#endif
+ void setMaskGenerator(const QMaskGenerator *maskGenerator);
+ const QMaskGenerator *maskGenerator() const;
qint64 readBufferSize() const;
void setReadBufferSize(qint64 size);
#include "qwebsocketprotocol_p.h"
#include "qwebsockethandshakerequest_p.h"
#include "qwebsockethandshakeresponse_p.h"
+#include "qdefaultmaskgenerator_p.h"
#include <QtCore/QUrl>
#include <QtNetwork/QAuthenticator>
m_closeReason(),
m_pingTimer(),
m_dataProcessor(),
- m_configuration()
+ m_configuration(),
+ m_pMaskGenerator(&m_defaultMaskGenerator),
+ m_defaultMaskGenerator()
{
}
m_closeReason(),
m_pingTimer(),
m_dataProcessor(),
- m_configuration()
+ m_configuration(),
+ m_pMaskGenerator(&m_defaultMaskGenerator),
+ m_defaultMaskGenerator()
{
}
void QWebSocketPrivate::init()
{
Q_ASSERT(q_ptr);
- //TODO: need a better randomizer
- qsrand(static_cast<uint>(QDateTime::currentMSecsSinceEpoch()));
+ Q_ASSERT(m_pMaskGenerator);
+
+ m_pMaskGenerator->seed();
if (m_pSocket) {
makeConnections(m_pSocket.data());
}
/*!
- * \internal
- */
-quint32 QWebSocketPrivate::generateRandomNumber() const
-{
- //TODO: need a better randomizer
- return quint32((double(qrand()) / RAND_MAX) * std::numeric_limits<quint32>::max());
-}
-
-/*!
\internal
*/
quint32 QWebSocketPrivate::generateMaskingKey() const
{
- return generateRandomNumber();
+ return m_pMaskGenerator->nextMask();
}
/*!
QByteArray key;
for (int i = 0; i < 4; ++i) {
- const quint32 tmp = generateRandomNumber();
+ const quint32 tmp = m_pMaskGenerator->nextMask();
key.append(static_cast<const char *>(static_cast<const void *>(&tmp)), sizeof(quint32));
}
/*!
\internal
*/
+void QWebSocketPrivate::setMaskGenerator(const QMaskGenerator *maskGenerator)
+{
+ if (!maskGenerator)
+ m_pMaskGenerator = &m_defaultMaskGenerator;
+ else if (maskGenerator != m_pMaskGenerator)
+ m_pMaskGenerator = const_cast<QMaskGenerator *>(maskGenerator);
+}
+
+/*!
+ \internal
+ */
+const QMaskGenerator *QWebSocketPrivate::maskGenerator() const
+{
+ Q_ASSERT(m_pMaskGenerator);
+ return m_pMaskGenerator;
+}
+
+/*!
+ \internal
+ */
qint64 QWebSocketPrivate::readBufferSize() const
{
return m_readBufferSize;
#include "qwebsocketprotocol.h"
#include "qwebsocketdataprocessor_p.h"
+#include "qdefaultmaskgenerator_p.h"
QT_BEGIN_NAMESPACE
class QWebSocketHandshakeResponse;
class QTcpSocket;
class QWebSocket;
+class QMaskGenerator;
struct QWebSocketConfiguration
{
QNetworkProxy proxy() const;
void setProxy(const QNetworkProxy &networkProxy);
#endif
+ void setMaskGenerator(const QMaskGenerator *maskGenerator);
+ const QMaskGenerator *maskGenerator() const;
qint64 readBufferSize() const;
void resume();
void setPauseMode(QAbstractSocket::PauseModes pauseMode);
quint32 generateMaskingKey() const;
QByteArray generateKey() const;
- quint32 generateRandomNumber() const;
qint64 writeFrames(const QList<QByteArray> &frames) Q_REQUIRED_RESULT;
qint64 writeFrame(const QByteArray &frame) Q_REQUIRED_RESULT;
QWebSocketDataProcessor m_dataProcessor;
QWebSocketConfiguration m_configuration;
+ QMaskGenerator *m_pMaskGenerator;
+ QDefaultMaskGenerator m_defaultMaskGenerator;
+
friend class QWebSocketServerPrivate;
};
load(qt_build_config)
TARGET = QtWebSockets
-QT = core network core-private
+QT = core network core-private sql
TEMPLATE = lib
$$PWD/qwebsocket.h \
$$PWD/qwebsocketserver.h \
$$PWD/qwebsocketprotocol.h \
- $$PWD/qwebsocketcorsauthenticator.h
+ $$PWD/qwebsocketcorsauthenticator.h \
+ $$PWD/qmaskgenerator.h
PRIVATE_HEADERS += \
$$PWD/qwebsocket_p.h \
$$PWD/qwebsockethandshakeresponse_p.h \
$$PWD/qwebsocketdataprocessor_p.h \
$$PWD/qwebsocketcorsauthenticator_p.h \
- $$PWD/qwebsocketframe_p.h
+ $$PWD/qwebsocketframe_p.h \
+ $$PWD/qdefaultmaskgenerator_p.h
SOURCES += \
$$PWD/qwebsocket.cpp \
$$PWD/qwebsockethandshakeresponse.cpp \
$$PWD/qwebsocketdataprocessor.cpp \
$$PWD/qwebsocketcorsauthenticator.cpp \
- $$PWD/qwebsocketframe.cpp
+ $$PWD/qwebsocketframe.cpp \
+ $$PWD/qmaskgenerator.cpp \
+ $$PWD/qdefaultmaskgenerator_p.cpp
contains(QT_CONFIG, openssl) | contains(QT_CONFIG, openssl-linked) {
SOURCES += $$PWD/qsslserver.cpp
websocketprotocol \
dataprocessor \
websocketframe \
- handshakerequest
+ handshakerequest \
+ qdefaultmaskgenerator
SUBDIRS += \
qwebsocket \
--- /dev/null
+CONFIG += console
+CONFIG += testcase c++11
+CONFIG -= app_bundle
+
+TEMPLATE = app
+
+TARGET = tst_defaultmaskgenerator
+
+QT = core testlib websockets websockets-private
+
+SOURCES += tst_defaultmaskgenerator.cpp
+
+requires(contains(QT_CONFIG, private_tests))
+DEFINES += QT_DISABLE_DEPRECATED_BEFORE=0
--- /dev/null
+/****************************************************************************
+**
+** Copyright (C) 2013 Digia Plc and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/legal
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and Digia. For licensing terms and
+** conditions see http://qt.digia.com/licensing. For further information
+** use the contact form at http://qt.digia.com/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Digia gives you certain additional
+** rights. These rights are described in the Digia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file. Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+#include <QtTest/QtTest>
+#include <QtTest/qtestcase.h>
+#include <QtTest/QSignalSpy>
+#include <QtCore/QBuffer>
+#include <QtCore/QByteArray>
+#include <QtCore/QDebug>
+
+#include "private/qdefaultmaskgenerator_p.h"
+
+QT_USE_NAMESPACE
+
+class tst_QDefaultMaskGenerator : public QObject
+{
+ Q_OBJECT
+
+public:
+ tst_QDefaultMaskGenerator();
+
+private Q_SLOTS:
+ void initTestCase();
+ void cleanupTestCase();
+ void init();
+ void cleanup();
+
+ void tst_randomnessWithoutSeed();
+ void tst_randomnessWithSeed();
+
+private:
+};
+
+
+
+tst_QDefaultMaskGenerator::tst_QDefaultMaskGenerator()
+{
+}
+
+void tst_QDefaultMaskGenerator::initTestCase()
+{
+}
+
+void tst_QDefaultMaskGenerator::cleanupTestCase()
+{
+}
+
+void tst_QDefaultMaskGenerator::init()
+{
+}
+
+void tst_QDefaultMaskGenerator::cleanup()
+{
+}
+
+void tst_QDefaultMaskGenerator::tst_randomnessWithoutSeed()
+{
+ //generate two series of data, and see if they differ
+ {
+ QDefaultMaskGenerator generator;
+
+ QVector<quint32> series1, series2;
+ for (int i = 0; i < 1000; ++i)
+ series1 << generator.nextMask();
+ for (int i = 0; i < 1000; ++i)
+ series2 << generator.nextMask();
+
+ QVERIFY(series1 != series2);
+ }
+}
+
+void tst_QDefaultMaskGenerator::tst_randomnessWithSeed()
+{
+ //generate two series of data, and see if they differ
+ //the generator is seeded
+ {
+ QDefaultMaskGenerator generator;
+ generator.seed();
+
+ QVector<quint32> series1, series2;
+ for (int i = 0; i < 1000; ++i)
+ series1 << generator.nextMask();
+ for (int i = 0; i < 1000; ++i)
+ series2 << generator.nextMask();
+
+ QVERIFY(series1 != series2);
+ }
+ //generates two series of data with 2 distinct generators
+ //both generators are seeded
+ {
+ QDefaultMaskGenerator generator1, generator2;
+ generator1.seed();
+ generator2.seed();
+
+ QVector<quint32> series1, series2;
+ for (int i = 0; i < 1000; ++i) {
+ series1 << generator1.nextMask();
+ series2 << generator2.nextMask();
+ }
+
+ QVERIFY(series1 != series2);
+ }
+ //generates two series of data with 2 distinct generators
+ //only one of the two is seeded
+ {
+ QDefaultMaskGenerator generator1, generator2;
+ generator1.seed();
+
+ QVector<quint32> series1, series2;
+ for (int i = 0; i < 1000; ++i) {
+ series1 << generator1.nextMask();
+ series2 << generator2.nextMask();
+ }
+
+ QVERIFY(series1 != series2);
+ }
+}
+
+QTEST_MAIN(tst_QDefaultMaskGenerator)
+
+#include "tst_defaultmaskgenerator.moc"
projects / contrib / qtwebsockets.git / commitdiff