whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QDtls: respect pre-set verification errors 

That's actually how ignoreVerificationErrors (and QSslSocket::ignoreSslErrors)
are used to set the expected/known verification errors before handshake.
Auto-test updated too.

Change-Id: I9c700302d81ddb383a4a750fafd594373fb38ace
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
bb10
Timur Pocheptsov 2018-07-31 10:43:00 +02:00
parent 10f254b234
commit 5c7d2033e0
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/network/ssl/qdtls_openssl.cpp
View File

@ -1054,7 +1054,7 @@ bool QDtlsPrivateOpenSSL::continueHandshake(QUdpSocket *socket, const QByteArray
|| (dtlsConfiguration.peerVerifyMode == QSslSocket::AutoVerifyPeer
&& mode == QSslSocket::SslClientMode);
if (!doVerifyPeer || verifyPeer()) {
if (!doVerifyPeer || verifyPeer() || tlsErrorsWereIgnored()) {
connectionEncrypted = true;
handshakeState = QDtls::HandshakeComplete;
return true;

27
tests/auto/network/ssl/qdtls/tst_qdtls.cpp
View File

@ -41,6 +41,7 @@
#include <QtCore/qcryptographichash.h>
#include <QtCore/qbytearray.h>
#include <QtCore/qvector.h>
#include <QtCore/qstring.h>
#include <QtCore/qobject.h>
@ -99,6 +100,7 @@ private slots:
void protocolVersionMatching();
void verificationErrors_data();
void verificationErrors();
void ignoreExpectedErrors();
void verifyServerCertificate_data();
void verifyServerCertificate();
void verifyClientCertificate_data();
@ -685,6 +687,31 @@ void tst_QDtls::verificationErrors()
}
}
void tst_QDtls::ignoreExpectedErrors()
{
connectHandshakeReadingSlots();
auto serverConfig = defaultServerConfig;
serverConfig.setPrivateKey(serverKeySS);
serverConfig.setLocalCertificate(selfSignedCert);
QVERIFY(serverCrypto->setDtlsConfiguration(serverConfig));
const QVector<QSslError> expectedErrors = {{QSslError::HostNameMismatch, selfSignedCert},
{QSslError::SelfSignedCertificate, selfSignedCert}};
clientCrypto->ignoreVerificationErrors(expectedErrors);
QVERIFY(clientCrypto->setPeer(serverAddress, serverPort));
QVERIFY(clientCrypto->doHandshake(&clientSocket));
testLoop.enterLoopMSecs(handshakeTimeoutMS);
QVERIFY(!testLoop.timeout());
QDTLS_VERIFY_HANDSHAKE_SUCCESS(serverCrypto);
QCOMPARE(clientCrypto->handshakeState(), QDtls::HandshakeComplete);
QVERIFY(clientCrypto->isConnectionEncrypted());
}
void tst_QDtls::verifyServerCertificate_data()
{
QTest::addColumn<QSslSocket::PeerVerifyMode>("verifyMode");