Windows: Workaround for CredWriteW used by QtKeychain #1394
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Saving all client CA's within one credential may result in: Error: "Credential size exceeds maximum size of 2560" Client CA certificates are now being stored in separate slots within the keychain and are being processed by a queue mechanism. IMPORTANT TODO: forgetSensitiveData(): Invoked by "Log out" & "Remove account" - Remove client CA certs and KEY! (uncomment "//deleteKeychainEntries();" ) Disabled as long as selecting another cert is not supported by the UI. Signed-off-by: Michael Schuster <michael@schuster.ms>
Signed-off-by: Michael Schuster <michael@schuster.ms>
misch7
added a commit
that referenced
this pull request
Dec 7, 2019
With QtKeychain on Windows, storing larger keys in one keychain entry causes the following error due to limits in the Windows APIs: Error: "Credential size exceeds maximum size of 2560" To avoid overhead on the other platforms and balance code duplication, this approach puts some read- and write-parts into Windows-only defines. For reference also see previous fixes: - #1389 - #1394 This (again) fixes the re-opened issue: - #863 Signed-off-by: Michael Schuster <michael@schuster.ms>
3 tasks
misch7
added a commit
that referenced
this pull request
Dec 8, 2019
With QtKeychain on Windows, storing larger keys in one keychain entry causes the following error due to limits in the Windows APIs: Error: "Credential size exceeds maximum size of 2560" To avoid overhead on the other platforms and balance code duplication, this approach puts some read- and write-parts into Windows-only defines. For reference also see previous fixes: - #1389 - #1394 This (again) fixes the re-opened issue: - #863 Signed-off-by: Michael Schuster <michael@schuster.ms>
misch7
added a commit
that referenced
this pull request
Dec 8, 2019
With QtKeychain on Windows, storing larger keys in one keychain entry causes the following error due to limits in the Windows APIs: Error: "Credential size exceeds maximum size of 2560" To avoid overhead on the other platforms and balance code duplication, this approach puts some read- and write-parts into Windows-only defines. For reference also see previous fixes: - #1389 - #1394 This (again) fixes the re-opened issue: - #863 Signed-off-by: Michael Schuster <michael@schuster.ms> (cherry picked from commit 72be80c) Signed-off-by: Michael Schuster <michael@schuster.ms>
misch7
added a commit
that referenced
this pull request
Dec 24, 2019
…t SSL keys and large certs
With QtKeychain on Windows, storing larger keys or certs in one keychain entry causes the
following error due to limits in the Windows APIs:
Error: "Credential size exceeds maximum size of 2560"
This fix implements the new wrapper class KeychainChunk with wrapper jobs ReadJob and WriteJob
to encapsulate the QKeychain handling of ReadPasswordJob and WritePasswordJob with binaryData
but split every supplied keychain entry's data into 2048 byte chunks, on Windows only.
The wrapper is used for all keychain operations in WebFlowCredentials, except for the server password.
All finished keychain jobs now get deleted properly, to avoid memory leaks.
For reference also see previous fixes:
- #1389
- #1394
This should finally fix the re-opened issue:
- #863
Signed-off-by: Michael Schuster <michael@schuster.ms>
misch7
added a commit
that referenced
this pull request
Dec 24, 2019
…t SSL keys and large certs
With QtKeychain on Windows, storing larger keys or certs in one keychain entry causes the
following error due to limits in the Windows APIs:
Error: "Credential size exceeds maximum size of 2560"
This fix implements the new wrapper class KeychainChunk with wrapper jobs ReadJob and WriteJob
to encapsulate the QKeychain handling of ReadPasswordJob and WritePasswordJob with binaryData
but split every supplied keychain entry's data into 2048 byte chunks, on Windows only.
The wrapper is used for all keychain operations in WebFlowCredentials, except for the server password.
All finished keychain jobs now get deleted properly, to avoid memory leaks.
For reference also see previous fixes:
- #1389
- #1394
This should finally fix the re-opened issue:
- #863
Signed-off-by: Michael Schuster <michael@schuster.ms>
misch7
added a commit
that referenced
this pull request
Dec 24, 2019
…t SSL keys and large certs
With QtKeychain on Windows, storing larger keys or certs in one keychain entry causes the
following error due to limits in the Windows APIs:
Error: "Credential size exceeds maximum size of 2560"
This fix implements the new wrapper class KeychainChunk with wrapper jobs ReadJob and WriteJob
to encapsulate the QKeychain handling of ReadPasswordJob and WritePasswordJob with binaryData
but split every supplied keychain entry's data into 2048 byte chunks, on Windows only.
The wrapper is used for all keychain operations in WebFlowCredentials, except for the server password.
All finished keychain jobs now get deleted properly, to avoid memory leaks.
For reference also see previous fixes:
- #1389
- #1394
This should finally fix the re-opened issue:
- #863
Signed-off-by: Michael Schuster <michael@schuster.ms>
(cherry picked from commit 9b034a2)
Signed-off-by: Michael Schuster <michael@schuster.ms>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Saving all client CA's within one credential may result in:
Error: "Credential size exceeds maximum size of 2560"
Client CA certificates are now being stored in separate slots
within the keychain and are being processed by a queue mechanism.
IMPORTANT TODO:
forgetSensitiveData(): Invoked by "Log out" & "Remove account"
Remove client CA certs and KEY!
(uncomment "//deleteKeychainEntries();" )
Disabled as long as selecting another cert is not supported by the UI.
Signed-off-by: Michael Schuster