Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Get Qt Extensions
  • Unsolved
Collapse
Brand Logo
  1. Home
  2. Qt Development
  3. General and Desktop
  4. QSslSocket Behaviour Linux vs macOS (possibly LibreSSL incompatibilities?)
Forum Updated to NodeBB v4.3 + New Features

QSslSocket Behaviour Linux vs macOS (possibly LibreSSL incompatibilities?)

Scheduled Pinned Locked Moved Solved General and Desktop
47 Posts 2 Posters 12.1k Views 2 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • SGaistS SGaist

    No worries, that's not what I was asking you to do at all !

    Just some dummy test server using the custom certificate so that the communication can be tested/established with the test client.

    M Offline
    M Offline
    Markus M.
    wrote on last edited by Markus M.
    #30

    @SGaist Here we go: https://github.com/markusmeyerhofer/SimpleServer

    Just a heads-up: this is a quickly distilled ssl server; it should work but its certainly not tested exhaustively.

    The client: https://github.com/markusmeyerhofer/QtSSLClient

    I created a small project creating certs and keys (again, using the sample provided in the mentioned thread above) and writing those to disk.
    I imported a key generated this way (recall: this key is accepted as valid by QSslKey) into a resource file and load that file in my SSL client - where the exact same key is rejected ("isNull").

    Visual inspection (qDebugging out the loaded file) suggests an actually valid key file. As it stands it looks like something happens during loading the key file. Not sure what I'm doing wrong...
    (Hint: the respective code segment is in "citcpconnection.cpp" lines 27ff, see Github Repo QtSSLClient as given above)

    1 Reply Last reply
    0
    • SGaistS Offline
      SGaistS Offline
      SGaist
      Lifetime Qt Champion
      wrote on last edited by
      #31

      After some testing, the certificate itself is good. What poses problem currently is the key. Poking at the sources and searching a bit, the key you are generating is a PKCS8 type of key which doesn't seem to be handled currently. PKCS1 keys on the other should be good.

      I didn't had time to go through OpenSSL to find how to generate such a key from the API however on the command line it seems to be as simple as: openssl rsa -in server.key -out server_new.key.

      Hope it helps.

      Interested in AI ? www.idiap.ch
      Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

      M 1 Reply Last reply
      0
      • SGaistS SGaist

        After some testing, the certificate itself is good. What poses problem currently is the key. Poking at the sources and searching a bit, the key you are generating is a PKCS8 type of key which doesn't seem to be handled currently. PKCS1 keys on the other should be good.

        I didn't had time to go through OpenSSL to find how to generate such a key from the API however on the command line it seems to be as simple as: openssl rsa -in server.key -out server_new.key.

        Hope it helps.

        M Offline
        M Offline
        Markus M.
        wrote on last edited by Markus M.
        #32

        @SGaist Thx for the heads - up. What still puzzles me is: how is it that the key generated in code (its in the client code posted) is accepted when fed into QSslKey directly; when storing the key as is and subsequently loading from file it isn't.

        Anyway, its kinda tedious - there are so many formats and how tos out there I kinda lost oversight. What I need is basically:

        1 - A certificate (self-signed) acting as CA certificate.
        2 - A server and a client key + certs, signed by the CA cert as created in 1. I did that, but, as you know, the key isn't accepted.

        There are other issues I don't quite understand: e.g. the key, even though set in the client, does not seem to appear on the server; meaning it isn't used. Similarly, setting the peer host name on the client, getting peerHostName on the server happens to be empty. Not sure why...

        The connection still is encrypted, but host identification is defunct as of now, opening a hole

        1 Reply Last reply
        0
        • SGaistS Offline
          SGaistS Offline
          SGaist
          Lifetime Qt Champion
          wrote on last edited by
          #33

          Looking for something else, I stumble on this bug of Curl which I wonder if it relates to the problem at end.

          Interested in AI ? www.idiap.ch
          Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

          M 1 Reply Last reply
          0
          • SGaistS SGaist

            Looking for something else, I stumble on this bug of Curl which I wonder if it relates to the problem at end.

            M Offline
            M Offline
            Markus M.
            wrote on last edited by Markus M.
            #34

            @SGaist said in QSslSocket Behaviour Linux vs macOS (possibly LibreSSL incompatibilities?):

            bug of Curl

            I doubt it: the bug seems to address Yosemite; my issues are for one: on High Sierra and for two: consistent over various platforms (OpenSuSE, Ubuntu; Mac).

            Besides - why curl? I am not knowingly using curl for that project. Is it somehow used by Qt under the hood?

            M 1 Reply Last reply
            0
            • M Markus M.

              @SGaist said in QSslSocket Behaviour Linux vs macOS (possibly LibreSSL incompatibilities?):

              bug of Curl

              I doubt it: the bug seems to address Yosemite; my issues are for one: on High Sierra and for two: consistent over various platforms (OpenSuSE, Ubuntu; Mac).

              Besides - why curl? I am not knowingly using curl for that project. Is it somehow used by Qt under the hood?

              M Offline
              M Offline
              Markus M.
              wrote on last edited by
              #35

              Hello.. as a follow up: I am not aware of the changes that took place under the hood in Qt 5.12.

              However, the issues as described apparently are fixed now; i.e. I am now using Qt 5.12.0 as provided/updated using the Qt Maintenance Tool.

              In more detail: I had to use the custom compiled Qt 5.10.0 in order to be able to connect to my QSsl - based development server under macOS.
              With the latest update to Qt 5.12.0 everything works as intended out of the box, no custom Qt/SSL compilation required any more.

              Thx for fixing this!

              1 Reply Last reply
              0
              • SGaistS Offline
                SGaistS Offline
                SGaist
                Lifetime Qt Champion
                wrote on last edited by
                #36

                Glad it's working now and thanks for the feedback !

                Additonal note, I never wrote that this was a curl problem or bug that was affecting your application. Only that the bug report I found could give some additonal clues to look into to fix your problem.

                Interested in AI ? www.idiap.ch
                Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                M 1 Reply Last reply
                0
                • SGaistS SGaist

                  Glad it's working now and thanks for the feedback !

                  Additonal note, I never wrote that this was a curl problem or bug that was affecting your application. Only that the bug report I found could give some additonal clues to look into to fix your problem.

                  M Offline
                  M Offline
                  Markus M.
                  wrote on last edited by Markus M.
                  #37

                  @SGaist Actually the post above may have been a bit premature. Not sure what is going on: I updated 2 machines to Qt 5.12.0.

                  On my workstation, it is working as intended and described in the previous post.

                  Since I assumed the issues have been fixed I also updated my Macbook only to find out the failed handshake still occurs.

                  Currently I am in the process of investigating what is going on - mentioned computers installations are very similar. All I know for now is that the handshake failures occur only on one computer with standard Qt installation.
                  I suspect the cause is somehow tied to libssl.a/libcrypto.a, perhaps different ssl version or something like that.

                  I'll keep you advised if I find out what's going on

                  1 Reply Last reply
                  0
                  • SGaistS Offline
                    SGaistS Offline
                    SGaist
                    Lifetime Qt Champion
                    wrote on last edited by
                    #38

                    The one problem I can see is that OpenSSL is not used on macOS since a few Qt versions. Qt use the SecureTransport framework from macOS. You can still use OpenSSL though but you have to build Qt yourself for that as well as get a recent version of OpenSSL.

                    Interested in AI ? www.idiap.ch
                    Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                    M 1 Reply Last reply
                    0
                    • SGaistS SGaist

                      The one problem I can see is that OpenSSL is not used on macOS since a few Qt versions. Qt use the SecureTransport framework from macOS. You can still use OpenSSL though but you have to build Qt yourself for that as well as get a recent version of OpenSSL.

                      M Offline
                      M Offline
                      Markus M.
                      wrote on last edited by Markus M.
                      #39

                      @SGaist I know - I did compile Qt with OpenSSL 1.0.2o a couple of months ago (Qt 5.10.0).
                      Unfortunately later versions Qt failed to compile using this config - never figured out why; for the lack of time I just went ahead using mentioned custom compiled version.

                      Yesterday I randomly checked if my server compiles/works using 5.12.0 - and to my surprise it did (on my workstation).
                      It still doesn't on the Macbook what puzzles me...

                      otool -L indicates everything is similar. The binary compiled on the workstation also does not work on the notebook - so clearly some dynamically linked library causing this. If only I knew which one

                      1 Reply Last reply
                      0
                      • SGaistS Offline
                        SGaistS Offline
                        SGaist
                        Lifetime Qt Champion
                        wrote on last edited by
                        #40

                        Any difference of macOS versions ?

                        Any hint from the logs on the system ?

                        Just in case, IIRC, since 5.10 Qt supports also OpenSSL 1.1

                        Interested in AI ? www.idiap.ch
                        Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                        M 1 Reply Last reply
                        0
                        • SGaistS SGaist

                          Any difference of macOS versions ?

                          Any hint from the logs on the system ?

                          Just in case, IIRC, since 5.10 Qt supports also OpenSSL 1.1

                          M Offline
                          M Offline
                          Markus M.
                          wrote on last edited by
                          #41

                          @SGaist Nope. Same OS version, same Qt version... hence my surprise. I tried OpenSSL 1.1, but it seems incompatible with earlier versions as well as with the SSL classes in JDK, which my clients use. So no option for now

                          1 Reply Last reply
                          0
                          • SGaistS Offline
                            SGaistS Offline
                            SGaist
                            Lifetime Qt Champion
                            wrote on last edited by
                            #42

                            OpenSSL 1.1 requires a different backend. The 1.1 release broke API and ABI compatibility with the 1.0 release, hence you have to do a specific build of Qt or any library/application using OpenSSL.

                            Interested in AI ? www.idiap.ch
                            Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                            M 1 Reply Last reply
                            0
                            • SGaistS SGaist

                              OpenSSL 1.1 requires a different backend. The 1.1 release broke API and ABI compatibility with the 1.0 release, hence you have to do a specific build of Qt or any library/application using OpenSSL.

                              M Offline
                              M Offline
                              Markus M.
                              wrote on last edited by
                              #43

                              @SGaist I did a fresh macOS install using a VM and can confirm the issue is resolved in stock macOS High Sierra using XCode 9.4.1, Command Line Tools 10.1 for High Sierra and standard Qt 5.12.0 installation.

                              Guess I have to find some path/ssl lib or similar getting in the way on my Macbook, but this should not be any of your concern.

                              Again, thanks for support.

                              Issue solved.

                              1 Reply Last reply
                              0
                              • SGaistS Offline
                                SGaistS Offline
                                SGaist
                                Lifetime Qt Champion
                                wrote on last edited by
                                #44

                                You're welcome !

                                Then please mark the thread as solved using the "Topic Tools" button so other forum users may know a solution has been found :)

                                Interested in AI ? www.idiap.ch
                                Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                                M 1 Reply Last reply
                                0
                                • SGaistS SGaist

                                  You're welcome !

                                  Then please mark the thread as solved using the "Topic Tools" button so other forum users may know a solution has been found :)

                                  M Offline
                                  M Offline
                                  Markus M.
                                  wrote on last edited by Markus M.
                                  #45

                                  @SGaist Done!

                                  Fyi: did not find what was wrong; after a clean install everything is working as intended.

                                  Thx

                                  1 Reply Last reply
                                  0
                                  • SGaistS Offline
                                    SGaistS Offline
                                    SGaist
                                    Lifetime Qt Champion
                                    wrote on last edited by
                                    #46

                                    Software mysteries... You may have gremlins playing with your machine ;-)

                                    Interested in AI ? www.idiap.ch
                                    Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

                                    M 1 Reply Last reply
                                    0
                                    • SGaistS SGaist

                                      Software mysteries... You may have gremlins playing with your machine ;-)

                                      M Offline
                                      M Offline
                                      Markus M.
                                      wrote on last edited by
                                      #47

                                      @SGaist Yeh, pretty likely :-)

                                      Checked every single dylib, libcrypto.* libssl.*, but no luck. Reinstalling took me half the time in comparison to investigating the issue...

                                      1 Reply Last reply
                                      0

                                      • Login

                                      • Login or register to search.
                                      • First post
                                        Last post
                                      0
                                      • Categories
                                      • Recent
                                      • Tags
                                      • Popular
                                      • Users
                                      • Groups
                                      • Search
                                      • Get Qt Extensions
                                      • Unsolved