mirrors/mumble
2
0
Fork 0
mirror of https://github.com/mumble-voip/mumble.git synced 2025-10-26 11:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

MetaParams: replace SSL settings setup code with a call to loadSSLSettings().

Browse Source 
This changes MetaParams to use the newly-introduced loadSSLSettings() method
to load SSL settings.
This commit is contained in:
Mikkel Krautz 2017-02-28 03:10:32 +01:00
parent fd78d6431e
commit 09d4bd33fb
1 changed files with 2 additions and 138 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

140
src/murmur/Meta.cpp
View File

@ -365,144 +365,8 @@ void MetaParams::read(QString fname) {
bSendVersion = typeCheckedFromSettings("sendversion", bSendVersion);
bAllowPing = typeCheckedFromSettings("allowping", bAllowPing);
qsCiphers = typeCheckedFromSettings("sslCiphers", qsCiphers);
QString qsSSLCert = qsSettings->value("sslCert").toString();
QString qsSSLKey = qsSettings->value("sslKey").toString();
QString qsSSLCA = qsSettings->value("sslCA").toString();
QString qsSSLDHParams = qsSettings->value("sslDHParams").toString();
qbaPassPhrase = qsSettings->value("sslPassPhrase").toByteArray();
if (! qsSSLCA.isEmpty()) {
QFile pem(qsSSLCA);
if (pem.open(QIODevice::ReadOnly)) {
QByteArray qba = pem.readAll();
pem.close();
QList<QSslCertificate> ql = QSslCertificate::fromData(qba);
if (ql.isEmpty()) {
qCritical("Failed to parse any CA certificates from %s", qPrintable(qsSSLCA));
} else {
qlCA = ql;
}
} else {
qCritical("Failed to read %s", qPrintable(qsSSLCA));
}
}
QByteArray crt, key, dhparams;
if (! qsSSLCert.isEmpty()) {
QFile pem(qsSSLCert);
if (pem.open(QIODevice::ReadOnly)) {
crt = pem.readAll();
pem.close();
} else {
qCritical("Failed to read %s", qPrintable(qsSSLCert));
}
}
if (! qsSSLKey.isEmpty()) {
QFile pem(qsSSLKey);
if (pem.open(QIODevice::ReadOnly)) {
key = pem.readAll();
pem.close();
} else {
qCritical("Failed to read %s", qPrintable(qsSSLKey));
}
}
if (! key.isEmpty() || ! crt.isEmpty()) {
if (! key.isEmpty()) {
qskKey = Server::privateKeyFromPEM(key, qbaPassPhrase);
}
if (qskKey.isNull() && ! crt.isEmpty()) {
qskKey = Server::privateKeyFromPEM(crt, qbaPassPhrase);
if (! qskKey.isNull())
qCritical("Using private key found in certificate file.");
}
if (qskKey.isNull())
qFatal("No private key found in certificate or key file.");
QList<QSslCertificate> ql = QSslCertificate::fromData(crt);
ql << QSslCertificate::fromData(key);
for (int i=0;i<ql.size(); ++i) {
const QSslCertificate &c = ql.at(i);
if (Server::isKeyForCert(qskKey, c)) {
qscCert = c;
ql.removeAt(i);
break;
}
}
if (qscCert.isNull()) {
qFatal("Failed to find certificate matching private key.");
}
if (ql.size() > 0) {
qlIntermediates = ql;
qCritical("Adding %d intermediate certificates from certificate file.", ql.size());
}
}
#if defined(USE_QSSLDIFFIEHELLMANPARAMETERS)
if (! qsSSLDHParams.isEmpty()) {
QFile pem(qsSSLDHParams);
if (pem.open(QIODevice::ReadOnly)) {
dhparams = pem.readAll();
pem.close();
} else {
qCritical("Failed to read %s", qPrintable(qsSSLDHParams));
}
}
if (! dhparams.isEmpty()) {
QSslDiffieHellmanParameters qdhp = QSslDiffieHellmanParameters::fromEncoded(dhparams);
if (qdhp.isValid()) {
qbaDHParams = dhparams;
} else {
qFatal("Unable to use specified Diffie-Hellman parameters: %s", qPrintable(qdhp.errorString()));
}
}
#else
if (! qsSSLDHParams.isEmpty()) {
qFatal("This version of Murmur does not support Diffie-Hellman parameters (sslDHParams). Murmur will not start unless you remove the option from your murmur.ini file.");
}
#endif
{
QList<QSslCipher> ciphers = MumbleSSL::ciphersFromOpenSSLCipherString(qsCiphers);
if (ciphers.isEmpty()) {
qFatal("Invalid sslCiphers option. Either the cipher string is invalid or none of the ciphers are available: \"%s\"", qPrintable(qsCiphers));
}
#if !defined(USE_QSSLDIFFIEHELLMANPARAMETERS)
// If the version of Qt we're building against doesn't support
// QSslDiffieHellmanParameters, then we must filter out Diffie-
// Hellman cipher suites in order to guarantee that we do not
// use Qt's default Diffie-Hellman parameters.
{
QList<QSslCipher> filtered;
foreach (QSslCipher c, ciphers) {
if (c.keyExchangeMethod() == QLatin1String("DH")) {
continue;
}
filtered << c;
}
if (ciphers.size() != filtered.size()) {
qWarning("Warning: all cipher suites in sslCiphers using Diffie-Hellman key exchange "
"have been removed. Qt %s does not support custom Diffie-Hellman parameters.",
qVersion());
}
qlCiphers = filtered;
}
#else
qlCiphers = ciphers;
#endif
QStringList pref;
foreach (QSslCipher c, qlCiphers) {
pref << c.name();
}
qWarning("Meta: TLS cipher preference is \"%s\"", qPrintable(pref.join(QLatin1String(":"))));
if (!loadSSLSettings()) {
qFatal("MetaParams: Failed to load SSL settings. See previous errors.");
}
QStringList hosts;