1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
diff -ruN kdelibs-4.4.5.orig/kio/kio/tcpslavebase.cpp kdelibs-4.4.5/kio/kio/tcpslavebase.cpp
--- kdelibs-4.4.5.orig/kio/kio/tcpslavebase.cpp 2010-04-29 21:52:23.000000000 +0200
+++ kdelibs-4.4.5/kio/kio/tcpslavebase.cpp 2011-03-09 10:31:37.000000000 +0100
@@ -490,8 +490,6 @@
// domain<->certificate matching here.
d->sslErrors = d->socket.sslErrors();
QSslCertificate peerCert = d->socket.peerCertificateChain().first();
- QStringList domainPatterns(peerCert.subjectInfo(QSslCertificate::CommonName));
- domainPatterns += peerCert.alternateSubjectNames().values(QSsl::DnsEntry);
QRegExp domainMatcher(QString(), Qt::CaseInsensitive, QRegExp::Wildcard);
QMutableListIterator<KSslError> it(d->sslErrors);
while (it.hasNext()) {
@@ -499,16 +498,29 @@
// *in the case of HostNameMismatch*. A HostNameMismatch, however, will always
// be an error of the peer certificate so we just don't check the error's
// certificate().
- if (it.next().error() != KSslError::HostNameMismatch) {
- continue;
- }
- foreach (const QString &dp, domainPatterns) {
- domainMatcher.setPattern(dp);
- if (domainMatcher.exactMatch(d->host)) {
- it.remove();
- }
+
+ // Remove all HostNameMismatch, we have to redo name checking later.
+ if (it.next().error() == KSslError::HostNameMismatch) {
+ it.remove();
}
}
+ // Redo name checking here and (re-)insert HostNameMismatch to sslErrors if
+ // host name does not match any of the names in server certificate.
+ // QSslSocket may not report HostNameMismatch error, when server
+ // certificate was issued for the IP we are connecting to.
+ QStringList domainPatterns(peerCert.subjectInfo(QSslCertificate::CommonName));
+ domainPatterns += peerCert.alternateSubjectNames().values(QSsl::DnsEntry);
+ bool names_match = false;
+ foreach (const QString &dp, domainPatterns) {
+ domainMatcher.setPattern(dp);
+ if (domainMatcher.exactMatch(d->host)) {
+ names_match = true;
+ break;
+ }
+ }
+ if (!names_match) {
+ d->sslErrors.insert(0, KSslError(KSslError::HostNameMismatch, peerCert));
+ }
// The app side needs the metadata now for the SSL error dialog (if any) but
// the same metadata will be needed later, too. When "later" arrives the slave
|
GitWeb
