mirrors/mumble
2
0
Fork 0
mirror of https://github.com/mumble-voip/mumble.git synced 2025-10-26 11:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Meta: avoid cluttering the global QSslSocket::defaultCaCertificates() list.

Browse Source 
Before this commit, we would add any intermediate certificates found in
the SSL certificate's PEM bundle to the default CA list via
QSslSocket::addDefaultCaCertificates().
We would also add any certificates found in the sslCA PEM bundle to the
default CA list, using the same method.

Due to the way the hot-reload feature for SSL settings is going to work,
these patterns wouldn't work well in that environment, because reloading
the settings would keep adding entries to the global QSslSocket default
CA certificates list. (QSslSocket::defaultCaCertificates())

To combat this, this series of commits try to be more strict about how
default CAs and intermediates in general are handled.

Generally, instead of adding them to the global QSslSocket default CA
list, we add them to each QSslSocket as necessary.

Note: this commit does not stand on its own. It requires the follow-up
commits in this PR. It is split out to aid in reviewing.
This commit is contained in:
Mikkel Krautz 2017-02-25 23:10:38 +01:00
parent e95dd303fb
commit d5f04b4223
2 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/murmur/Meta.cpp
View File

@ -374,7 +374,7 @@ void MetaParams::read(QString fname) {
if (ql.isEmpty()) {
qCritical("Failed to parse any CA certificates from %s", qPrintable(qsSSLCA));
} else {
QSslSocket::addDefaultCaCertificates(ql);
qlCA = ql;
}
} else {
qCritical("Failed to read %s", qPrintable(qsSSLCA));
@ -428,8 +428,8 @@ void MetaParams::read(QString fname) {
qFatal("Failed to find certificate matching private key.");
}
if (ql.size() > 0) {
QSslSocket::addDefaultCaCertificates(ql);
qCritical("Adding %d CA certificates from certificate file.", ql.size());
qlIntermediates = ql;
qCritical("Adding %d intermediate certificates from certificate file.", ql.size());
}
}

16
src/murmur/Meta.h
View File

@ -93,6 +93,22 @@ public:
QSslCertificate qscCert;
QSslKey qskKey;
/// qlIntermediates contains the certificates
/// from PEM bundle pointed to by murmur.ini's
/// sslCert option that do not match the key
/// pointed to by murmur.ini's sslKey option.
///
/// Simply put: it contains any certificates
/// that aren't the main certificate, or "leaf"
/// certificate.
QList<QSslCertificate> qlIntermediates;
/// qlCA contains all certificates read from
/// the PEM bundle pointed to by murmur.ini's
/// sslCA option.
QList<QSslCertificate> qlCA;
QByteArray qbaDHParams;
QByteArray qbaPassPhrase;
QString qsCiphers;