whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QSslSocket (SecureTransport) - use anchors only from QSslConfiguration 

Calling SecTrustSetAnchorCertificatesOnly(trust, false) we actually extend
what our user provided in QSslConfiguration as CA certificates (caCertificates,
setCaCertificates) - Secure Transport will also use a default set provided
by the system and SSL handshake can surprisingly (for a user) succeed.
And the default content of these caCertificates, if not altered by setCaCertificates
call - are those system CA certificates.

Task-number: QTBUG-60233
Change-Id: I8c1094bb7eec260f5202a47085f9f75e720eda7b
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
bb10
Timur Pocheptsov 2017-04-24 16:33:08 +02:00
parent e5a1c7fff7
commit 2d2dd85766
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/network/ssl/qsslsocket_mac.cpp
View File

@ -1223,7 +1223,8 @@ bool QSslSocketBackendPrivate::verifyPeerTrust()
CFArrayAppendValue(certArray, certRef);
}
SecTrustSetAnchorCertificates(trust, certArray);
SecTrustSetAnchorCertificatesOnly(trust, false);
// Secure Transport should use anchors only from our QSslConfiguration:
SecTrustSetAnchorCertificatesOnly(trust, true);
SecTrustResultType trustResult = kSecTrustResultInvalid;
SecTrustEvaluate(trust, &trustResult);