Revision control
Copy as Markdown
// Copyright (C) 2017 Witekio.
// Copyright (C) 2018 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
// Qt-Security score:significant reason:default
#include "qcoapqudpconnection_p.h"
#include <private/qcoapnamespace_p.h>
#include <QtCore/qloggingcategory.h>
#include <QtNetwork/qnetworkdatagram.h>
#include <QtNetwork/private/qabstractsocket_p.h>
#if QT_CONFIG(dtls)
#include <QtNetwork/QDtls>
#include <QtNetwork/QSslPreSharedKeyAuthenticator>
#include <QtNetwork/QSslConfiguration>
#include <QtNetwork/QSslKey>
#endif
QT_BEGIN_NAMESPACE
/*!
\internal
\class QCoapQUdpConnection
\inmodule QtCoap
\brief The QCoapQUdpConnection class handles the transfer of frames to
and from a server.
\reentrant
The QCoapQUdpConnection class is used by the QCoapClient class to send
requests to a server. It has a socket listening for UDP messages,
that is used to send the CoAP frames.
When a reply is available, the QCoapQUdpConnection object emits a readyRead()
signal.
\sa QCoapClient
*/
/*!
Constructs a new QCoapQUdpConnection for the given \a securityMode and
sets \a parent as the parent object.
\note Since QtCoap::RawPublicKey is not supported yet, the connection
will fall back to the QtCoap::NoSecurity in the QtCoap::RawPublicKey mode.
That is, the connection won't be secure in this mode.
*/
QCoapQUdpConnection::QCoapQUdpConnection(QtCoap::SecurityMode securityMode, QObject *parent) :
QCoapQUdpConnection(*new QCoapQUdpConnectionPrivate(securityMode), parent)
{
}
/*!
\internal
Constructs a new QCoapQUdpConnection as a child of \a parent, with \a dd as
its \c d_ptr. This constructor must be used when internally subclassing
the QCoapQUdpConnection class.
*/
QCoapQUdpConnection::QCoapQUdpConnection(QCoapQUdpConnectionPrivate &dd, QObject *parent) :
QCoapConnection(dd, parent)
{
Q_D(QCoapQUdpConnection);
createSocket();
if (isSecure()) {
#if QT_CONFIG(dtls)
connect(this, &QCoapConnection::securityConfigurationChanged, this,
[this]() {
Q_D(QCoapQUdpConnection);
d->setSecurityConfiguration(securityConfiguration());
});
auto configuration = QSslConfiguration::defaultDtlsConfiguration();
switch (d->securityMode) {
case QtCoap::SecurityMode::RawPublicKey:
qCWarning(lcCoapConnection, "RawPublicKey security is not supported yet,"
"disabling security");
d->securityMode = QtCoap::SecurityMode::NoSecurity;
break;
case QtCoap::SecurityMode::PreSharedKey:
d->dtls = new QDtls(QSslSocket::SslClientMode, this);
configuration.setPeerVerifyMode(QSslSocket::VerifyNone);
d->dtls->setDtlsConfiguration(configuration);
connect(d->dtls.data(), &QDtls::pskRequired, this, &QCoapQUdpConnection::pskRequired);
connect(d->dtls.data(), &QDtls::handshakeTimeout,
this, &QCoapQUdpConnection::handshakeTimeout);
break;
case QtCoap::SecurityMode::Certificate:
d->dtls = new QDtls(QSslSocket::SslClientMode, this);
configuration.setPeerVerifyMode(QSslSocket::VerifyPeer);
d->dtls->setDtlsConfiguration(configuration);
connect(d->dtls.data(), &QDtls::handshakeTimeout,
this, &QCoapQUdpConnection::handshakeTimeout);
break;
default:
break;
}
#else
qCWarning(lcCoapConnection, "DTLS is disabled, falling back to QtCoap::NoSecurity mode.");
d->securityMode = QtCoap::SecurityMode::NoSecurity;
#endif
}
}
/*!
\internal
Creates the socket used by the connection and sets it in connection's private
class.
*/
void QCoapQUdpConnection::createSocket()
{
Q_D(QCoapQUdpConnection);
d->udpSocket = new QUdpSocket(this);
connect(d->udpSocket.data(), &QUdpSocket::readyRead, this, [this]() {
Q_D(QCoapQUdpConnection);
d->socketReadyRead();
});
connect(d->udpSocket.data(), &QUdpSocket::errorOccurred, this,
[this](QAbstractSocket::SocketError socketError) {
qCWarning(lcCoapConnection) << "CoAP UDP socket error" << socketError
<< socket()->errorString();
emit error(socketError);
});
}
QCoapQUdpConnectionPrivate::QCoapQUdpConnectionPrivate(QtCoap::SecurityMode security)
: QCoapConnectionPrivate(security)
#if QT_CONFIG(dtls)
, dtls(nullptr)
#endif
, udpSocket(nullptr)
{
}
QCoapQUdpConnectionPrivate::~QCoapQUdpConnectionPrivate()
{
#if QT_CONFIG(dtls)
if (dtls && dtls->isConnectionEncrypted()) {
Q_ASSERT(udpSocket);
dtls->shutdown(udpSocket);
}
#endif
}
/*!
\internal
Binds the socket to a random port and returns \c true if it succeeds.
*/
bool QCoapQUdpConnectionPrivate::bind()
{
#if QT_CONFIG(networkinterface)
// Using the QAbstractSocketPrivate private API to bind to a specific
// network interface.
auto priv = static_cast<QAbstractSocketPrivate *>(QObjectPrivate::get(socket()));
QNetworkInterface *iface = udpNetworkInterface.isValid() ? &udpNetworkInterface : nullptr;
return priv->bind(QHostAddress::Any, 0, QAbstractSocket::ShareAddress, iface);
#else
return socket()->bind(QHostAddress::Any, 0, QAbstractSocket::ShareAddress);
#endif
}
/*!
\internal
Binds the socket if it is not already done and emits the bound() signal when
the socket is ready.
*/
void QCoapQUdpConnectionPrivate::bindSocket()
{
Q_Q(QCoapQUdpConnection);
if (state != QCoapQUdpConnection::ConnectionState::Bound && bind())
emit q->bound();
}
/*!
\internal
Prepares the socket for data transmission to the given \a host and
\a port by binding the socket. In case of a secure connection also
starts the handshake with the server.
Emits the bound() signal when the transport is ready.
*/
void QCoapQUdpConnection::bind(const QString &host, quint16 port)
{
Q_D(QCoapQUdpConnection);
if (!isSecure()) {
d->bindSocket();
#if QT_CONFIG(dtls)
} else {
Q_ASSERT(d->dtls);
if (d->dtls->isConnectionEncrypted()) {
emit bound();
} else if (socket()->state() == QAbstractSocket::UnconnectedState) {
d->bind();
d->dtls->setPeer(QHostAddress(host), port);
if (!d->dtls->doHandshake(d->socket()))
qCWarning(lcCoapConnection) << "Handshake error: " << d->dtls->dtlsErrorString();
}
#else
Q_UNUSED(host);
Q_UNUSED(port);
#endif
}
}
/*!
\internal
Sends the given \a data frame to the \a host at the \a port.
*/
void QCoapQUdpConnection::writeData(const QByteArray &data, const QString &host, quint16 port)
{
Q_D(QCoapQUdpConnection);
d->writeToSocket(data, host, port);
}
/*!
\internal
\brief Close the UDP socket
In the case of a secure connection, this also interrupts any ongoing
hand-shake and shuts down the DTLS connection.
*/
void QCoapQUdpConnection::close()
{
Q_D(QCoapQUdpConnection);
#if QT_CONFIG(dtls)
if (isSecure()) {
if (d->dtls->handshakeState() == QDtls::HandshakeInProgress)
d->dtls->abortHandshake(d->socket());
if (d->dtls->isConnectionEncrypted())
d->dtls->shutdown(d->socket());
}
#endif
d->socket()->close();
}
/*!
\internal
Sets the QUdpSocket socket \a option to \a value.
*/
void QCoapQUdpConnection::setSocketOption(QAbstractSocket::SocketOption option, const QVariant &value)
{
Q_D(QCoapQUdpConnection);
d->socket()->setSocketOption(option, value);
}
/*!
\internal
Sends the given \a data frame to the \a host at the \a port.
*/
void QCoapQUdpConnectionPrivate::writeToSocket(const QByteArray &data, const QString &host, quint16 port)
{
#if QT_CONFIG(dtls)
Q_Q(QCoapQUdpConnection);
#endif
if (!socket()->isWritable()) {
bool opened = socket()->open(socket()->openMode() | QIODevice::WriteOnly);
if (!opened) {
qCWarning(lcCoapConnection, "Failed to open the UDP socket with write permission");
return;
}
}
QHostAddress hostAddress(host);
if (hostAddress.isNull()) {
qCWarning(lcCoapConnection) << "Invalid host IP address" << host
<< "- only IPv4/IPv6 destination addresses are supported.";
return;
}
const qint64 bytesWritten =
#if QT_CONFIG(dtls)
q->isSecure() ? (Q_ASSERT(dtls), dtls->writeDatagramEncrypted(socket(), data)) :
#endif
socket()->writeDatagram(data, hostAddress, port);
if (bytesWritten < 0)
qCWarning(lcCoapConnection) << "Failed to write datagram:" << socket()->errorString();
}
/*!
\internal
This slot reads all data stored in the socket and emits a readyRead()
signal for each received datagram.
*/
void QCoapQUdpConnectionPrivate::socketReadyRead()
{
Q_Q(QCoapQUdpConnection);
if (!socket()->isReadable()) {
bool opened = socket()->open(socket()->openMode() | QIODevice::ReadOnly);
if (!opened) {
qCWarning(lcCoapConnection, "Failed to open the UDP socket with read permission");
return;
}
}
while (socket()->hasPendingDatagrams()) {
if (!q->isSecure()) {
const auto &datagram = socket()->receiveDatagram();
if (datagramMatchesNetworkInterface(datagram))
emit q->readyRead(datagram.data(), datagram.senderAddress());
#if QT_CONFIG(dtls)
} else {
handleEncryptedDatagram();
#endif
}
}
}
/*!
\internal
Returns the socket.
*/
QUdpSocket *QCoapQUdpConnection::socket() const
{
Q_D(const QCoapQUdpConnection);
return d->udpSocket;
}
/*!
\internal
Sets the DTLS configuration.
*/
void QCoapQUdpConnectionPrivate::setSecurityConfiguration(
const QCoapSecurityConfiguration &configuration)
{
#if QT_CONFIG(dtls)
Q_ASSERT(dtls);
auto dtlsConfig = dtls->dtlsConfiguration();
if (!configuration.defaultCipherString().isEmpty()) {
dtlsConfig.setBackendConfigurationOption("CipherString",
configuration.defaultCipherString());
}
if (!configuration.caCertificates().isEmpty())
dtlsConfig.setCaCertificates(configuration.caCertificates().toList());
if (!configuration.localCertificateChain().isEmpty())
dtlsConfig.setLocalCertificateChain(configuration.localCertificateChain().toList());
if (!configuration.privateKey().isNull()) {
if (configuration.privateKey().algorithm() != QSsl::Opaque) {
QSslKey privateKey(configuration.privateKey().key(),
configuration.privateKey().algorithm(),
configuration.privateKey().encodingFormat(),
QSsl::PrivateKey,
configuration.privateKey().passPhrase());
dtlsConfig.setPrivateKey(privateKey);
} else if (configuration.privateKey().handle()) {
QSslKey opaqueKey(configuration.privateKey().handle());
dtlsConfig.setPrivateKey(opaqueKey);
} else {
qCWarning(lcCoapConnection, "Failed to set private key, the provided key is invalid");
}
}
dtls->setDtlsConfiguration(dtlsConfig);
#else
Q_UNUSED(configuration);
#endif
}
/*!
\internal
Checks if the datagram was received on a specified network interface
*/
bool QCoapQUdpConnectionPrivate::datagramMatchesNetworkInterface(
const QNetworkDatagram &datagram) const
{
#if QT_CONFIG(networkinterface)
return !udpNetworkInterface.isValid()
|| uint(udpNetworkInterface.index()) == datagram.interfaceIndex();
#else
Q_UNUSED(datagram);
return true;
#endif
}
#if QT_CONFIG(dtls)
/*!
\internal
This slot is invoked when PSK authentication is required. It is used
for setting the identity and pre shared key in order for the TLS handshake
to complete.
*/
void QCoapQUdpConnection::pskRequired(QSslPreSharedKeyAuthenticator *authenticator)
{
Q_ASSERT(authenticator);
authenticator->setIdentity(securityConfiguration().preSharedKeyIdentity());
authenticator->setPreSharedKey(securityConfiguration().preSharedKey());
}
/*!
\internal
This slot handles handshake timeouts.
*/
void QCoapQUdpConnection::handshakeTimeout()
{
Q_D(QCoapQUdpConnection);
qCWarning(lcCoapConnection, "Handshake timeout, trying to re-transmit");
if (d->dtls->handshakeState() == QDtls::HandshakeInProgress &&
!d->dtls->handleTimeout(d->udpSocket)) {
qCWarning(lcCoapConnection) << "Failed to re-transmit" << d->dtls->dtlsErrorString();
}
}
/*!
\internal
Returns a decrypted datagram received from a UDP socket or a std::nullopt
if the datagram was received on an incorrect network interface.
*/
std::optional<QNetworkDatagram> QCoapQUdpConnectionPrivate::receiveDatagramDecrypted() const
{
auto datagram = socket()->receiveDatagram();
if (!datagramMatchesNetworkInterface(datagram))
return std::nullopt;
const QByteArray plainText = dtls->decryptDatagram(socket(), datagram.data());
datagram.setData(plainText);
return datagram;
}
/*!
\internal
If the connection is encrypted, emits the readyRead() signal for
the pending datagram. Otherwise starts the DTLS handshake and
if it is completed, starts to send the pending request.
*/
void QCoapQUdpConnectionPrivate::handleEncryptedDatagram()
{
Q_Q(QCoapQUdpConnection);
Q_ASSERT(dtls);
if (dtls->isConnectionEncrypted()) {
const auto datagram = receiveDatagramDecrypted();
if (datagram)
emit q->readyRead(datagram->data(), datagram->senderAddress());
} else {
const auto datagram = socket()->receiveDatagram();
if (!datagramMatchesNetworkInterface(datagram))
return;
if (!dtls->doHandshake(socket(), datagram.data())) {
qCWarning(lcCoapConnection) << "Handshake error: " << dtls->dtlsErrorString();
return;
}
// The handshake is successfully done, emit the bound() signal to inform
// listeners that the socket is ready to start transferring data.
if (dtls->isConnectionEncrypted())
emit q->bound();
}
}
#endif // dtls
QT_END_NAMESPACE