Skip to content
This repository was archived by the owner on Feb 27, 2023. It is now read-only.

Commit bab5482

Browse files
authored
Fix cert errors (#604)
* Fix certificate errors
1 parent 5956193 commit bab5482

File tree

4 files changed

+145
-11
lines changed

4 files changed

+145
-11
lines changed
Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
--- /dev/null
2+
+++ b/src/network/certfix.cpp
3+
@@ -0,0 +1,102 @@
4+
+/****************************************************************************
5+
+**
6+
+** Copyright (C) 2017 The Qt Company Ltd.
7+
+** Copyright (C) 2014 Governikus GmbH & Co. KG
8+
+** Contact: https://www.qt.io/licensing/
9+
+**
10+
+** This file is part of the QtNetwork module of the Qt Toolkit.
11+
+**
12+
+** $QT_BEGIN_LICENSE:LGPL$
13+
+** Commercial License Usage
14+
+** Licensees holding valid commercial Qt licenses may use this file in
15+
+** accordance with the commercial license agreement provided with the
16+
+** Software or, alternatively, in accordance with the terms contained in
17+
+** a written agreement between you and The Qt Company. For licensing terms
18+
+** and conditions see https://www.qt.io/terms-conditions. For further
19+
+** information use the contact form at https://www.qt.io/contact-us.
20+
+**
21+
+** GNU Lesser General Public License Usage
22+
+** Alternatively, this file may be used under the terms of the GNU Lesser
23+
+** General Public License version 3 as published by the Free Software
24+
+** Foundation and appearing in the file LICENSE.LGPL3 included in the
25+
+** packaging of this file. Please review the following information to
26+
+** ensure the GNU Lesser General Public License version 3 requirements
27+
+** will be met: https://www.gnu.org/licenses/lgpl-3.0.html.
28+
+**
29+
+** GNU General Public License Usage
30+
+** Alternatively, this file may be used under the terms of the GNU
31+
+** General Public License version 2.0 or (at your option) the GNU General
32+
+** Public license version 3 or any later version approved by the KDE Free
33+
+** Qt Foundation. The licenses are as published by the Free Software
34+
+** Foundation and appearing in the file LICENSE.GPL2 and LICENSE.GPL3
35+
+** included in the packaging of this file. Please review the following
36+
+** information to ensure the GNU General Public License requirements will
37+
+** be met: https://www.gnu.org/licenses/gpl-2.0.html and
38+
+** https://www.gnu.org/licenses/gpl-3.0.html.
39+
+**
40+
+** $QT_END_LICENSE$
41+
+**
42+
+****************************************************************************/
43+
+
44+
+/****************************************************************************
45+
+**
46+
+** In addition, as a special exception, the copyright holders listed above give
47+
+** permission to link the code of its release of Qt with the OpenSSL project's
48+
+** "OpenSSL" library (or modified versions of the "OpenSSL" library that use the
49+
+** same license as the original version), and distribute the linked executables.
50+
+**
51+
+** You must comply with the GNU General Public License version 2 in all
52+
+** respects for all of the code used other than the "OpenSSL" code. If you
53+
+** modify this file, you may extend this exception to your version of the file,
54+
+** but you are not obligated to do so. If you do not wish to do so, delete
55+
+** this exception statement from your version of this file.
56+
+**
57+
+****************************************************************************/
58+
+
59+
+#include <QDirIterator>
60+
+#include <QDir>
61+
+#include <qsslconfiguration.h>
62+
+#include <qsslerror.h>
63+
+
64+
+QList<QByteArray> unixRootCertDirectories_backport()
65+
+{
66+
+ return QList<QByteArray>() << "/etc/ssl/certs/" // (K)ubuntu, OpenSUSE, Mandriva ...
67+
+ << "/usr/lib/ssl/certs/" // Gentoo, Mandrake
68+
+ << "/usr/share/ssl/" // Centos, Redhat, SuSE
69+
+ << "/usr/local/ssl/" // Normal OpenSSL Tarball
70+
+ << "/var/ssl/certs/" // AIX
71+
+ << "/usr/local/ssl/certs/" // Solaris
72+
+ << "/etc/openssl/certs/" // BlackBerry
73+
+ << "/opt/openssl/certs/" // HP-UX
74+
+ << "/etc/ssl/"; // OpenBSD
75+
+}
76+
+
77+
+QList<QSslCertificate> systemCaCertificates_backport()
78+
+{
79+
+ QList<QSslCertificate> systemCerts;
80+
+ QList<QString> certFiles;
81+
+ QDir currentDir;
82+
+ QStringList nameFilters;
83+
+ QList<QByteArray> directories;
84+
+ QSsl::EncodingFormat platformEncodingFormat;
85+
+ directories = unixRootCertDirectories_backport();
86+
+ nameFilters << QLatin1String("*.pem") << QLatin1String("*.crt");
87+
+ platformEncodingFormat = QSsl::Pem;
88+
+ {
89+
+ currentDir.setNameFilters(nameFilters);
90+
+ for (int a = 0; a < directories.count(); a++) {
91+
+ currentDir.setPath(QLatin1String(directories.at(a)));
92+
+ QDirIterator it(currentDir);
93+
+ while (it.hasNext()) {
94+
+ it.next();
95+
+ certFiles.insert(certFiles.size(), it.fileInfo().canonicalFilePath());
96+
+ }
97+
+ }
98+
+ for (int a = 0; a < certFiles.count(); a++)
99+
+ systemCerts.append(QSslCertificate::fromPath(certFiles.at(a), platformEncodingFormat));
100+
+ systemCerts.append(QSslCertificate::fromPath(QLatin1String("/etc/pki/tls/certs/ca-bundle.crt"), QSsl::Pem));
101+
+ systemCerts.append(QSslCertificate::fromPath(QLatin1String("/usr/local/share/certs/ca-root-nss.crt"), QSsl::Pem));
102+
+ }
103+
+
104+
+ return systemCerts;
105+
+}
106+
--- a/src/network/networkaccessmanager.cpp
107+
+++ b/src/network/networkaccessmanager.cpp
108+
@@ -88,6 +88,8 @@
109+
#include <qsslerror.h>
110+
#include <qdatetime.h>
111+
112+
+#include "certfix.cpp"
113+
+
114+
// #define NETWORKACCESSMANAGER_DEBUG
115+
116+
NetworkAccessManager::NetworkAccessManager(QObject *parent)
117+
@@ -164,6 +166,7 @@ void NetworkAccessManager::loadSettings()
118+
119+
#ifndef QT_NO_OPENSSL
120+
QSslConfiguration sslCfg = QSslConfiguration::defaultConfiguration();
121+
+ sslCfg.setCaCertificates(systemCaCertificates_backport());
122+
QList<QSslCertificate> ca_list = sslCfg.caCertificates();
123+
QList<QSslCertificate> ca_new = QSslCertificate::fromData(settings.value(QLatin1String("CaCertificates")).toByteArray());
124+
ca_list += ca_new;

buildroot/package/ca-certificates/Config.in

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ config BR2_PACKAGE_CA_CERTIFICATES
66
connections.
77

88
It includes, among others, certificate authorities used by the
9-
Debian infrastructure and those shipped with Mozilla's browsers.
9+
Debian infrastructure and those shipped with Mozilla's
10+
browsers.
1011

11-
http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git
12+
https://salsa.debian.org/debian/ca-certificates
Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
# hashes from: $(CA_CERTIFICATES_SITE)/ca-certificates_$(CA_CERTIFICATES_VERSION).dsc :
2-
sha1 6013ce6a3bf13e73a7e1feddcd17f5b2c09e5bd3 ca-certificates_20141019.tar.xz
3-
sha256 684902d3f4e9ad27829f4af0d9d2d588afed03667997579b9c2be86fcd1eb73a ca-certificates_20141019.tar.xz
2+
sha1 47d4584eae85fc905e4994766eb3930a8a84e2e1 ca-certificates_20190110.tar.xz
3+
sha256 ee4bf0f4c6398005f5b5ca4e0b87b82837ac5c3b0280a1cb3a63c47555c3a675 ca-certificates_20190110.tar.xz
4+
5+
# Locally computed
6+
sha256 80fd11117df5543d5cf17bfd951b0ead213f7867d0b09f09c6d5a5eca3ff7422 debian/copyright

buildroot/package/ca-certificates/ca-certificates.mk

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,34 +4,40 @@
44
#
55
################################################################################
66

7-
CA_CERTIFICATES_VERSION = 20141019
7+
CA_CERTIFICATES_VERSION = 20190110
88
CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
9-
CA_CERTIFICATES_SITE = http://snapshot.debian.org/archive/debian/20141023T043132Z/pool/main/c/ca-certificates
9+
CA_CERTIFICATES_SITE = http://snapshot.debian.org/archive/debian/20190513T145054Z/pool/main/c/ca-certificates
1010
CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python
11-
CA_CERTIFICATES_LICENSE = GPLv2+ (script), MPLv2.0 (data)
11+
CA_CERTIFICATES_LICENSE = GPL-2.0+ (script), MPL-2.0 (data)
1212
CA_CERTIFICATES_LICENSE_FILES = debian/copyright
1313

1414
define CA_CERTIFICATES_BUILD_CMDS
15-
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) all
15+
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) clean all
1616
endef
1717

1818
define CA_CERTIFICATES_INSTALL_TARGET_CMDS
1919
$(INSTALL) -d -m 0755 $(TARGET_DIR)/usr/share/ca-certificates
2020
$(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/ssl/certs
21-
$(MAKE) -C $(@D) install DESTDIR=$(TARGET_DIR)
21+
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) install DESTDIR=$(TARGET_DIR)
2222
rm -f $(TARGET_DIR)/usr/sbin/update-ca-certificates
2323

2424
# Remove any existing certificates under /etc/ssl/certs
2525
rm -f $(TARGET_DIR)/etc/ssl/certs/*
2626

2727
# Create symlinks to certificates under /etc/ssl/certs
28+
# and generate the bundle
2829
cd $(TARGET_DIR) ;\
29-
for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
30+
for i in `find usr/share/ca-certificates -name "*.crt" | LC_COLLATE=C sort` ; do \
3031
ln -sf ../../../$$i etc/ssl/certs/`basename $${i} .crt`.pem ;\
31-
done
32+
cat $$i ;\
33+
done >$(@D)/ca-certificates.crt
3234

3335
# Create symlinks to the certificates by their hash values
3436
$(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs
37+
38+
# Install the certificates bundle
39+
$(INSTALL) -D -m 644 $(@D)/ca-certificates.crt \
40+
$(TARGET_DIR)/etc/ssl/certs/ca-certificates.crt
3541
endef
3642

3743
$(eval $(generic-package))

0 commit comments

Comments
 (0)