whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SecureTransport: clean the code a bit 

As discussed/proposed previously: remove the duplicated code when converting the
native certificate representation into QSslCertificate (configuration.peerCertificate).
Also, use the correct integer type when iterating - CFIndex is actually long, not int.

Change-Id: Ia6f43172e21b5153a93f1ef2589980d68ec2b39f
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
bb10
Timur Pocheptsov 2018-08-07 09:26:07 +02:00
parent 5b8d5c7493
commit c1117ac496
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/network/ssl/qsslsocket_mac.cpp
View File

@ -1248,9 +1248,8 @@ bool QSslSocketBackendPrivate::verifyPeerTrust()
}
QList<QSslError> errors;
// store certificates
const int certCount = SecTrustGetCertificateCount(trust);
// Store certificates.
// Apple's docs say SetTrustEvaluate must be called before
// SecTrustGetCertificateAtIndex, but this results
// in 'kSecTrustResultRecoverableTrustFailure', so
@ -1270,19 +1269,17 @@ bool QSslSocketBackendPrivate::verifyPeerTrust()
configuration.peerCertificate.clear();
configuration.peerCertificateChain.clear();
for (int i = 0; i < certCount; ++i) {
const CFIndex certCount = SecTrustGetCertificateCount(trust);
for (CFIndex i = 0; i < certCount; ++i) {
SecCertificateRef cert = SecTrustGetCertificateAtIndex(trust, i);
QCFType<CFDataRef> derData = SecCertificateCopyData(cert);
configuration.peerCertificateChain << QSslCertificate(QByteArray::fromCFData(derData), QSsl::Der);
}
if (certCount > 0) {
SecCertificateRef cert = SecTrustGetCertificateAtIndex(trust, 0);
QCFType<CFDataRef> derData = SecCertificateCopyData(cert);
configuration.peerCertificate = QSslCertificate(QByteArray::fromCFData(derData), QSsl::Der);
}
if (configuration.peerCertificateChain.size())
configuration.peerCertificate = configuration.peerCertificateChain.at(0);
// check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer)
// Check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer):
for (const QSslCertificate &cert : qAsConst(configuration.peerCertificateChain)) {
if (QSslCertificatePrivate::isBlacklisted(cert) && !canIgnoreVerify) {
const QSslError error(QSslError::CertificateBlacklisted, cert);