Qt-contributors-summit-2013-19025

From Qt Wiki
Jump to: navigation, search
Revision from: 14:54, 15 Jul 2013

Qt Network Session – Qt Contributors Summit 2013

Talking Points

  • Option to add random padding to https requests. This makes us more resistant to the various https attacks that have been floating around. * X-Qt-Padding: some noise of varying length *Recommendation 3 from http://www.isg.rhul.ac.uk/tls/RC4biases.pdf
  • Who is working on the stack?
  • What's up with the constant failing tests in the CI, and how can we fix the situation?
  • Support for diffie-hellman ciphers
  • Support for redirects
  • Pause on connect
  • Performance
  • Peter's chromium qnam port
  • Automatic fallback support
  • Certificate store API / Caching intermediates
  • OCSP support
  • Replacing the QNAM disk cache
  • HTTP 2.0 / SPDY support
  • Web sockets
  • Enginio and Qt network
  • Webkit2 and custom QNetworkAccessManagers

Off topic, but related:

  • PBKDF2 / BCrypt support (QtCore really)
  • Should we warn if running as root? If running suid?

Notes by Thiago:

  • Difficult to test because of the test server * Tests should use localhost (in-test server) whenever possible * We can't reproduce the CI server (Peter doesn't get to 0 images) * Short-term: get the VM image from the test server → talk to Tony * Long-term: get puppet working → talk to Tony * Suggestions to improve: * Split out the localhost-only tests to verify that local servers working * Test with localhost where possible (using QTcpServer) * Reduce the number of daemons required in the test server (e.g., IMAP server)
  • DH key exchange * no public API * easy to implement, hard to test
  • OCSP * adds latency: needs to query the OCSP server * Richard implemented one year ago * still works, but hasn't worked on it in a while * enabled by default * QSslSocket level
  • Certificate store: * storing intermediate certs from broken servers that don't return the whole chain * browsers do that to work around issues in the wild * adds security * certificates are not trusted, so they don't add a new security attack vector * virtual QSslCertificate QAbstractSslCertificateStore::certificateForId(QSslCertificateId)
  • QNAM redirects * discussed in the DD Contributor Day * vector for insecurity (users do it wrong) * should be configurable * we don't need to fix this for the browser case → they already have the code * we need it only for the simple application cases * allow redirect from HTTP to HTTPS, allow within-protocol * could work with pausing * readyRead & metaDataChanged from the final, sslErrors per connection
  • Pause on connect: * Already discussed, implementation challenges and details known * Work is missing (Peter doesn't have time)
  • Performance: latency problems * Helped by the pre-connect
  • Replacing QNAM port: * With Blink: * difficult, it's too big for QtNetwork * no guarantee that we'll get a "library" interface * libcurl: * they're behind us
  • SPDY / HTTP/2.0: * HTTP/2.0 adopted SPDY 3.0's transport format * we can start supporting SPDY to get on our way to HTTP/2.0 * libcurl has started