Skip to content

Commit

Permalink
[auth] Merge CAs added by PKI bundles to the trusted CAs
Browse files Browse the repository at this point in the history
  • Loading branch information
elpaso committed Oct 16, 2017
1 parent 7b7dad0 commit 032f225
Show file tree
Hide file tree
Showing 6 changed files with 14 additions and 12 deletions.
1 change: 1 addition & 0 deletions src/auth/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,4 @@ ADD_SUBDIRECTORY(basic)
ADD_SUBDIRECTORY(identcert)
ADD_SUBDIRECTORY(pkipaths)
ADD_SUBDIRECTORY(pkipkcs12)
ADD_SUBDIRECTORY(oauth2)
11 changes: 5 additions & 6 deletions src/auth/pkipaths/qgsauthpkipathsmethod.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -98,22 +98,21 @@ bool QgsAuthPkiPathsMethod::updateNetworkRequest( QNetworkRequest &request, cons
QSslConfiguration sslConfig = request.sslConfiguration();
//QSslConfiguration sslConfig( QSslConfiguration::defaultConfiguration() );

sslConfig.setLocalCertificate( pkibundle->clientCert() );
sslConfig.setPrivateKey( pkibundle->clientCertKey() );
sslConfig.setLocalCertificate( pkibundle->clientCert() );

// add extra CAs in the bundle
// add extra CAs from the bundle
// this does not work due to the fact that QNAM overrides it in createRequest!
if ( pkibundle->config().config( QStringLiteral( "addcas" ), QStringLiteral( "false" ) ) == QStringLiteral( "true" ) )
{
QList<QSslCertificate> cas;
cas = QgsAuthCertUtils::casMerge( QgsAuthManager::instance()->getTrustedCaCerts(), pkibundle->caChain() );
sslConfig.setCaCertificates( cas );
sslConfig.setCaCertificates( pkibundle->caChain() );
}

request.setSslConfiguration( sslConfig );

return true;
}


bool QgsAuthPkiPathsMethod::updateDataSourceUriItems( QStringList &connectionItems, const QString &authcfg,
const QString &dataprovider )
{
Expand Down
4 changes: 1 addition & 3 deletions src/auth/pkipkcs12/qgsauthpkcs12method.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -103,9 +103,7 @@ bool QgsAuthPkcs12Method::updateNetworkRequest( QNetworkRequest &request, const

if ( pkibundle->config().config( QStringLiteral( "addcas" ), QStringLiteral( "false" ) ) == QStringLiteral( "true" ) )
{
QList<QSslCertificate> cas;
cas = QgsAuthCertUtils::casMerge( QgsAuthManager::instance()->getTrustedCaCerts(), pkibundle->caChain() );
sslConfig.setCaCertificates( cas );
sslConfig.setCaCertificates( pkibundle->caChain() );
}

request.setSslConfiguration( sslConfig );
Expand Down
1 change: 0 additions & 1 deletion src/core/auth/qgsauthmanager.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1401,7 +1401,6 @@ bool QgsAuthManager::updateNetworkRequest( QNetworkRequest &request, const QStri
}
return true;
}

return false;
}

Expand Down
4 changes: 2 additions & 2 deletions src/core/qgsnetworkaccessmanager.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -184,8 +184,8 @@ QNetworkReply *QgsNetworkAccessManager::createRequest( QNetworkAccessManager::Op
{
QgsDebugMsg( "Adding trusted CA certs to request" );
QSslConfiguration sslconfig( pReq->sslConfiguration() );
sslconfig.setCaCertificates( QgsAuthManager::instance()->getTrustedCaCertsCache() );

// Merge trusted CAs with any additional CAs added by the authentication methods
sslconfig.setCaCertificates( QgsAuthCertUtils::casMerge( QgsAuthManager::instance()->getTrustedCaCertsCache(), sslconfig.caCertificates( ) ) );
// check for SSL cert custom config
QString hostport( QStringLiteral( "%1:%2" )
.arg( pReq->url().host().trimmed() )
Expand Down
5 changes: 5 additions & 0 deletions src/gui/auth/qgsauthsslerrorsdialog.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,11 @@ void QgsAuthSslErrorsDialog::showCertificateChainInfo()

void QgsAuthSslErrorsDialog::showCertificateChainCAsInfo()
{
for ( const auto &cert : mSslConfiguration.caCertificates() )
{
qDebug() << cert.subjectInfo( QSslCertificate::SubjectInfo::CommonName );
}

QgsAuthTrustedCAsDialog *dlg = new QgsAuthTrustedCAsDialog( this, mSslConfiguration.caCertificates() );
dlg->setWindowModality( Qt::WindowModal );
dlg->resize( 675, 500 );
Expand Down

0 comments on commit 032f225

Please sign in to comment.